Threat detected JS:Agent-EDB trj

[davidbodego]

I found this trojan on my computer by Avast Internet Security.
It is always blocking, but the message begin to appear every hour and now it is appearing every 10 minutes. (Completely disgusting)
So step by step, first of all, a screenshot of the message (Screenshot1.jpg).

After I find the message, I install Malwarebytes and it found 7 entries that it put on quarantine. (I did not save the log  )
During one day, I did not hear any other threat from Avast, then I uninstall MB.
Inmediatelly, the threat appear again. I took a look to whatever install, start pages and everything I have found through the Web, but nothing was matching so I install MB again.
After the second installing, MB can not find any threat, but I have the Threat detected by Avast every 10 minutes.

What can I do?

[Pondus]

Instructions, read it ALL before you start   https://forum.avast.com/index.php?topic=194892.0

After I find the message, I install Malwarebytes and it found 7 entries that it put on quarantine. (I did not save the log  )

Log is saved in Malwarebytes history ... default i think

[davidbodego]

As requested.
Attached files from MB and FRST

[Sass Drake]

SAve your work before doing this because it will restart your computer automatically.

• Open Notepad (click Start button -> type notepad.exe -> press Enter)
• Copy text from code block below and paste it into Notepad

Code: [Select]

cmd: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SearchList /d "" /f
Reboot:

• Go to File -> Save As
• Make sure that  UTF-8 is selected as Encoding (left side of Save button)
• Save it as fixlist.txt on Desktop
• Open again FRST and click on button Fix
• Wait until FRST finishes
• fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

[davidbodego]

As requested fixlog.txt

[Sass Drake]

You didn't copy text from code block correctly. You missed "cmd: " at begining.

[davidbodego]

Sorry, it was my mistake.

Now attached.

[Sass Drake]

Does Avast still display notification about blocked threats?

[davidbodego]

No. It seems that now everything is fine.
So fixed?
And why did it happens?

[Sass Drake]

Your system were infected by adware which set auto'configuration proxy script.


• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.
Run the tool and check the following boxes below;
Remove disinfection tools
Create registry backup
Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

[davidbodego]

Thank you very much