aminmuqri Posted February 10 ID:1616726 Share Posted February 10 Since last week, malwarebytes has been detecting an outbound connection from the same address every 15 minutes, I have deleted all the other malware that I accidentally downloaded but this one has not left since last week. Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616727 Share Posted February 10 Hello @aminmuqri and My name is MKDB and I will assist you. Let's keep these principles as we proceed. Make sure to read the entire post below first. Please follow the steps in the given order and post back the log files. Please attach all log files into your post. Before we start, please make sure that you have an external backup, not connected to this system, of all private data. Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you. As English is not my native language, please do not use slang or idioms. It may be hard for me to understand. If you do not respond within 4 days, your topic will be closed. Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure. Please run MBST in order to help you. Please download the Malwarebytes Support Tool (MBST). Run MBST and accept license agreement. In the left navigation pane of MBST, click Advanced. In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine. A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply. Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616729 Share Posted February 10 here it is mbst-grab-results.zip 1 Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616730 Share Posted February 10 @aminmuqri Please give me some time to review what you have posted! Thank you! Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616734 Share Posted February 10 (edited) @aminmuqri Unfortunately there are indications pirated software is on the system. Any and all programs requiring proper activation for which you do not have a valid product key will need to be removed before we can clean the system. If you are willing to uninstall such software please do so. If you are unable, or unwilling to remove the software, my support will end. Office and/or Windows is illegally used: Quote Microsoft 365 Apps for enterprise - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 16.0.17231.20194 - Microsoft Corporation) "threatName": "HackTool.KMSpico" Error: (02/10/2024 12:36:05 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: ) Description: License Activation (slui.exe) failed with the following error code: hr=0xC004F074 Command-line arguments: RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=NetworkAvailable From my first post: Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure. Forum rules: Keep me updated on how you want to proceed! Edited February 10 by MKDB Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616735 Share Posted February 10 how do i delete those, I am willing to delete them Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616741 Share Posted February 10 please help me Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616745 Share Posted February 10 sorry for bothering you but just want to confirm whether you’re going to help me or not @MKDB Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616749 Share Posted February 10 (edited) @aminmuqri Uninstall Microsoft 365 Apps for enterprise via Start > Settings > Apps and remove every crack / hack / keygen / etc. from your system. Let me know when it's completed. Edited February 10 by MKDB Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616750 Share Posted February 10 okay i have done it, but the detections are still going off Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616752 Share Posted February 10 (edited) @aminmuqri Malware removal isn't easy. You have to be very patient during the cleanup process. And even if nothing is blocked anymore, that doesn't mean your system is already clean. Next, let's run ESET and MSS. Both scans may take some time (>> 2 hours) to complete. 1️⃣ I would suggest a free scan with the ESET Online Scanner Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe It will start a download of "esetonlinescanner.exe". Save the file to your system, such as the Downloads folder, or else to the Desktop. Go to the saved file, and double click it to get it started. When presented with the initial ESET options, click on "Computer Scan". Next, when prompted by Windows, allow it to start by clicking Yes. When prompted for scan type, Click on Full scan. Look at & tick ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click on the Start scan button. Have patience. The entire process may take an hour or more. There is an initial update download. There is a progress window display. You should ignore all prompts to get the ESET antivirus software program. (e.g. their standard program). You do not need to buy or get or install anything else. When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”. Click The blue “Save scan log” to save the log. If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files” (in blue, at the bottom). Press Continue when all done. You should click to off the offer for “periodic scanning”. Note: If you do need to do a File Restore from ESET please follow the directions below [KB2915] Restore files quarantined by the ESET Online Scanner version 3 https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner 2️⃣ The Microsoft Safety Scanner (MSS) is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. The download links & the how-to-run-the tool are at this link at Microsoft. Please let me know the results of this scan. Run a Full Scan. The log is named MSERT.log. The log will be at%SYSTEMROOT%\debug\msert.log which in most cases is C:\Windows\debug\msert.log Please attach that log with your next reply. Edited February 10 by MKDB Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616761 Share Posted February 10 I realized that the malware is in my windows\explorer.exe file, I read about this in the internet and I dont know how to delete it Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616763 Share Posted February 10 2 minutes ago, aminmuqri said: I realized that the malware is in my windows\explorer.exe file, I read about this in the internet and I dont know how to delete it The malware is NOT in your explorer.exe. Explorer.exe is a legit windows file, but it is MIS-USED by the malware. Instead of reading in the internet, I suggest to follow the instructions above. Thank you. Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616764 Share Posted February 10 here it is, i havent started the est one msert.log Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616765 Share Posted February 10 here is additional information i forgot to send earlier Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616766 Share Posted February 10 @aminmuqri Well done. Now run ESET please. I suggest to disable Kaspersky in the meantime, otherwise there may be a conflict. Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616767 Share Posted February 10 (edited) @aminmuqri Moreover, I would like you to attach this file for my review: C:\Users\User\Downloads\Fixlog.txt Furthermore, let me know if you have run this fix on your own. Edited February 10 by MKDB Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616769 Share Posted February 10 My kaspersky is not on since my license is expired, Im going to run the EST now Fixlog.txt Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616771 Share Posted February 10 @aminmuqri Ok, do so. Let's see what ESET gives back. Who gave you the fixlist? Or did you create this fix on your own? Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616772 Share Posted February 10 I created one on my own before this Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616773 Share Posted February 10 Just now, aminmuqri said: I created one on my own before this Ok, thanks. Now go on with ESET. I'll be back later (~ 3 hours). Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616774 Share Posted February 10 is it okay if we setting this in like 5-7 hours time? Its midnight for me right now and i already lost my sleep yesterday Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616775 Share Posted February 10 settle* Link to post Share on other sites More sharing options...
aminmuqri Posted February 10 Author ID:1616799 Share Posted February 10 I have run it but the outbound connection still persists. EST.txt Link to post Share on other sites More sharing options...
MKDB Posted February 10 ID:1616802 Share Posted February 10 @aminmuqri I'll be back sooner than expected. Let's run a fresh FRST scan. Run C:\Users\User\Downloads\FRSTEnglish.exe Do not change any settings. Press the Scan button. FRST will create two logs now (FRST.txt + Addition.txt) in the same directory the tool is run. Please attach these logfiles to your next reply. Link to post Share on other sites More sharing options...
Recommended Posts