« previous next »
Pages: [1] 2   Go Down

Author Topic: http://wpad.Home/wpad.dat  (Read 6795 times)

0 Members and 1 Guest are viewing this topic.

sys3rgy

  • Guest
http://wpad.Home/wpad.dat
« on: January 17, 2014, 06:13:53 PM »
Hello!

I've stumbled into a problem here. I turned on my laptop today and kept getting pop-ups from Avast that it has blocked my computer from accessing a website or file (http://wpad.Home/wpad.dat). The pop-up is rather annoying and I'm also worried if this "thing" is dangerous or not.

As per instruction, I've included logs from OTL and MBAM. I couldn't provide logs from aswMBR.exe as I am using Windows 8.

Thanks for your help  :)
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: http://wpad.Home/wpad.dat
« Reply #1 on: January 17, 2014, 07:05:26 PM »
Let me know if this stops it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:Commands
[CREATERESTOREPOINT]

:OTL
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www2.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=30AD0008CA8230C4
FF - prefs.js..extensions.enabledAddons: superstart%40enjoyfreeware.org:6.12
[2014/01/17 12:23:54 | 000,000,000 | ---D | M] (Super Start) -- C:\Users\Amir\AppData\Roaming\mozilla\Firefox\Profiles\umrgnpxd.default\extensions\superstart@enjoyfreeware.org
[2014/01/17 23:52:51 | 000,407,752 | ---- | M] () (No name found) -- C:\Users\Amir\AppData\Roaming\mozilla\firefox\profiles\umrgnpxd.default\extensions\jid0-w1UVmoLd6VGudaIERuRJCPQx1dQ@jetpack.xpi
[2014/01/03 20:06:50 | 000,833,482 | ---- | M] () (No name found) -- C:\Users\Amir\AppData\Roaming\mozilla\firefox\profiles\umrgnpxd.default\extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi
[2013/08/21 13:22:52 | 000,000,000 | ---D | M] -- C:\Users\Amir\AppData\Roaming\Awesomium
[2013/05/02 08:12:13 | 000,000,000 | ---D | M] -- C:\Users\Amir\AppData\Roaming\Babylon

:Commands
[resethosts]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
Logged

sys3rgy

  • Guest
Re: http://wpad.Home/wpad.dat
« Reply #2 on: January 17, 2014, 07:57:30 PM »
After the initial reboot from OTL, there was a single pop-up. But after the second reboot from Adwcleaner, everything seems to be quiet. Will notify if there are any occurrence after this post. Thanks :)

Edit: Its still there unfortunately :/. Another pop-up came out. But the rate of the pop-ups did decrease. Before this I would get around 2-4 pop-ups in 10 minutes.

As ordered, the logs are as attached.
« Last Edit: January 17, 2014, 08:20:00 PM by sys3rgy »
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: http://wpad.Home/wpad.dat
« Reply #3 on: January 17, 2014, 08:18:29 PM »
Let me know when you are happy and we will tidy up :)
Logged

sys3rgy

  • Guest
Re: http://wpad.Home/wpad.dat
« Reply #4 on: January 17, 2014, 08:23:04 PM »
Another pop-up came out right after I read your reply. Darn it! Guess its not over. Whats the next step Capt'n?
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: http://wpad.Home/wpad.dat
« Reply #5 on: January 17, 2014, 08:29:28 PM »
OK lets use this next

Please download Junkware Removal Tool to your desktop.
  • Right-mouse click JRT.exe and select "Run as Administrator" the tool will open and start scanning your system
  • please be patient as this can take a while to complete depending on your system's specifications
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • post the contents of JRT.txt into your next message.
Logged

sys3rgy

  • Guest
Re: http://wpad.Home/wpad.dat
« Reply #6 on: January 17, 2014, 08:44:33 PM »
Alright. Done. Awaiting instructions.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: http://wpad.Home/wpad.dat
« Reply #7 on: January 17, 2014, 08:57:05 PM »
Is it still occurring ?  This file is getting a list of updated servers, and sometimes it can just be a game trying to update from a bad site
Logged

sys3rgy

  • Guest
Re: http://wpad.Home/wpad.dat
« Reply #8 on: January 17, 2014, 09:04:26 PM »
Its still occurring. I'm surprised there's a lot of new threads regarding this problem. What is it actually? I've read in some older threads before mine that it could be an FP. Is this the case for me?
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: http://wpad.Home/wpad.dat
« Reply #9 on: January 17, 2014, 09:09:40 PM »
There is that possibility, I am looking for a common programme that would use that to update its list of servers
There is a programme on your system that is requesting an updated list and for some reason Avast does not like that server.  I will continue looking :)

But on the bright side you are now clear of any adware

EDIT: I have forwarded this thread to Avast for them to check out
Logged

sys3rgy

  • Guest
Re: http://wpad.Home/wpad.dat
« Reply #10 on: January 17, 2014, 09:18:04 PM »
Great! Good to hear I'm free of Adware.

Alright. Thanks for all your help :)! So, what do I have to do now? Do I just wait it out and keep checking this thread in case of a solution?
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: http://wpad.Home/wpad.dat
« Reply #11 on: January 17, 2014, 09:41:50 PM »
As soon as I either find the culprit or Avast releases a streaming update to fix it I am afraid so
Logged

sys3rgy

  • Guest
Re: http://wpad.Home/wpad.dat
« Reply #12 on: January 17, 2014, 09:43:55 PM »
Got it. I'll wait it out then. Thanks for all your help Capt'n :)! I'll keep visiting this thread in case of updates.
Logged

Offline Milos

  • Avast team
  • Super Poster
  • *
  • Posts: 2297
Re: http://wpad.Home/wpad.dat
« Reply #13 on: January 17, 2014, 10:23:00 PM »
Hello,
domain will be unblocked in next stream update.

Milos
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: http://wpad.Home/wpad.dat
« Reply #14 on: January 17, 2014, 10:49:41 PM »
Thank you Milos :)
Logged
Pages: [1] 2   Go Up
« previous next »