Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: wordism on August 05, 2012, 12:13:18 AM

Title: Continuous Malicious URL BLOCKED and Blue Screen Errors
Post by: wordism on August 05, 2012, 12:13:18 AM
On my desktop I'm having continuous problems today with my desktop. I'm currently on my laptop due to blue screen errors... Here are descriptions of whats happening.

I'm receiving continuous Malicious URL Blocked from Avast
Infection Details
URL:   hxxp://espeak911.com/x/
Process:   C:\Windows\System32\services.exe
Infection:   URL:Mal

and 2 more similar to this. I also cannot view google at the time and I'm starting to get blue screen errors. Actually my desktop is restarting after about 10 minutes.
AntiMalware Bytes and Avast haven't found any malware. Help would be greatly appreciated.
Title: Re: Continuous Malicious URL BLOCKED and Blue Screen Errors
Post by: Pondus on August 05, 2012, 12:32:05 AM
sound like you have the infection everyone else has...see virus and worms section

start a new topic in virus and worms section......and in your new topic there you do this

follow this guide and attach (not copy and paste) logs from malwarebytes / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0
Title: Re: Continuous Malicious URL BLOCKED and Blue Screen Errors
Post by: DavidR on August 05, 2012, 12:37:57 AM
@ wordism
When posting URLs to suspect sites - Please 'modify' the URL change the URL from http to hXXp, to break the link and avoid accidental exposure to suspect sites, thanks.
Title: Re: Continuous Malicious URL BLOCKED and Blue Screen Errors
Post by: wordism on August 05, 2012, 02:01:18 AM
thanks for the tips guys. I eventually found out that I had a rootkit.
I think everything may be fine now
Title: Re: Continuous Malicious URL BLOCKED and Blue Screen Errors
Post by: DavidR on August 05, 2012, 02:09:34 AM
Yes there is most likely a rootkit involvement, but this one may be more complex as the services.exe may have been modified also.

Personally I would advise following up on the link Pondus gave you.