noveu911.cn trojan

D1craig · 17 Dec 2021 at 17:23

so i keep getting a popup saying this website has been blocked because of a trojan. i am not trying to access this site it is just popping up. its apparently coming from cftmon.exe. this has only started happening as soon as malware bytes update to a new version.

what could this be and how do i stop it? google is offering me nothing about this.

Blackbadger · 17 Dec 2021 at 18:36

That's a domain, resolving from Moldova/Romania

If your computer is communicating with servers to such locations without your consent. It's time to disconnect from the internet. Backup your important files and format.

t31os · 17 Dec 2021 at 20:43

Sounds like a browser hijack, probably some malware. If you have any other browser (already installed) you can test and those messages persist, then it's possibly got it's hooks in already. See it sticks around in safe mode, if safe mode runs clean, check your startup entries for rogue exes/dlls.

Quartz · 17 Dec 2021 at 20:47

What does Malwarebytes say when you run a scan?

D1craig · 18 Dec 2021 at 17:25

i have no idea why i didnt even try the quarantine button... it seems to have gotten rid of it. i googled the cftmon.exe and saw it was something to do with asus so got a little curious about quarantining it.

i must have turned malwarebytes off because it was being funny with my miners...

D1craig · 18 Dec 2021 at 17:26

Quartz said:
What does Malwarebytes say when you run a scan?

it picked up 3 of them trojans in the same .exe and all my miners from nicehash. i got rid of the trojans now and havent seen a popup since.