Author Topic: Malicious URL Blocked- over and over and over  (Read 8226 times)

0 Members and 1 Guest are viewing this topic.

grover8t

  • Guest
Malicious URL Blocked- over and over and over
« on: August 25, 2013, 08:34:36 PM »
Hello there!  Like some others, I have a "threat has been detected" pop happening over and over again.  It is always Malicious URL Blocked, and the object always ends in /task/6/.  I read on another post that this is a virus trying to "phone home".

I am going through the process you have offered - Logs to assist in cleaning malware - running adwcleaner now, and hope someone out there will read my logs and help me.

Thank you!

grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #1 on: August 25, 2013, 09:07:20 PM »
adwcleaner log attached

grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #2 on: August 25, 2013, 09:39:33 PM »
Attached are the malware and the 2 OTL logs... anyone out there?  :)

grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #3 on: August 25, 2013, 09:48:00 PM »
And now I can't run aswMBR.exe because it is not a valid Windows 32 file or something.  Hopefully someone can help me with what I posted so far as the pops still going non stop... all objects ending in /task/6/

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37505
  • Not a avast user
Re: Malicious URL Blocked- over and over and over
« Reply #4 on: August 25, 2013, 10:51:12 PM »
Quote
anyone out there?
yep....and next time, do this in the virus and Worms forum section...thats what is was made for   ;)

try run aswMBR from safe mode


malware removers are notified, it may take hours before they arrive.....


grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #5 on: August 25, 2013, 11:09:51 PM »
Hey sorry.  I'll get on running that in safe mode. 

Shall I move now or remain here?

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Malicious URL Blocked- over and over and over
« Reply #6 on: August 25, 2013, 11:13:17 PM »
Stay here now

Could you let me know if this kills the alerts

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:Commands
[CREATERESTOREPOINT]

:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=fmtoby&chnl=fmtoby&cd=2XzuyEtN2Y1L1QzutDtDtBtCyD0DtB0BtBtD0F0E0DtB0CtCtN0D0Tzu0CtBtDtBtN1L2XzutBtFtCtFtDtFtAtDtC&cr=120480611
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=fmtoby&chnl=fmtoby&cd=2XzuyEtN2Y1L1QzutDtDtBtCyD0DtB0BtBtD0F0E0DtB0CtCtN0D0Tzu0CtBtDtBtN1L2XzutBtFtCtFtDtFtAtDtC&cr=120480611
IE - HKU\S-1-5-21-1159065996-402827216-737821929-1004\..\SearchScopes\{36474992-3D9F-4B8A-9191-98E61750BB4A}: "URL" = http://search.conduit.com/Results.aspx?ctid=CT3300019&SearchSource=45&UM=2&q={searchTerms}
[2013/07/21 10:32:28 | 000,000,000 | ---D | M] ("Trusted Saver") -- C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\Profiles\tk6znb9o.default\extensions\9b7182cf-0847-4d17-8a3f-c850f8c4a23e@51bca2a9-a5e9-4d98-8d77-40c0e8212d2a.com
[2013/07/20 14:34:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\Profiles\tk6znb9o.default\extensions\9b7182cf-0847-4d17-8a3f-c850f8c4a23e@51bca2a9-a5e9-4d98-8d77-40c0e8212d2a.com\chrome\content\extensionCode
[2013/06/26 12:22:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/06/26 12:22:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKU\S-1-5-21-1159065996-402827216-737821929-1004..\Run: [SPMTray] "C:\Program Files (x86)\PC Speed Maximizer\SPMTray.exe" File not found
[2013/08/25 14:58:46 | 000,001,842 | ---- | M] () -- C:\Windows\tasks\Trusted Saver-firefoxinstaller.job

:Commands
[resethosts]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN

Run AdwCleaner again and scan, once completed select all and press clean 

grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #7 on: August 26, 2013, 12:16:07 AM »
Here is the OTL report after running your fix.  Pop ups still happening.  Will run the adwhere thing again.

grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #8 on: August 26, 2013, 01:03:14 AM »
Ran adwcleaner again.  Still have pop ups.  :(

iroc9555

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #9 on: August 26, 2013, 02:02:51 AM »
Essexboy will be back tomorrow. It is almost 1 AM back in the UK.

Regards.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Malicious URL Blocked- over and over and over
« Reply #10 on: August 26, 2013, 11:36:57 AM »
Could you attach a screenshot of the Avast alert please as that will give more information

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
  • Accept the disclaimer and allow to update if it asks




  • When finished, it shall produce a log for you.
  • Please include the C:\ComboFix.txt in your next reply.[/b]
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #11 on: August 27, 2013, 04:26:48 AM »
Oops, had to go to work, screen shot attached, headed now to do other thing.

grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #12 on: August 27, 2013, 04:45:47 AM »
Cant find combotext log... rebooted and all, will perhaps run it again.

Attached two more visuals for ya of what is repeatedly and still happening...

grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #13 on: August 27, 2013, 05:07:47 AM »
Okay, took me a second time, but found the log from the combofix... read it was outputting to this 3277 file thingy dingy.

When I tried to attach and/or look at the file, I got a message saying I have no permission to do so.

I can't find the "text" file you refer to... searched computer for "combo" to no avail.

Avast blocking pop ups still happening over and over...

Please see attached file.  Sooooo thankful for your help in getting this laptop working!  Not sure what else a gal would do without the likes of folks like you!  :o


grover8t

  • Guest
Re: Malicious URL Blocked- over and over and over
« Reply #14 on: August 27, 2013, 05:24:42 AM »
Wait wait!  Something happening!  More soon.