URL:Mal Infection Blocked

[REDACTED]

Every time I turn on my computer I get an Avast popup telling me an infection was blacked. The URL listed is different every time but it always lists the infection as URL:Mal and the process as C:\Windows\System32\svchost.exe.

Can someone help remove it permanently?

[Asyn]

Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253.0

[TwinHeadedEagle]

Monitoring

[REDACTED]

Logs are attached.

[REDACTED]

Sorry. aswMBR log is not complete. I will follow up when that's done.

[REDACTED]

Completed aswMBR log is attached.

[TwinHeadedEagle]

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
  
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:

Code: [Select]

createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b

• Make sure that Scan All Users option is checked.
  
• Push Run Script and wait patiently. The scan may take a couple of minutes.
  
• When the scan completes, a zoek-results logfile should open in notepad.
  
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

[REDACTED]

Zoek results attached.

[TwinHeadedEagle]

We will run one more Zoek fix:


Fix with ZOEK

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
  
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:

Code: [Select]

createsrpoint;
C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Preferences;f
chrdefaults;

• Make sure that Scan All Users option is checked.
  
• Push Run Script and wait patiently. The scan may take a couple of minutes.
  
• When the scan completes, a zoek-results logfile should open in notepad.
  
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

[REDACTED]

Zoek results attached.

[TwinHeadedEagle]

How is your PC behaving now?

[REDACTED]

While I did get the infection blocked pop up one last time last night it seems to be clear now. I'll follow up on this thread if it comes back again. Thanks for your help!

[REDACTED]

And then as if on cue I got the same popup again just minutes after I sent the last message. This time it happened when I opened Glary Utilities to run a scan.

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
  
• Make sure that Addition option is checked.
  
• Press Scan button and wait.
  
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
  

Please include their content into your next reply.

[REDACTED]

Attached. Thanks for your continued help.