Malicious URL Blocked

[Fazer]

It's still doing the pop up and saying "Malicious URL Blocked"

I am really confused by this one

***EDIT*** If I can catch it quick enough I will grab a screenshot of what Avast is showing me

[Fazer]

Here is the screenshot, it just did it again

[essexboy]

Could you post the combofix log please as there may be something there that is hidden

[Fazer]

Here's the Combofix Log, I had to run it again as I couldn't find the original log
On saying that, since I ran it, I have not had a popup............YET

[essexboy]

Nothing appears hidden - however two files were suspect

h:\programdata\Microsoft\Network\Downloader\qmgr0.dat
h:\programdata\Microsoft\Network\Downloader\qmgr1.dat

[Fazer]

All seems well now, not had another popup in well over 15 mins.

THANKS TO ALL FOR YOUR HELP TODAY !!!!!!!!!!!!

[essexboy]

No problem let me know if it is OK tomorrow and I will remove the tools

[DavidR]

Martin, how is it that these .dat files can be responsible for this.

The DAT file type is primarily associated with 'Data'. Can be just about anything: text, graphic, or general binary data. There is no specific structure for a .DAT file. You can use an editor like EditPad Pro to look inside a .DAT file and possible determine its contents and relationship with a program. If you are looking for information on the file INDEX.DAT please see the FAQ.

Surely they just contain the data but need something else to activate them/do the dirty work ?

[essexboy]

qgmr.dat is actualy used by windows updates as a director to the site... Weird I know

[Fazer]

Just to let you know essexboy, Everything is still working fine, no more popups since I ran ComboFix yesterday

[essexboy]

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

 Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:


Click Start > Run  and copy/paste the following bolded text into the Run box and click OK: [color="#FF0000"]N.b. If used[/color]

ComboFix /Uninstall

Run OTS and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

SPRING CLEAN

To manually create a new Restore Point

• Go to Control Panel and select System
  
• Select System
  
• On the left select System Protection and accept the warning if you get one
  
• Select System Protection Tab
  
• Select Create at the bottom
  
• Type in a name i.e. Clean
• Select Create

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools page
  
• Select Performance Information and Tools
  
• Right click Disc cleanup an select run as administrator
  
• Select Your main drive and accept the warning if you get one
  
• For a few moments the system will make some calculations
• Select the More Options tab
  
• In the System Restore and Shadow Backups select Clean up
  
• Select Delete on the pop up
  
• Select OK
• Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
 
Malwarebytes.  Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update
  

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?
Keep safe  :wave:

[Fazer]

OK all done, I now have MBAM running permanently. Thanks again for all your help, it was greatly appreciated

[essexboy]

My pleasure