Notifications : Website blocked due to Trojan every minutes

[JimSulivan]

Hi, 

I'm having this malware that causes my CPU to run wild until I open the TaskManager and then it hides immediately. 
I used different tools attempting to track it like Process Hacker and Process Explorer, and it has the same behavior of hiding as soon as I opened them.
But I did manage to see a explorer.exe process running at 2.4Go of RAM for a split second using Process Explorer before it disappeared so I suspect this malware is linked to the notifications I'm receiving from MalwareBytes :

 

Could you please help me resolve this ?

Also, sorry, but I'm new here and I don't have a subscription to MalwareBytes yet, I freshly started the trial, I don't know if it matters.
Your tool was somehow the last one on my list of attempts and it happened to be the one to actually properly detect what's going on.

[Porthos]

@JimSulivan

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point  <<<<< Important.
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup   Windows 8 and newer only <<<<< Important.
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes
      RESTART the computer <<<<< Important.
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case. <<<<< Important.

 

Thank you

[JimSulivan]

AdwCleaner[C00].txtMalwarebytes Scan Report 2024-09-06 180027.txtAddition.txtFRST.txt

 

Hi again,

Thanks for the quick reply and your assistance.

Here are the scan results.

[JimSulivan]

The malware exploiting my CPU seems to have been removed, it is quietly idle now without having TaskManager opened.

But I still got detection alerts after the last two PC restarts I made after scanning with AdwClearner and MalwareBytes. Though they are from an other nature from the ones I had before :

[JimSulivan]

Sorry I meant to show this history:

[JSntgRvr]

Follow the instructions here:

 

 

Let me know the outcome.

[JSntgRvr]

Welcome 
 
I'll be helping you with your computer.
 
Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding.
 
Please take note of the guidelines for this fix:

• Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated.
• First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer.
• Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me.
• Please read ALL instructions carefully and perform the steps fully and in the order they are written.
• If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean.
• Continue to read and follow my instructions until I tell you that your machine is clean.
• If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed.
• Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary. 

Let's begin... 

The following Fix will empty these folders:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin
• Hosts file will be reset

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns, please ask before running this fix.

The system will be rebooted after the fix has run.

FRST64 was saved as C:\Users\Thierry\OneDrive\Bureau\FRSTEnglish.exe

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

You will need to send them an email to obtain a link to download the scanner, please do so

• The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
• Close all open applications and locate the downloaded file and double-click to run it
• The program will take a moment to launch and bring up the License and Update screen
• Place a check mark to agree to the terms and then click on the Continue button
• Click the underlined link Select objects for scanning
• On the top left click the Scanning objects that should automatically check all objects
• Click the small wrench and make sure there is a check on Automatically apply actions to threats
• Then click the large button on bottom right Start scanning
• Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
• The log is saved in the folder named Doctor Web in the top of your user profile folders
• Please attach that log on your next reply

[JimSulivan]

 

Fixlog.txtcureit.log

Hi again,

All done. Here are the results.

Just for your information, during the BIOS startup that happened after the FRST fix and restart, my C disk was analyzed and repaired but the screen was stuck at "100% done" for one hour.
I risked a forced power cycle, and my PC started normally after that.

[JimSulivan]

2 hours ago, JSntgRvr said:

Follow the instructions here:

 

 

Let me know the outcome.

I did this, including for FireFox and Opera GX that I'm also using.
And MalwareBytes didn't alert me about riskwares and blocked websites this time after all the other procedures.

[JimSulivan]

Nevermind,

I got two new ones : 

But I wonder if those are infections on my rig or just alerts I'm getting from dubious websites I still have opened in my browser.

[JSntgRvr]

They could be incoming RPT's. Lets see if a CHKDSK report was saved by the Event Viewer.

FRST64 was saved as C:\Users\Thierry\OneDrive\Bureau\FRSTEnglish.exe

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.
• Another report should be saved on the desktop as DiskCheckLog.txt.

Please attach these files in your next reply.

Lets try another scanner:
Please run the following ESET Online Scanner and perform a Full Scan
 
Click the following link to save the installer for ESET Online Scanner
https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get started.
• When presented with the initial ESET screen, click on "Get Started". Read and accept the Terms of use
• On the "Before we start..." screen chose if you want to send anonymous data and if you want to provide feedback or not, then click Continue
• When prompted for scan type, Click on the Full Scan button
• Enable  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click the Start scan button.
• Have patience.  The entire process may take a few hours or more.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log and give it a name and location you remember.
• If something was removed and you know it is a false postive, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to turn off the offer for “periodic scanning”.
• Enable "Delete application data on closing" - You do not need to submit feedback unless you want to. Simply ignore and close the program.

 

 
Note: If you do need to do a File Restore from ESET please follow the directions below
[KB2915] Restore files quarantined by the ESET Online Scanner version 3
https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner
 
Please attach the ESET scan log you saved at the end to your next reply

Edited September 7 by JSntgRvr
typo

[JimSulivan]

Fixlog.txtESETLog.txt

And still got an alert after ESET was done, although I didn't restarted yet, so I will keep on monitoring after that :

[JimSulivan]

DiskCheckLog.txt

[JimSulivan]

MalwareBytes is saying those communication attempts are outbound so I presume I'm still infected.

[JSntgRvr]

Scan with SecurityCheck and attach the report.

Lets reset Opera:

FRST64 was saved as C:\Users\Thierry\OneDrive\Bureau\FRSTEnglish.exe

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. (FRSTEnglish.exe)
• Close Opera.
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.
• Open Opera and the application will open with default values.

See if Malwarebytes still detecting those RPT's.

 

[JimSulivan]

Fixlog.txt

Done, thanks a lot so far.
I will keep monitoring anything suspicious by leaving my other browsers opened since I also have Chrome, Firefox and Edge.

[JimSulivan]

I doesn't seems to have worked for Opera though, I opened it and I still had my previous tabs and browser theme restored before closing it.

I use Opera GX, not the classic Opera if it matters.

[JSntgRvr]

Open Opera. Select Go to Full Browser Settings. Search for Reset in Settings and click on Restore settings to their original defaults.

 

Run Security Check and attach the report.

[JimSulivan]

Malwarebytes Scan Report 2024-09-07 195622.txt

Done

[JSntgRvr]

Security Check and attach the report.

[JimSulivan]

I'm confused, How do I do the Security Check you want? With which app? Can't do with Windows Defender since it opens MalwareBytes if I want to do a scan and there is no security check built in Opera as far as I know.

[Porthos]

5 minutes ago, JimSulivan said:

How do I do the Security Check you want?

Scan with SecurityCheck by glax24
https://forums.malwarebytes.com/topic/307301-scan-with-securitycheck-by-glax24/

[JimSulivan]

SecurityCheck.txt

Thanks, and done.

[JSntgRvr]

Here are some programs that need an update.:

Git version 2.31.1 v.2.31.1 Warning! Download Update
Python 2.7.15 (64-bit) v.2.7.15150 Warning! Download Update
Node.js v.10.15.1 Warning! Download Update
Microsoft SQL Server 2012 Native Client  v.11.4.7462.6 Warning! This software is no longer supported. Should remove.
Microsoft Visual Studio Code (User) v.1.74.3 Warning! Download Update
FileZilla Client 3.58.0 v.3.58.0 Warning! Download Update
Notepad++ (32-bit x86) v.8.4.8 Warning! Download Update
TeamViewer v.15.55.3 Warning! Download Update
WinSCP 5.17.10 v.5.17.10 Warning! Download Update
7-Zip 23.01 (x64) v.23.01 Warning! Download Update
Uninstall old version and install new one.
Discord v.1.0.9048 Warning! Download Update
Mozilla Firefox (x64 en-US) v.127.0.2 Warning! Download Update
CertsUpdater version 1.5 v.1.5 Warning! Suspected Adware! If this program is not familiar to you it is recommended to uninstall it and execute PC scanning using Malwarebytes Anti-Malware and Malwarebytes AdwCleaner. Before uninstallation and scanning it is necessary to consult in the forum where cure is provided for you!!!
 

How is it doing?

[JimSulivan]

All done and updated. My last alert of outbound communication was 5 hours ago.
i will keep monitoring today.

Thank you very much so far, I feel much safer.