URL:Mal help i think infected

[REDACTED]

hello i've been getting random pop up from avast web shield every 1min.


url: http://103.1.138.141/ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/...

infection: url:MAL

process: C:\Windows\System32\svchost.exe


i have run a full scan and ran malware bytes on the system and everything seems to be ok

also when i tried to install malwarebytes, it gave me the pop up as well

URL: http://103.1.138.141/data-cdn.mbamupdates.com/v2/mbam/consumer/data/mbam-setup-2.0.4.1028.exe

infection: url:mal

process : c:\windows\system32\svchost.exe

please help i will be on this forum waiting for replies ty

--
edit
(yes i'm from singapore and i use M1 as ISP and ASUS Router)

Before I posted on this thread, i went ahad and used malware bytes to try to fix it my own and it caught 3 viruses ( the one i included in the attached is the latest one with no viruses )

-<mbam-log>
-<header>
<date>2015/02/13 19:18:01 +0800</date>
<logfile>mbam-log-2015-02-13 (19-17-57).xml</logfile>
<isadmin>yes</isadmin>
</header>

-<engine>
<version>2.00.4.1028</version>
<malware-database>v2015.02.13.04</malware-database>
<rootkit-database>v2015.02.03.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>

-<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x64</arch>
<username>Owner</username>
<filesys>NTFS</filesys>
</system>
-<summary>
<type>threat</type>
<result>completed</result>
<objects>320321</objects>
<time>151</time>
<processes>0</processes>
<modules>0</modules>
<keys>0</keys>
<values>0</values>
<datas>0</datas>
<folders>0</folders>
<files>3</files>
<sectors>0</sectors>
</summary>

-<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
-<items>

-<file>
<path>C:\Users\Owner\AppData\Local\Temp\6426.tmp</path>
<vendor>Spyware.OnlineGames</vendor>
<action>success</action>
<hash>7c7c7ba236544beb004f76f0d62a5aa6</hash>
</file>
-<file>
<path>C:\Users\Owner\AppData\Local\Temp\6965.tmp</path>
<vendor>Spyware.OnlineGames</vendor>
<action>success</action>
<hash>a7512fee5e2cf93d27285610c73909f7</hash>
</file>

-<file>
<path>C:\Users\Owner\AppData\Local\Temp\D7AF.tmp</path>
<vendor>Spyware.OnlineGames</vendor>
<action>success</action>
<hash>ad4b0a13602a80b6e06f6cfa1fe154ac</hash>
</file>
</items>
</mbam-log>

[Pondus]

for help, we need you to attach some logs

Logs to assist in cleaning malware   https://forum.avast.com/index.php?topic=53253.0

[REDACTED]

I have included the files

[Pondus]

I have included the files

the normal thing is to add logs in next reply, and not previous post .... as we look for a new reply with logs   

you dont have to redo it .... now you wait for a malware expert, it may take some hours before they are online

[essexboy]

The address is for mobile1 in Singapore  https://www.whoisthisip.com/ipwhois/103.1.138.141

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
2015-02-07 00:42 - 2015-02-07 00:42 - 00000000 __SHD () C:\Users\Owner\AppData\Local\EmieUserList
2015-02-07 00:42 - 2015-02-07 00:42 - 00000000 __SHD () C:\Users\Owner\AppData\Local\EmieSiteList
2015-02-07 00:42 - 2015-02-07 00:42 - 00000000 __SHD () C:\Users\Owner\AppData\Local\EmieBrowserModeList
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

[REDACTED]

Attached

[essexboy]

Are you still getting the alerts ?

[REDACTED]

Yes.

[essexboy]

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[REDACTED]

Attached combofix.txt



So far nothing has popped up yet but when I still try to download malware bytes it leads me to that IP website again

[essexboy]

OK that sounds like a DNS problem

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
c:\users\Owner\AppData\Local\EmieUserList
c:\users\Owner\AppData\Local\EmieSiteList
c:\users\Owner\AppData\Local\EmieBrowserModeList
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

[REDACTED]

Here is the attached after trying to download malware bytes it still leads me to this website
URL: http://103.1.138.141/data-cdn.mbamupdates.com/v2/mbam/consumer/data/mbam-setup-2.0.4.1028.exe

and then avast blocks it at usual saying it's URL:MAL

[essexboy]

Are you using other computers on this router ?  Do they have the same problem

[REDACTED]

Wait I tried to use my IPHONE to go to that website and it redirected me to that 103.x.x.x IP address (phone is using router's wifi)

[essexboy]

OK it sounds like a router infection...  Do you know how to reset the router ?