« previous next »
Pages: [1] 2 3   Go Down

Author Topic: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal  (Read 6813 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« on: June 09, 2018, 02:19:51 AM »
Hey All,
 Let me start by saying I appreciate any help given! A few days ago I started getting a message saying threat secured/ aborted connection on 172.86.120. 188 infected with URL:MAL.

Threat name: URL:Mal
URL: http:172.86.120.188/current/runtime.exe
Process C:\windows\system32\svchost.exe
Detected by Web Shield
Status   Connection aborted

I think I followed the instructions in the sticky post and included my log files. Again, any help will be greatly appreciated!!!
Logged

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #1 on: June 09, 2018, 11:02:04 AM »
This will restart your PC automatically so save your work before doing this.

  • Open Notepad (click Start button -> type notepad.exe -> press Enter)
  • Copy text from code block below and paste it into Notepad
Code: [Select]
EmptyTemp:
  • Go to File -> Save As
  • Make sure that  UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
Logged

REDACTED

  • Guest
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #2 on: June 10, 2018, 02:11:39 AM »
Here it is..thanks again!
Logged

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #3 on: June 10, 2018, 11:11:50 AM »
What is status now?
Logged

REDACTED

  • Guest
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #4 on: June 10, 2018, 03:32:04 PM »
Same message from avast popping up every ten minutes or so.
Logged

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #5 on: June 10, 2018, 09:22:32 PM »
  • Open Notepad (click Start button -> type notepad.exe -> press Enter)
  • Copy text from code block below and paste it into Notepad
Code: [Select]
cmd: bitsadmin /list /allusers /verbose
cmd: bitsadmin /reset /allusers
  • Go to File -> Save As
  • Make sure that  UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
Logged

REDACTED

  • Guest
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #6 on: June 11, 2018, 12:56:19 AM »
Posting now, status is the same just in case you needed that info. Avast warning popping up every ten min or so..Thanks again for helping!
« Last Edit: June 11, 2018, 12:58:38 AM by The Horror Above »
Logged

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #7 on: June 11, 2018, 09:01:31 PM »
  • Please download PowerRun from here.
  • Extract it and run PowerRun_x64.exe
  • Right click on first entry in list (%SystemRoot%\System32\cmd.exe) and click on Run
  • Command Prompt window with SYSTEM privilegies should appear. Type this command and press Enter:
Code: [Select]
bitsadmin /reset /allusers
  • Make screenshot of Command Prompt window and attach it here please.

Logged

REDACTED

  • Guest
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #8 on: June 11, 2018, 11:54:17 PM »
Here it is. Ive said before but I really appreciate the help!
Logged

REDACTED

  • Guest
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #9 on: June 11, 2018, 11:59:01 PM »
sorry posted the wrong one..here is the right one ...
Logged

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #10 on: June 12, 2018, 12:14:06 AM »
Hmm. What is system status now? If same, please read carefully and follow again instructions I wrote.
Logged

REDACTED

  • Guest
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #11 on: June 12, 2018, 04:19:22 AM »
This is what I'm seeing after slowly going step by step..

« Last Edit: June 12, 2018, 06:03:32 AM by The Horror Above »
Logged

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #12 on: June 12, 2018, 07:56:30 PM »
Are you still getting Avast notifications for blocked URL?
Logged

REDACTED

  • Guest
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #13 on: June 13, 2018, 01:34:26 AM »
Yes I'm still getting them ,thanks!
Logged

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: Threat detected/ aborted connection on 172.86.120.188 infected with URL:Mal
« Reply #14 on: June 13, 2018, 01:59:26 AM »
  • Open Notepad (click Start button -> type notepad.exe -> press Enter)
  • Copy text from code block below and paste it into Notepad
Code: [Select]
cmd: bitsadmin /list /allusers /verbose
cmd: bitsadmin /reset /allusers
  • Go to File -> Save As
  • Make sure that  UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
Logged
Pages: [1] 2 3   Go Up
« previous next »