« previous next »
Pages: [1]   Go Down

Author Topic: Avast! Popup Malicious URL Blocked  (Read 7841 times)

0 Members and 1 Guest are viewing this topic.

Jamespb

  • Guest
Avast! Popup Malicious URL Blocked
« on: October 18, 2011, 07:24:15 AM »
I followed DavidR's instructions to the best of my ability

I am getting a red Avast! pop up periodically as follows:

Malicious URL blocked
Avast! Network shield has blocked.....
Object:http://www.mp3codec.net/pldl.php
Infection: URL:Mal
Process: C:\windows\system32\svchost.exe

My System:Windows Vista Home Premium Service Pack 2 (build 6002)

I have run
Avast! full scan
And Boot time scan
Malwarebytes full scan
Trendmicro (free) online scanner
Also another tool i had not heard of previously tdsskiller.

I deleted a suspicious file in the Temp folder pl.exe

I might add that when I log on as a alternate user the problem does not seem to occur

Thanks Jamespb
Logged

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89351
  • No support PMs thanks
Re: Avast! Popup Malicious URL Blocked
« Reply #1 on: October 18, 2011, 02:44:59 PM »
Well as you mentioned before MBAM found nothing.

The aswMBR.exe is reporting an Unknown MBR code (e.g. not the default MBR code), this can indicate the presence of an MBR rootkit, but it can also mean nothing more than you have a customised system, like a Dell, HP, etc. These may have a custom MBR to allow for use of their recovery partition, to restore your system back to the factory settings. Is your system from a major computer manufacturer like Dell, HP ?
The tdsskiller is also looking for rootkits, specifically TDSS variants, I assume it didn't find anything ?

####
The OTL logs will have to be analysed by a specialist, when he is on-line.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Avast! Popup Malicious URL Blocked
« Reply #2 on: October 18, 2011, 07:39:29 PM »
On completion of this run can you let me know if the mal url continues

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Quote
    :OTL
    O3 - HKU\S-1-5-21-1916948713-297805433-2369559756-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O3 - HKU\S-1-5-21-1916948713-297805433-2369559756-1001\..\Toolbar\WebBrowser: (no name) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - No CLSID value found.
    [2011/10/18 00:11:01 | 000,000,493 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics

    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Logged

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89351
  • No support PMs thanks
Re: Avast! Popup Malicious URL Blocked
« Reply #3 on: October 18, 2011, 07:48:56 PM »
Thanks for joining the topic essexboy.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Avast! Popup Malicious URL Blocked
« Reply #4 on: October 18, 2011, 08:20:48 PM »
Keeps me out of the pub  ;D
Logged

Jamespb

  • Guest
Re: Avast! Popup Malicious URL Blocked
« Reply #5 on: October 19, 2011, 12:03:08 AM »
Problem appears solved Much thanks.
The question was posed about the OEM it is a Compaq Presario C769US.
I see from the OTL log that the host file was deleted/replaced fresh. Can i overwrite this with the Spybot default host file?  I see that 2 files were deleted from a folder in created for this situation
C:\Users\James\Popup BS Fix\cmd.bat deleted successfully.
C:\Users\James\Popup BS Fix\cmd.txt deleted successfully.
I did not see these in that folder if you could explain to me what happened i'd enjoy the knowledge. Attached file per your request. Ps I'm glad i kept you out of the pubs :-)
Cheers
Jamespb
Logged

YoKenny

  • Guest
Re: Avast! Popup Malicious URL Blocked
« Reply #6 on: October 19, 2011, 12:08:38 AM »
Quote from: Jamespb on October 19, 2011, 12:03:08 AM
I see from the OTL log that the host file was deleted/replaced fresh. Can i overwrite this with the Spybot default host file?  I see that 2 files were deleted from a folder in created for this situation
C:\Users\James\Popup BS Fix\cmd.bat deleted successfully.
C:\Users\James\Popup BS Fix\cmd.txt deleted successfully.
I did not see these in that folder if you could explain to me what happened i'd enjoy the knowledge. Attached file per your request. Ps I'm glad i kept you out of the pubs :-)
Cheers
Jamespb
Spybot HOSTS file is useless and not well maintained.

The hpHosts and MVPS HOST files are much better maintained.

http://winhelp2002.mvps.org/hosts.htm
Logged

Jamespb

  • Guest
Re: Avast! Popup Malicious URL Blocked
« Reply #7 on: October 19, 2011, 03:36:06 AM »
Ok YoKenny I took your advice and substituted the host file with the one you suggested. Thanks.
Have you replied for essexboy because i had a few questions I had posed for him [note above] about my issue. Although it was solved i was just curious about a few things?
 Cheers
Jamespb
Logged

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33937
  • malware fighter
Re: Avast! Popup Malicious URL Blocked
« Reply #8 on: October 19, 2011, 10:30:35 AM »
Hi YoKenny,

Also consider this info: http://www.threatexpert.com/report.aspx?md5=10a7fdacbebe7164b47da0a3e873eb71
because of request for GET /pixel/18410 HTTP/1.1
Host: -dm.demdex.net see: http://www.malware-control.com/statics-pages/059b40f6f5eafc7324fa78f1027b4aa5.php

polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Avast! Popup Malicious URL Blocked
« Reply #9 on: October 19, 2011, 07:42:17 PM »
Quote from: Jamespb on October 19, 2011, 12:03:08 AM
Problem appears solved Much thanks.
The question was posed about the OEM it is a Compaq Presario C769US.
I see from the OTL log that the host file was deleted/replaced fresh. Can i overwrite this with the Spybot default host file?  I see that 2 files were deleted from a folder in created for this situation
C:\Users\James\Popup BS Fix\cmd.bat deleted successfully.
C:\Users\James\Popup BS Fix\cmd.txt deleted successfully.
I did not see these in that folder if you could explain to me what happened i'd enjoy the knowledge. Attached file per your request. Ps I'm glad i kept you out of the pubs :-)
Cheers
Jamespb
OK the problem was in the Host.ics file which I deleted and then reset the main host file to default.  The command files that were deleted were created by the malware and were set as hidden - but OTL could see them and delete them   ;D

So the redirects are now history ?
Logged

Jamespb

  • Guest
Re: Avast! Popup Malicious URL Blocked
« Reply #10 on: October 19, 2011, 11:23:15 PM »
I had been through the etc folder and scrutinized then edited the host file to ignore the redirect site trying for a fix to no avail. I do know that the etc folder contains other host type files and left them alone. ICS is apparently an outlook related file i did not touch it or try to view it. I see the host.ics is again present in the etc folder I'm assuming it was replaced with a fresh/clean file. This is my sisters PC and i had not enabled to view hidden files and to view extensions as i normally would, hence my not seeing the cmd.bat and cmd.txt
So Cheers to you

The redirects are gone thank you for your time.
Excellent

Jamespb
Logged

Jamespb

  • Guest
Re: Avast! Popup Malicious URL Blocked
« Reply #11 on: October 19, 2011, 11:24:47 PM »
Incidentally i am still confused as to why a ics file would shoot me to a malicious site
hmm
Cheers
Jamespb
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Avast! Popup Malicious URL Blocked
« Reply #12 on: October 19, 2011, 11:37:13 PM »
It is a very old trick - replacing the legitimate ICS with a bad one. 

Run otl and press the cleanup button to remove it and its components  ;D
Logged

Jamespb

  • Guest
Re: Avast! Popup Malicious URL Blocked
« Reply #13 on: October 20, 2011, 12:30:54 AM »
Ok thanks again for the help
Logged
Pages: [1]   Go Up
« previous next »