THE_ONE Posted September 20 ID:1662148 Share Posted September 20 Hello there, Thank you for taking your time to read this thread I'm currently using the trial version of Malwarebytes and Windows 11. Recently, I have been constantly receiving notifications from Malwarebytes stating that "Website blocked due to Riskware." Upon researching, I found out that this website is capable of transferring potential threat to my computer. I have been doing several scans but it eventually says that there is no harm but AS I said before I keep getting those notifications like every 5 minutes. What should I do to remove it? Link to post Share on other sites More sharing options...
Porthos Posted September 20 ID:1662149 Share Posted September 20 @THE_ONE Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following. Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware. Please respond to all future instructions from your helper in a timely manner. Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process Then follow each step in the order provided. Unless otherwise asked, please attach all logs Please make the following system changes: Please pay close attention the the instructions in all of the following links. If you have not done so already - Enable System Protection and create a NEW System Restore Point <<<<< Important. Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed Disable-Fast-Startup Windows 8 and newer only <<<<< Important. Show-Hidden-Folders-Files-Extensions Please run the following scans: Please pay close attention the the instructions in all of the following links. Click the following link and run a Scan with AdwCleaner Click the following link and run a Scan with Malwarebytes RESTART the computer <<<<< Important. Click the following link and run a Scan with Farbar Recovery Scan Tool Example image of where to click to attach files when posting your reply Then be patient for the next expert to take your case. <<<<< Important. Thank you Link to post Share on other sites More sharing options...
THE_ONE Posted September 20 Author ID:1662151 Share Posted September 20 I did all The instructions :) and those are all the logs : Malwarebytes Scan Report 2024-09-20 114329.txt AdwCleaner[S00].txt FRST.txt Addition.txt Link to post Share on other sites More sharing options...
JSntgRvr Posted September 20 ID:1662195 Share Posted September 20 You must use the version of FRST compatible with your system. You have a 64bit system. You must also rename Frst64.exe to FRSTEnglish.exe and then perform a Scan. Instructions below. Scan with Farbar Recovery Scan Tool Please download the Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Please rename FRST.EXE or FRST64.EXE to FRSTEnglish.exe After renaming the file right-click over FRSTEnglish.exe and select "Run as administrator" When the tool opens click Yes to the disclaimer if this is the first time using the tool Make sure there is a check mark in the Addition.txt check box Press the Scan button. It will make a log FRST.txt and Addition.txt in the same directory the tool is run from. Please attach both logs to your next reply. Link to post Share on other sites More sharing options...
THE_ONE Posted September 20 Author ID:1662317 Share Posted September 20 bro I literally did that previously don't you see Link to post Share on other sites More sharing options...
JSntgRvr Posted September 21 ID:1662338 Share Posted September 21 From FRST.txt: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-09-2024 Ran by Seraj (administrator) on NOX67I (LENOVO 20L8S3H72E) (20-09-2024 12:53:59) Running from C:\Users\Seraj\OneDrive\Desktop\FRST.exe Loaded Profiles: Seraj Platform: Microsoft Windows 11 Professionnel Version 23H2 22631.4169 (X64) Language: French (France) -> English (United States) Default browser: Chrome Boot Mode: Normal It wasn't renamed as instructed. Let run a script to review some of the settings: The following Fix will empty these folders: Windows Temp Users Temp folders Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Discord cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Hosts file will be reset Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns, please ask before running this fix. The system will be rebooted after the fix has run. FRST64 was saved as D:\download\FRSTEnglish.exe Download the enclosed file Fixlist.txt Save it in the same location FRST64 is saved. (FRSTEnglish.exe) Start FRST (FRST64) with Administrator privileges This time around Press the Fix button and wait When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from. Please attach this file in your next reply. Dr.Web CureIt! Please download the Dr.Web CureIt! anti-virus utility https://free.drweb.com/ You will need to send them an email to obtain a link to download the scanner, please do so The downloaded file will normally have a unique name such as: q7a9tr4p.exe Close all open applications and locate the downloaded file and double-click to run it The program will take a moment to launch and bring up the License and Update screen Place a check mark to agree to the terms and then click on the Continue button Click the underlined link Select objects for scanning On the top left click the Scanning objects that should automatically check all objects Click the small wrench and make sure there is a check on Automatically apply actions to threats Then click the large button on bottom right Start scanning Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad The log is saved in the folder named Doctor Web in the top of your user profile folders Please attach that log on your next reply Link to post Share on other sites More sharing options...
THE_ONE Posted September 21 Author ID:1662363 Share Posted September 21 OKAY those are theFixlog.txt logs : cureit.log Link to post Share on other sites More sharing options...
JSntgRvr Posted September 21 ID:1662366 Share Posted September 21 KMPlayer 64X (remove only) (HKLM\...\KMPlayer 64X) (Version: 2024.7.24.12 - PandoraTV) is detected as a RISK PROGRAM. The script ran well. Still receiving notifications? Link to post Share on other sites More sharing options...
THE_ONE Posted September 21 Author ID:1662419 Share Posted September 21 Wait wait I didn't get u, should I uninstall KM Player or what ? Link to post Share on other sites More sharing options...
THE_ONE Posted September 21 Author ID:1662420 Share Posted September 21 And Yeah I'm still receiving the notification Link to post Share on other sites More sharing options...
JSntgRvr Posted September 21 ID:1662449 Share Posted September 21 12 hours ago, JSntgRvr said: KMPlayer 64X (remove only) (HKLM\...\KMPlayer 64X) (Version: 2024.7.24.12 - PandoraTV) is detected as a RISK PROGRAM. The script ran well. Still receiving notifications? It is up to you to keep it, but it is flagged as a Risk Program. Lets try another scanner: Please run the following ESET Online Scanner and perform a Full Scan Click the following link to save the installer for ESET Online Scanner https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe It will start a download of "esetonlinescanner.exe" Save the file to your system, such as the Downloads folder, or else to the Desktop. Go to the saved file, and double click it to get started. When presented with the initial ESET screen, click on "Get Started". Read and accept the Terms of use On the "Before we start..." screen chose if you want to send anonymous data and if you want to provide feedback or not, then click Continue When prompted for scan type, Click on the Full Scan button Enable ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click the Start scan button. Have patience. The entire process may take a few hours or more. When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”. Click The blue “Save scan log” to save the log and give it a name and location you remember. If something was removed and you know it is a false postive, you may click on the blue ”Restore cleaned files” ( in blue, at the bottom). Press Continue when all done. You should click to turn off the offer for “periodic scanning”. Enable "Delete application data on closing" - You do not need to submit feedback unless you want to. Simply ignore and close the program. Note: If you do need to do a File Restore from ESET please follow the directions below [KB2915] Restore files quarantined by the ESET Online Scanner version 3 https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner Please attach the ESET scan log you saved at the end to your next reply Link to post Share on other sites More sharing options...
THE_ONE Posted September 21 Author ID:1662450 Share Posted September 21 May it be just from an update cuz Im ignoring the update of the software KM Player 64 bit should I update it maybe the update is for fixing a vulnerability that it's causing this ? Link to post Share on other sites More sharing options...
THE_ONE Posted September 21 Author ID:1662452 Share Posted September 21 No just ignore what I've just said the software is already uninstalled but the problem still I'll try the instructions Link to post Share on other sites More sharing options...
JSntgRvr Posted September 21 ID:1662454 Share Posted September 21 Let me know the outcome. Link to post Share on other sites More sharing options...
THE_ONE Posted September 22 Author ID:1662531 Share Posted September 22 sorry for the late this the log the potential unwanted app it found is Bing Wallpaper Scanlog.txt Link to post Share on other sites More sharing options...
JSntgRvr Posted September 22 ID:1662533 Share Posted September 22 MSIL/Microsoft.Bing is a correct detection for ESET as it classifies it as an application that pushes users into changing the default search engine. Such applications meet the definition of potentially unwanted applications according to ESET. Most people just create an exception for this type of programs. There is nothing wrong in having Bing Wallpaper. How is the computer doing otherwise? Link to post Share on other sites More sharing options...
JSntgRvr Posted September 22 ID:1662534 Share Posted September 22 As indicated earlier: Note: If you do need to do a File Restore from ESET please follow the directions below [KB2915] Restore files quarantined by the ESET Online Scanner version 3 https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner Link to post Share on other sites More sharing options...
THE_ONE Posted September 22 Author ID:1662620 Share Posted September 22 Why Would I do a file restore ? Link to post Share on other sites More sharing options...
THE_ONE Posted September 22 Author ID:1662621 Share Posted September 22 OH Ok I got u so u basically said the MS bing wallpaper is a false positive right ? Link to post Share on other sites More sharing options...
THE_ONE Posted September 22 Author ID:1662623 Share Posted September 22 And about the notifications it has been almost 2 hours and there is no notification yet, But I would like to know in which step did exactly the problem has been solved Link to post Share on other sites More sharing options...
THE_ONE Posted September 22 Author ID:1662627 Share Posted September 22 PLOT TWIST : Nothing has been solved, the blocked websites are now different Link to post Share on other sites More sharing options...
JSntgRvr Posted September 22 ID:1662655 Share Posted September 22 6 hours ago, THE_ONE said: OH Ok I got u so u basically said the MS bing wallpaper is a false positive right ? Yes/ Follow the steps in the following link: Link to post Share on other sites More sharing options...
THE_ONE Posted September 29 Author ID:1663929 Share Posted September 29 bruh unfortunately there is no hope I guess, I have been doing all ur tips but i KEEP seeing this kind of notifications. Link to post Share on other sites More sharing options...
JSntgRvr Posted September 29 ID:1663961 Share Posted September 29 Please re-scan with D:\download\FRSTEnglish.exe and attach new logs. Scan with these programs and attach the reports: Link to post Share on other sites More sharing options...
THE_ONE Posted September 30 Author ID:1663966 Share Posted September 30 ok those are the logs : Addition.txt FRST.txt SecurityCheck.txt FSS.txt Link to post Share on other sites More sharing options...
Recommended Posts