Skegnessasc Malware. Help!

[REDACTED]

Hi there,

Throughout today I have been receiving alerts from avast that it has blocked the threat skegnessasc.org. I have run a full system scan and also run a Malwarebytes scan, both have come back with nothing. I hope someone here can help!

Attached are the logs as per the pinned topic.

[Sass Drake]

Can you make screenshot of Avast message?

[REDACTED]

This is the avast popup.

[Sass Drake]

This will restart your system so save your work before this.

• Open Notepad (click Start button -> type notepad.exe -> press Enter)
• Copy text from code block below and paste it into Notepad

Code: [Select]

RemoveProxy:
cmd: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SearchList /d "" /f
Reboot:

• Go to File -> Save As
• Make sure that  UTF-8 is selected as Encoding (left side of Save button)
• Save it as fixlist.txt on Desktop
• Open again FRST and click on button Fix
• Wait until FRST finishes
• fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

[REDACTED]

I have done that, here is the log. Thanks for your help

[Sass Drake]

Does Avast still shows alerts for Skegnessasc?

[REDACTED]

It does, yes

[Sass Drake]

• Run FRST
• Paste following text in text box

Code: [Select]

skegnessasc.org

• Click on Search registry
• Attach Search.txt to your message

[REDACTED]

Here is the log, doesn't show anything though

[Sass Drake]

• Open Notepad (click Start button -> type notepad.exe -> press Enter)
• Copy text from code block below and paste it into Notepad

Code: [Select]

Hosts:
cmd: bitsadmin /RESET /ALLUSERS

• Go to File -> Save As
• Make sure that  UTF-8 is selected as Encoding (left side of Save button)
• Save it as fixlist.txt on Desktop
• Open again FRST and click on button Fix
• Wait until FRST finishes
• fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

[REDACTED]

Here is the log. Thanks again for your help. What shall I do now?

[Sass Drake]

Are you still getting popups for blocked URLs?

[REDACTED]

Hello

I was still getting popups, but since restarting I have not seen any. Should it be gone now? I was never able to pick it up on scans so it is hard to tell. Thanks for your help!

[Sass Drake]

Yup, it is gone now.

• Sledeća procedura će implementirati završno čišćenje.

:arrow:  Preuzmi "Xplode"-ov DelFix alat i snimi ga na Desktop.
Dvoklikom pokreni alat i štikliraj kućice ispred sledećih opcija;

Remove disinfection tools
Create registry backup
Purge System Restore

Klikni na dugme Run i pričekaj trenutak dok alat ne završi svoj rad.
Od ovog trenutka, svi korišćeni alati u ovoj temi bi trebali biti obrisani.
Alat će takođe formirati izveštaj za tebe. (C:\DelFix.txt)

[size=10]Alat će snimiti i zdravo stanje registy-ja i napraviti backup koristeci integrisan program "ERUNT" u %windir%\ERUNT\DelFix
Alat briše stare system restore tačke i pravi novu, svežu tačku nakon čišćenja.[/size]