Malicious URL blocked

[jomztaruc]

So i've downloaded a torrent via phone(it includes codec), i cant play it so ive decided to play it at my laptop. Unluckily i can't play it too(looking for some codec), since the torrent file the ive downloaded includes codec i installed it(not sure if it was installed or what). Since then, avast warning keeps on popping out saying Malicious URL blocked. Every now and then it pops out, i guess every 30secs(not sure). Ive tried to search for solution but its kinda complicated and im not sure if the one that i saw have the same problem as i have. So i post here(almost all the results are from this site). Please do help me, its kinda annoying. Btw im not sure if its because of the CODEC or what. I also installed "Advance system care 6"(i thought that it might solve the problem). Cant also browse using google chrome, always shows warning(so ive uninstalled chrome cause i thought it might solve the problem, still no luck). Now i'm using Mozilla Firefox and i cant login at google(looking for cookies, so i tried to enable something mentioned at instructions but still no luck. I hope you guys can help me.

MY LAPTOP:
Manufac: Acer
Model: Aspire 4730Z
Processor: Intel Premium Dual CPU T3400 @ 2.16ghz 217ghz
RAM: 3gb
System type: 32bit OS

ERROR MESSAGE INDICATES(THE ONE THAT POPPED OUT)

OBJECT: bsfun.com/
INFECTION: URL:MAL
ACTION: BLOCKED
PROCESS: C:\WINDOWS\SYSTEM32\SCVHOST.EXE

[essexboy]

The torrent and the codecs have infected you

Download OTL  to your Desktop
Secondary link

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

• Select All Users
  
• Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Attach  both logs

[jomztaruc]

Here you go.

[essexboy]

Multiple infections here

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
C:\ProgramData\BetterSoft
c:\Program Files\BrowseToSave
C:\ProgramData\Browsee2saave
SRV - File not found [Auto | Stopped] -- -- (Winstep Xtreme Service)
SRV - File not found [Unknown (-1) | Unknown] -- -- (SKYNETrvnsxyqe)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (XDva300)
DRV - File not found [Unknown (-1) | Unknown (-1) | Unknown] -- -- (SKYNETrvnsxyqe)
O2 - BHO: (Browsee2saave) - {1EE53832-30EE-7924-5350-98544FF758ED} - C:\ProgramData\Browsee2saave\512d143499ba8.dll ()
O20 - AppInit_DLLs: (c:\progra~1\easylife\sprote~1.dll) - File not found
O20 - AppInit_DLLs: (c:\progra~1\browse~1\sprote~1.dll) - c:\Program Files\BrowseToSave\sprotector.dll ()
O33 - MountPoints2\{f67bed7f-0490-11de-951f-001eecd87995}\Shell\AutoRun\command - "" = F:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\OgarD.exe
O33 - MountPoints2\{f67bed7f-0490-11de-951f-001eecd87995}\Shell\open\command - "" = F:\SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\OgarD.exe
[2013/02/27 03:33:10 | 000,000,000 | ---D | C] -- C:\ProgramData\SoftSafe
[2013/02/27 03:31:01 | 000,000,000 | ---D | C] -- C:\ProgramData\BetterSoft
[2013/02/27 03:30:26 | 000,000,000 | ---D | C] -- C:\Program Files\BrowseToSave
[2013/02/27 03:30:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Browsee2saave
[2013/02/27 03:30:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Browsee2saave
[2013/02/27 03:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2013/02/27 02:24:01 | 000,000,000 | ---D | C] -- C:\Users\Melissa Taruc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mega Codec Pack
[2013/02/28 00:59:51 | 000,000,432 | -H-- | M] () -- C:\Windows\tasks\schedule!3036567561.job
[C:\Windows\$NtUninstallKB59234$] -> Error: Cannot create file handle -> Unknown point type

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

FINALLY


Download AdwCleaner from here to your desktop
Run AdwCleaner and select Delete



Once done it will ask to reboot, allow this
On reboot a log will be produced please attach that

[jomztaruc]

Working now. Will edit this reply for the attachments later

Edit- No logs produce, should i rerun combo fix?

[essexboy]

Download this copy please it is named http://www.majorgeeks.com/Combofix_d6402.html

[jomztaruc]

I renamed combofix to combofix1 (wont run unless the name is change)

Now its running and a blue bar showed with texts on it

Scanning infected files
This typically doesn't take 10minutes
However, scan times for badly infected machines may easily doubled.

Is it normal? Should i wait for it?

Edit- nothing happens man, stays on it
Nothing is happening man. (((

[jomztaruc]

Anyooooone

[mikaelrask]

hey wait for essexbox to help you he be online later today to continue with you problem.

[essexboy]

Could you reboot and run combofix from safe mode

If that fails then what is  the version of windows that you have ?  And do you have a spare USB drive

[jomztaruc]

What do you mean by USB spare drive?
Combofix will only run to me when its renamed (Ex: Conbofix1)
But i think its not running normally. Stuck at:

Scanning infected files
This typically doesn't take 10minutes
However, scan times for badly infected machines may easily doubled.

Sorry if im being impatient i thought i was ignored yesterday. Sorry guys i hope i can fix this today. Thanks!

[essexboy]

Is combofix counting through stages i.e 1,2,3 etc or is it just a blue box ?

[jomztaruc]

After some patches blue box pops out with words in it(i forgot what words) and it changed to "scanning infected files.. Will take 10mins.. Scan times for badly infected files might be doubled" it was stuck there for more than 10mins. Redownloading combofix and rerunning it wont work too. There's a small bar blinking at the end of the sentence (which indicates that its still working but not working properly i guess)

[essexboy]

Have you tried in safe mode ?

[jomztaruc]

Havent tried it, should i try it?