System32 inbound connection

[gullfisk9922]

today at 12:38PM i got a notification from Malwarebytes that said

 

-Log Details-
Protection Event Date: 8/9/2024
Protection Event Time: 12:38 PM
Log File: 961f6940-563b-11ef-98e9-0045e2088476.json

 

-Blocked Website Details-
Malicious Website: 1
, C:\Windows\System32\svchost.exe, Blocked, -1, -1, 0.0.0, 8EC922C7A58A8701AB481B7BE9644536, 949BFB5B4C7D58D92F3F9C5F8EC7CA4CEAFFD10EC5F0020F0A987C472D61C54B

-Website Data-
Category: Compromised
Domain:
IP Address: 79.124.62.134
Port: 49670
Type: Inbound
File: C:\Windows\System32\svchost.exe

 

what do i do against this, i recently fell for a trojan and have reset my windows and wiped my drive but i dont think im in the clear, what do i do. all scans say im clear but i dont believe i am due to the amount of connections malwarebytes has to block about 2-3 per hour.

 

ive added all the IP adresses to a blocklist but new addresses appear every time

[1PW]

For staff use.

https://www.abuseipdb.com/check/79.124.62.134

https://www.virustotal.com/gui/url/371639712a6d3d56330ab04d4cf0170f671f07a005447931f0486077584b19fb?nocache=1

 

PING @AdvancedSetup

Edited August 11 by 1PW

[AdvancedSetup]

That IP should not be added to an exclusion @gullfisk9922

https://www.abuseipdb.com/check/79.124.62.134

 

 

 

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes:  Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans:  Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 
    

Example image of where to click to attach files when posting your reply

 

Thank you

 

[gullfisk9922]

doing the scans right now and here are the logs

AdwCleaner[C02].txt Malwarebytes Scan Report 2024-08-12 113348.txt FRST.txt Addition.txt

[AdvancedSetup]

Thank you for the logs @gullfisk9922

The logs do not indicate any obvious signs of an infection.

This is an Inbound block. Basically a bot is probing the system looking for any possible exploit. Malwarebytes is doing it's job blocking the probe. Normally these type of probes go away on their own within about a week.

If you use an external physical router with firewall that should normally stop these type of probes as well.

Thank you

 

[gullfisk9922]

its been 7 days since i got hacked so i hope it ends soon

[AdvancedSetup]

A factory reset of the router might help.

 

If you own your own router and are not renting it from your Internet Service Provider

Please ensure that you have the user manual for your router. Then perform a factory reset.

How To Reset Your Router
https://setuprouter.com/networking/how-to-reset-your-router/

Depending on one's preferences and the Router's capabilities please consider the following.

• Disable acceptance of ICMP Pings
• Change the Default Router password using a Strong Password
• Use a Strong WiFi password on WPA2 using AES encryption or Enable WPA3 if it is an option.
• Disable Remote Management
• Create separate WiFi networks for groups of devices with similar purposes to prevent an entire network of devices from being compromised if a malicious actor is able to gain unauthorized access to one device or network.
  Example: Keep IoT devices on one network and mobile devices on another.
• Change the network name (SSID).  Do not use your; Name, Postal address or other personal information.  Make it unique or whimsical and known to your family/group.
• Is the Router Firmware up-to-date ?  Updating the firmware mitigates exploitable vulnerabilities.
• Specifically set Firewall rules to BLOCK;   TCP and UDP ports 135 ~ 139, 445, 1234, 3389, 5555 and 9034
• Many Routers support Saving and Restoring settings from a file.  It is suggested to make a backup by saving your Router's settings once it has been configured.
• Document passwords created and store them in a safe but accessible location.

 

 

 

[gullfisk9922]

malwarebytes now suddenly decided FRSTEnglish.exe was a trojan and quarantined it, is this a glitch/bug or is FRST actually infected with something? either way seems relevant enough to post here

Malwarebytes Scan Report 2024-08-12 113348.txt

[AdvancedSetup]

Can you please post the Protection Log that shows the detection and quarantine @gullfisk9922

I'll report it to our internal team

 

[gullfisk9922]

im unsure how to get the protection log, ive just found the scan log

[gullfisk9922]

Malwarebytes Scan Report 2024-08-12 191900.txt

apparently attached the wrong file to last reply oops

[AdvancedSetup]

Thank you for the log. I've reported it as a False Positive detection

 

[AdvancedSetup]

Hello @gullfisk9922

Can you restore the file from quarantine

C:\USERS\MATTH\DESKTOP\FRST64ENGLISH.EXE

Then zip it up and attach here for me, please.

Thank you.

 

[gullfisk9922]

heres the zip file you requested

FRST64English.zip

[AdvancedSetup]

Thank you. I've submitted it to our internal research team for review

Are the Inbound blocks still happening?

 

[gullfisk9922]

yes theyre still happening

[AdvancedSetup]

That file you provided is not the same file that was flagged by the system.

Let's clean up all the programs and files. They really are not needed at this time.

Not sure how responsive your ISP is but you might contact their Technical Support and see if maybe you can get a new IP assigned to your router.

 

Please follow the directions below to remove the logs and tools we've used. If any are still left after that you can manually uninstall or delete them.

 

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt. You can close it.

 

 

 

 

 

[gullfisk9922]

okay downloaded that program and followed the instructions

do you want the log file?

do you want me to delete malwarebytes too?

[gullfisk9922]

also the file that i attached was legit the same file that i got when i removed the quarantined file from quarantine, i just zipped it up and sent it then deleted it from my pc

[AdvancedSetup]

How is the computer running now?

Are there still any signs of infection or any other unresolved issues  @gullfisk9922

 

[gullfisk9922]

i found some router settings had been changed with firewall and dmz and reset my router and its all fine now 👍

[AdvancedSetup]

Excellent, glad to hear all is well again. I'll go ahead and close your topic now and wish you well.

Please follow the directions below to remove the logs and tools we've used. If any are still left after that you can manually uninstall or delete them.

Take care and stay safe out there. Try to follow as much of the advise below as you can as well.

 

Let's go ahead and do some clean-up work and remove the tools and logs we've run.

Please download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• Read and accept the disclaimer.
• When the tool opens, ensure all boxes under Actions are checked.
• Under Delete Quarantines select Delete Now, then click Run.
• Once complete, click OK.
• A log will open in Notepad titled kprm-(date).txt. You can close it.

 

We're glad that we were able to assist you.

 

The following information will help you to keep your computer and data safer as well as improve your overall privacy

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/780233/best-password-manager/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download     https://patchmypc.com/about-us
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Cybersecurity basics & protection
Everything you need to know about cybercrime
https://www.malwarebytes.com/cybersecurity

 

Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes. Please tell your friends and family if they too need assistance with malware removal