Infection URL:Mal

[REDACTED]

No luck, the search did not find anything (as I can see from the 2 attached files, for both types of popups).

[essexboy]

OK been discussing this with Magna ..


Disconnect from the internet

To open an Administrator Cmd prompt from the Desktop  use Win + X and choose Command Prompt (Admin) from the list.

In the black box type in/copy the following commands, each one followed by enter  :

ipconfig /flushdns
netsh winsock reset catalog
netsh int ip reset c:\resetlog.txt
ipconfig /release
ipconfig /renew

Then reboot the computer

[REDACTED]

Disconnected, run the commands with the attached output (please note that I connect wirelessly to a home router).
Restarted and waited for some minutes with no network connection and nothing happened.
As soon as I connect to the router and start the internet connection I receive 28 notices from Avast (as in the attached screenshot).

[essexboy]

C:\WINDOWS\system32>netsh int ip reset c:\resetlog.txt
Resetting Interface, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting , failed.
Access is denied.

OK I need to check this out

[REDACTED]

Yes, I noticed that also, and the file c:\resetlog.txt was not created on the disk.

[essexboy]

OK lets now try FRST as I think we are on the track of the blighter now

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CMD:ipconfig /release
CMD:netsh int ip reset
CMD:ipconfig /renew
REBOOT:

 
Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

[REDACTED]

Seems like FRST64 has the same result as running manually the commands.
It seems that is something directly hooked into the network connection as the popups appear immediately after activating the wireless interface.

[essexboy]

Could you disable Avast self protection and run the FRST fix again please

[REDACTED]

Disabled all Avast shields and rerun the fix and the result is the same
I see that some other people are having issues with that specific command (http://www.eightforums.com/network-sharing/18945-error-when-resetting-tcp-ip-stack.html).

[essexboy]

OK we will need to activate the super admin account.   We must turn this off on completion

To open an Administrator Cmd prompt from the Desktop  use Win + X and choose Command Prompt (Admin) from the list.

In the black box type in/copy the following command   :

net user administrator /active:yes


Validate by pressing Enter.

Now log off and select the administrator account that should appear


To open an Administrator Cmd prompt from the Desktop  use Win + X and choose Command Prompt (Admin) from the list.

In the black box type in/copy the following commands, each one followed by enter  :

ipconfig /flushdns
netsh int ip reset c:\resetlog.txt
ipconfig /release
ipconfig /renew

Then reboot the computer to your normal account

If the fix is a success turn off the super admin :


To open an Administrator Cmd prompt from the Desktop use Win + X and choose Command Prompt (Admin) from the list.

In the black box type in/copy the following command :

net user administrator /active:no


Validate by pressing Enter.

[REDACTED]

netsh int ip reset c:\resetlog.txt has the same result using Administrator account so maybe it is just not working completely on windows 8.1.

[essexboy]

OK I will check how to retake permissions on that reg key

[essexboy]

When you disabled Avast self protection did you remove the tick in Settings > Troubleshooting

[essexboy]

OK this small programme should reset all registry key permissions to default, which should allow us to revert the changes

Download and run Reset Registry Permissions from here http://www.tweaking.com/content/page/reset_registry_permissions.html
Once it has finished then try the netsh int ip reset  command again

[REDACTED]

When you disabled Avast self protection did you remove the tick in Settings > Troubleshooting

Yes, that was what I did and also disabled the shields.