Outbound connection to 172.111.239.90 every minute

[JayLee71]

Hello

I think my PC is infected with something. Every minute I get "Website blocked due to malware" alert to IP: 172.111.29.90.

Please help me fix this issue.

I ran FRST64 and attaching the output files.

Thank you 

Jay

 

Addition.txt FRST.txt

[JayLee71]

Please close this. I ran your removal software and it seems to have fixed the problem, I am no longer getting the outbound alerts.

[AdvancedSetup]

Hello @JayLee71 and

Because symptoms are gone does not necessarily mean the computer is clean. It's up to you, but I'd suggest you allow us to take a closer look.

If you'd like us to review, please restart your computer and run the following

 

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes:

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans:

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 
    

Example image of where to click to attach files when posting your reply

 

Thank you

 

[JayLee71]

Hi

 

Here are the logs of the scans.

 

 

Addition.txt AdwCleaner[S03].txt FRST.txt MalwarebytesScan.txt

[AdvancedSetup]

The logs indicate a few issues. Let me have you run the following

 

 

Please make the following change in Malwarebytes if you're using the Premium or Trial version

• Please open Malwarebytes. Click on the small gear icon to open the Settings and go to the Security tab.
• Then turn off "Always register Malwarebytes in the Windows Security Center"
• Restart the computer

 

It is highly unlikely that you need to setup exclusions for Windows Defender, however if you experience any issues, please see the following article and setup exclusions
between Malwarebytes and Windows Defender

Malwarebytes for Windows antivirus exclusions list
https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list

 

Then restart the computer and run the following

Scan with SecurityCheck by glax24
https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

 

 

[JayLee71]

Hi 

 

Ran the scan as instructed and here's the log file.

 

 

SecurityCheck.txt

[AdvancedSetup]

Thank you @JayLee71

 

Please update, uninstall, or otherwise address the following as appropriate for your system

• 7-Zip 19.00 (x64) v.19.00 Warning! Download Update | Uninstall old version and install new one.
• AMD Software v.20.45.36 Warning! Download Update
• AnyDesk v.ad 7.0.14 Warning! Download Update
• Discord v.1.0.9002 Warning! Download Update
• FileZilla Client 3.55.1 v.3.55.1 Warning! Download Update
• Java 7 Update 80 (64-bit) v.7.0.800 Warning! This software is no longer supported. Please uninstall it and use Java SE 8 (jre-8u401-windows-x64.exe).
• Java SE Development Kit 7 Update 80 (64-bit) v.1.7.0.800 Warning! This software is no longer supported. Please uninstall it and use Java SE Development Kit (jdk-21_windows-x64_bin.exe).
• Microsoft SQL Server 2012 Native Client  v.11.4.7462.6 Warning! This software is no longer supported.
• Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 v.14.30.30704.0 Warning! Download Update
• NVIDIA GeForce Experience 3.27.0.112 v.3.27.0.112 Warning! Download Update
• Oracle VM VirtualBox 6.1.32 v.6.1.32 Warning! Download Update
• Picasa 3 v.3.9 Warning! This software is no longer supported.
• qBittorrent 4.3.8 v.4.3.8 Warning! Download Update
• Telegram Desktop v.4.12.2 Warning! Download Update
• WinRAR 6.02 (64-bit) v.6.02.0 Warning! Download Update

Please uninstall the following

---------------------------- [ UnwantedApps ] -----------------------------
CCleaner v.6.20 Warning! Suspected demo version of anti-spyware, driver updater or optimizer.
VdhCoApp 1.6.3 Warning! Application is distributed through the partnership programs and bundle assemblies. Uninstallation recommended. Possible you became a victim of fraud or social engineering.

Then RESTART the computer and check for Windows Updates and install any Security updates found.

Keep me posted

 

[JayLee71]

Hi

Ran all the updates as instructed and removed the two programs mentioned.

 

Jay

[AdvancedSetup]

Thank you. Please go ahead and run the following

 

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

 

You will need to send them an email to obtain a link to download the scanner, please do so

• The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
• Close all open applications and locate the downloaded file and double-click to run it
• The program will take a moment to launch and bring up the License and Update screen
• Place a check mark to agree to the terms and then click on the Continue button
• Click the underlined link Select objects for scanning
• On the top left click the Scanning objects that should automatically check all objects
• Click the small wrench and make sure there is a check on Automatically apply actions to threats
• Then click the large button on bottom right Start scanning
• Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
• The log is saved in the folder named Doctor Web in the top of your user profile folders
• Please attach that log on your next reply

 

 

 

[JayLee71]

Here it is.

 

 

cureit.log

[AdvancedSetup]

Excellent. From the log

There are no infected objects detected

How is the computer running now?

Are there still any signs of infection or any other unresolved issues?

 

[JayLee71]

There is one strange thing I noticed. I started losing connection to the internet once or twice a day since last week. I get "Connection is not secure" message on chrome and have to reset the modem to get the internet to work again. Can this be some type of infection?

 

Jay

[AdvancedSetup]

Let's go ahead and do a clean up of Google Chrome

 

Please follow the directions from the following topic for a more extensive article on cleaning Google Chrome

Resetting Google Chrome to clear unexpected issues
 

Thank you

 

[AdvancedSetup]

We're glad that we were able to assist you.

The following information will help you to keep your computer and data safer as well as improve your overall privacy

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/780233/best-password-manager/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download     https://patchmypc.com/about-us
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Cybersecurity basics & protection
Everything you need to know about cybercrime
https://www.malwarebytes.com/cybersecurity

 

Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes. Please tell your friends and family if they too need assistance with malware removal

 

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you