wpad.updatecheck

[REDACTED]

I've uninstalled Avast and Chrome and deleted some DNS registry entries from Rogue Killer. Added back a redundant nameserver from DNS Jumper and after multiple reboots no trace of the offending DNS entries. I think I'll reinstall Chrome first to check for bad extensions but debating on Avast. Navigation and tools seem fast just have to check printer connection.

Hoping to hear back tomorrow on possible issues or false positives.

[REDACTED]

Still waiting on whether to reinstall avast. Only Windows Defender running at this point. After reinstalling Chrome no bad extensions trying to reinstall. It took a couple of restarts for Chrome to go online but fine since then. The DNS warnings not there on RogueKiller either.

I think I had some issues but maybe not the exact ones Avast kept warning of. Either that or all the cleaning cleared some exploit or malware along the way. No odd behaviors yet today. I'm convinced we did some good through this process and hope to be able to reinstall Avast safely but still waiting and crossing fingers.

[essexboy]

I have heard back from Avast now and they have double checked the detection and it is good.. 

Are the alerts still coming

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
  
• Click on Scan.
  
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
  
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S0].txt as well.
  

[REDACTED]

OK Thanks. Ran another ADW Scan - results att:

[essexboy]

Are you still getting the alerts ?

[REDACTED]

I will reinstall Avast now and let you know. Nothing from Windows Defender and other cleaners seem to be coming up empty.

[REDACTED]

After reinstalling Avast for just 5 minutes and enabling extension in Chrome no popups so far. Will update.

The only changes I mage since having the popups were uninstalling Chrome and Avast and Running Rogue-Killer (deleted DNS I thin PUP warnings) and AWD Cleaner. All yesterday until reinstalling today.

[essexboy]

Do you have the Rkill and adwcleaner looks for me to peruse

[REDACTED]

Might need it because I just came back after a few hours reconnected the internet and got the wpad threat from Avast through svchost process. Amazing nothing then after a few hours idle it comes back. Will follow up in the am est tomorrow. After everything came up clean. Will run those 2 scans again.

[REDACTED]

OK ran scans with tools Rogue Killer, JRT and ADW.

It was fine until reinstalled Avast then let sit. Thanks again and good nite from here.

[REDACTED]

I'm having the same issue and I'm wondering if it's not a false positive also. It's linked to my svchost.exe process but when I ran frst like i was told to from my thread it just started popping up from other process's. Funny thing is when I uninstalled and completely removed avast and had no anti virus on my pc I had no pop up windows at all. When I reinstalled avast it told me it stopped pop up windows from opening immediately.

This sounds very similar to my issue. Now this morning no initial popups but I expect them soon.

[essexboy]

OK I believe we have pinned down where it is hiding


For 32bit systems, please download SystemLook from one of the links below and save it to your Desktop.
 
Download Mirror #1
Download Mirror #2
 
For 64bit systems, download SystemLook from here.
 
 

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

Code: [Select]

:Regfind
browserupdatecheck
wpad
wpad.browserupdatecheck.in


• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

 
Note: The log can also be found on your Desktop entitled SystemLook.txt

[REDACTED]

I can't get to that page or link. Not sure why. 64 bit

The requested URL /SystemLook.html was not found on this server.

And I'm getting the warnings again after computer was left on and timed out after reconnecting internet.

[essexboy]

OK it appears that the page is now down for some reason

So we will use FRST
Copy and paste the following into the search box in FRST :

browserupdatecheck;wpad;wpad.browserupdatecheck.in;browserupdatecheck.in

Then press Search Registry
A log will be generated please post that

[REDACTED]

Busy day but here is log.

Interesting article:

http://perimetergrid.com/wp/2008/01/11/wpad-internet-explorers-worst-feature/