Truminfi.com

[confutse]

Hi!
any idea what this is and why avast is blocking it every few minutes?
and how can i remove it?
thank you

[DavidR]

If you can post an image of the avast alert it will give us more information ?

What are you doing at the time this happens ?

What is your operating system and browser, etc. ?

The domain is one that avast considers malicious, see image, is this the same sort of image ?

[confutse]

Umm, how can i do that?

it happens every few minutes, even when i'm not in the net.

Win 7, firefox ver. 3.6.15

yes, it's exactly like that, the web address is a lot longer, filled with numbers.
oh wait, it says that process is explorer.exe

[DavidR]

You have to have some image capture software or printscreen and crop the image and save the image file. Then attach it to your post, additional Options on the reply window.

- When you click the Reply button, there is an Additional Options link, this expands the options to attach a file, that can be an image file or a text file (.log or .txt). Also see How to post an Image.

[confutse]

U can see the web address on the bottom of the screen, right?

[essexboy]

Looks like either a proxy malware or a dns hijack

Download OTS to your Desktop and double-click on it to run it

• Make sure you close all other programs and don't use the PC while the scan runs.
  
• Select All Users
  
• Under additional scans select the following

Reg - Disabled MS Config Items
Reg - Drivers32
Reg - NetSvcs
Reg - SafeBoot Minimal
Reg - Shell Spawning
Evnt - EventViewer Logs (Last 10 Errors)
File - Lop Check

• Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
  
• When the scan is complete Notepad will open with the report file loaded in it.
• Please attach the log in your next post.

[Hermite15]

clear all private data in the browser that you use and restart it. Then use CCleaner to clear what's left may be and temp folders content. This should get you rid of the issue.

edit: okay Essexboy posted in the meantime and sees potentially something else

[confutse]

like this?

[essexboy]

Yep - this will also flush out all your temps for you.  After reboot let me know if you still get the alerts 

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

Code: [Select]

[Unregister Dlls]
[Registry - Safe List]
< Run [HKEY_USERS\S-1-5-21-954531041-2713293074-437339881-1000\] > -> HKEY_USERS\S-1-5-21-954531041-2713293074-437339881-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "Stenabefogufagel" -> C:\Users\TT\AppData\Local\atPSNlev.dll [rundll32.exe  "C:\Users\TT\AppData\Local\atPSNlev.dll",Startup]
[Custom Items]
:Files
ipconfig /flushdns /c
:end
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]
 
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix.  Post that information back here

I will review the information when it comes back in.

[confutse]

like this?

[essexboy]

Have you turned off your system restore ?

Are you still getting the alerts ?

[confutse]

umm...i'm not sure about that system restore.
nope, no more alerts

[essexboy]

Ok that one is cleared - reference the system restore could you try to create one and let me know what error you get

[confutse]

Created a system restore point, didnt get any errors

[essexboy]

OK thanks - run OTS and hit the cleanup button and it will disappear