Author Topic: "Malicious URL Blocked" message  (Read 7658 times)

0 Members and 1 Guest are viewing this topic.

malkiera_11b

  • Guest
"Malicious URL Blocked" message
« on: January 14, 2013, 05:08:28 AM »
Hi

My Avast anti-virus keeps generating several "Malicious URL Blocked" messages.  Below is the log from my most recent Malwarebytes Anti-Malware Scan.

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.01.09.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
buoljd_ :: C [administrator]

1/13/2013 9:35:44 PM
mbam-log-2013-01-13 (21-35-44).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 209743
Time elapsed: 8 minute(s), 2 second(s)

Memory Processes Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> 2444 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.

(end)

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37605
  • Not a avast user
Re: "Malicious URL Blocked" message
« Reply #1 on: January 14, 2013, 05:54:57 AM »
you probably have a rootkit....

follow this guide and attch the logs.....not copy and paste.  http://forum.avast.com/index.php?topic=53253.0

AdwCleaner
Malwarebytes
OTL
aswMBR


when done the removal experts will be notified. it may take hours before one arrive so be patient


Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: "Malicious URL Blocked" message
« Reply #2 on: January 14, 2013, 02:31:25 PM »
Monitoring

malkiera_11b

  • Guest
Re: "Malicious URL Blocked" message
« Reply #3 on: January 14, 2013, 08:28:44 PM »
Attached are the logs from OTL and MBAM

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: "Malicious URL Blocked" message
« Reply #4 on: January 14, 2013, 09:02:06 PM »
@ malkiera_11b

Hello and wellcome to avast!  8)
  • I will be working on your Malware issues this may or may not solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • If you don't know or understand something, please don't hesitate to ask.
  • Please refrain from making any further changes to your computer (Install/Uninstall programs, delete files, edit the registry, etc...)
  • Please DO NOT run any other tools or scans whilst I am helping you.
  • It is important that you reply to this thread. Do not start a new topic.
  • Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  • Absence of symptoms does not mean that everything is clear.
Your system is infected with MBR rootkit (aka Pihar.B). Please read Warning!! in "Logs to assist in cleaning malware" topic.
----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   

#Additional informations


> Before we start with malware removal I'd like to see GMER logs.


Please download GMER , AntiRootkit tool from the link below and save it to your Desktop :


Download GMER

Double-clicking to run GMER .
  • Wait for initial scan to finish - if there is any query, click No ;

  • Click Scan and wait until the full scan is complete;
  • Click Save ... - save the report to the Desktop (called Gmer1 );
    // note: the scan for Gmer1 log may take some time


  • Right-click in the window GMER and select Options> Only non MS files - click Scan ;
  • after a fasts scan, click Save ... - save the report to the Desktop (called Gmer2 );
     
> Please attach here Gmer1 and Gmer2 logreports.

----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   ----   


#Malware Removal


Step#1 

Download TDSSKiller  and save it to your desktop

    Execute TDSSKiller.exe by doubleclicking on it.

  •     Press Start Scan

     
  •   If Suspicious object is detected, the default action will be Skip, click on Continue.
     
  •   If Malicious objects are found, select Cure.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt


Please post the contents of that log in your next reply.


**************************

Step#2 


> Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.

> Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.

How to disable avast:

  • Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
  • In the window that opens on the top right corner, click Settings.
  • In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.

  • Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
  • In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn on this option after the cleaning.



> Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.

ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.

If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.
If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart computer once more.


> When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
  Attach log reports ( ComboFix.txt) back to topic.

malkiera_11b

  • Guest
Re: "Malicious URL Blocked" message
« Reply #5 on: January 14, 2013, 10:09:03 PM »
Hi, and thanks for your response.  Attached are the Gmer1 and Gmer2 logs. 

malkiera_11b

  • Guest
Re: "Malicious URL Blocked" message
« Reply #6 on: January 14, 2013, 10:13:02 PM »
The Gmer1 log exceeds the maximu total size allowed for attachments.  Here is Gmer2

malkiera_11b

  • Guest
Re: "Malicious URL Blocked" message
« Reply #7 on: January 14, 2013, 10:31:36 PM »
Attach is the log from TDSS

malkiera_11b

  • Guest
Re: "Malicious URL Blocked" message
« Reply #8 on: January 14, 2013, 11:12:15 PM »
Attached is the log from ComboFix

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: "Malicious URL Blocked" message
« Reply #9 on: January 14, 2013, 11:31:21 PM »
    Hi,

    For Gmer1 log, may you please go to this website:

http://pastebin.com

Please paste content of Gmer1 log to pastebin and then click to Submit button.
Just copy-paste URL link here so that i can see Gmer1 log.  :)


---   ---   ---   ---   ---   ---   ---   ---   ---


Multiple Antivirus Programs

You are running more than 1 Antivirus program!


AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}



Running - more than one - antivirus program is not recommended because:
  • They can conflict with each other.
  • Report the other antivirus software as malicious.
  • Antivirus programs use an enormous amount of computer's resources... actively scanning your computer.
  • Can cause your computer to become unstable...run slowly and even, in rare cases, BSOD crash...etc
I strongly suggest you uninstall one of them.  Which one, is your decision.

**************************
TDSSKiller has did a pretty good thing in first run. Let's run further scan.


  • Re-run TDSSKiller.exe and click on Change parametres.
  • Under Additional options check the boxes next to Verify Driver Digital Signature and Detect TDLFS file system, then click OK
  • Click on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • Click the Report button and attach the contents of it into your next reply
Note:It will also create a log in the C:\ directory.


***********************


Open notepad and copy/paste the text present inside the code box below:


Code: [Select]

KillAll::

Reboot::

File::
c:\windows\svchost.exe

ClearJavaCache::

DDS::
Trusted Zone: adultfriendfinder.com




Save this as CFScript.txt



Close all browser windows and refering to the picture above.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )
« Last Edit: January 14, 2013, 11:33:46 PM by magna86 »

malkiera_11b

  • Guest
Re: "Malicious URL Blocked" message
« Reply #10 on: January 15, 2013, 03:42:51 AM »
Couldn't post the Gmer1 to the postsite due to size limitations (it is 554K) so I saved the Gmer1 in 2 files (Gmer1.1 and Gmer1.2).  Here is Gmer1.1


malkiera_11b

  • Guest
Re: "Malicious URL Blocked" message
« Reply #11 on: January 15, 2013, 03:43:22 AM »
Here is Gmer1.2

malkiera_11b

  • Guest
Re: "Malicious URL Blocked" message
« Reply #12 on: January 15, 2013, 03:55:40 AM »
I have disabled Microsoft Security for now, until I decide whether to uninstall Avast or Mircrosoft Security.


Attached is the log for "Re-run TDSSKiller.exe and click on Change parametres."

malkiera_11b

  • Guest
Re: "Malicious URL Blocked" message
« Reply #13 on: January 15, 2013, 04:40:55 AM »
Attached is the log for "CFScript.txt into ComboFix.exe."

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: "Malicious URL Blocked" message
« Reply #14 on: January 15, 2013, 11:24:15 PM »
Hi,
Quote
I have disabled Microsoft Security for now, until I decide whether to uninstall Avast or Mircrosoft Security.

As you wish, but know that it's not enough to just disable and turn off antivirus. His files and drivers are still active in backgraund and they are loaded first before all other files.
It also will try to do the driver of the other antivirus. Both drivers will try to take main level privileges on the system (kernel driver [Ring]) and if one driver hook second driver...resulting may be BSOD (for example)

So, the above warning still stands.
---   ---   ---   ---   ---   ---   ---   ---   ---   ---

Please re-run TDSSKiller as before (with change parametres ) and use Delete option for this entry:

\Device\Harddisk0\DR0 ( TDSS File System )

*****************************

Open notepad and copy/paste the text present inside the code box below:


Code: [Select]

DeQuarantine::
C:\Qoobox\Quarantine\c\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk.vir
Quit::



Save this as CFScript.txt



Close all browser windows and refering to the picture above.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )

***************************


> How is your computer running now?  8)