Malicious Url Blocked

[essexboy]

Download aswMBR.exe ( 1.8mb ) to your desktop.
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan 



On completion of the scan click save log, save it to your desktop and post in your next reply

[donjuangirl]

STILL HAVING POPUPS THIS VIRUS OR WHATEVER IT IS IS SERIOUS SMH!!!!!!!!!!!
OKAY HERE IS THE REPORT

[essexboy]

On the desktop will be a file mbr.dat could you rename it to MBR.txt and attach to your next post

Please read carefully and follow these steps.

• DownloadTDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

[donjuangirl]

here you go

[wali]

Wasn't trying to hijack this thread DavidR. I have the same issue. most places you post the same issue in the same thread, not start a new thread per person. I only posted and replied to help myself and others.

donjuangirl here is how I fixed the 2woody77.com.tw from popping up. All software was overlooking or will not remove since the file became system protected. your going to have to do this manually.

First your going to go to control panel and open folder options, clk the view tab, tic show hidden files and folders under the hidden files and folders. clk apply close that out.

open my computer, clk c: clk users, clk the folder name of the profile you having this issue with here we are going to use wali, clk temp, In there you should see the file thpm157572159625012743.tmp this is the file you need to get rid of.

1st I deleted everything in my temp folder. that file would not delete somehow its protected. I used unlocker to delete the file did a reboot and no more attacks.

you can download unlocker below:

http://download.cnet.com/Unlocker/3000-2248_4-10493998.html

you might want to go back to your control panel in folder options and reverse showing hidden files and folders

[donjuangirl]

essexboy enerything you told me to do worked thank you soooooooooooo much .

[DavidR]

Wasn't trying to hijack this thread DavidR. I have the same issue. most places you post the same issue in the same thread, not start a new thread per person. I only posted and replied to help myself and others.

donjuangirl here is how I fixed the 2woody77.com.tw from popping up. All software was overlooking or will not remove since the file became system protected. your going to have to do this manually.
<snip>

The problem being with things like this, any fixes suggested with the tools suggested are unique to that users system.

Also essexboy is already helping and is a qualified malware removal specialist, a teacher and moderator at the geekstogo Uni forum.

I have no idea of your experience levels, so I have no wish to insult you. But we have had lots of hassle from some individuals that though they were malware experts and could fix anything, whose abilities were sadly lacking. So we do have reservations when new people to the forums start trying to help.

[essexboy]

Thank you - could I have a copy of the MBR please as it looks like a new variant and I am sure GMER would like to play with it

You will find the dat file on the desktop it will be the one that I have highlighted, could you rename it to mbr.txt please and attach to your next post

How is the computer behaving now ?

[donjuangirl]

Hi Essexboy thanks so much again the computer is running great no more malicious url blocked popups I continue to do scans with malware,superantispyware and of course with AV and everything is coming up clean. I have attached what you asked for. Once again thanks a billion .

[wali]

DavidR says: The problem being with things like this, any fixes suggested with the tools suggested are unique to that users system.

Also essexboy is already helping and is a qualified malware removal specialist, a teacher and moderator at the geekstogo Uni forum.

I have no idea of your experience levels, so I have no wish to insult you. But we have had lots of hassle from some individuals that though they were malware experts and could fix anything, whose abilities were sadly lacking. So we do have reservations when new people to the forums start trying to help.


My 1st post had nothing to do with help. read it.... said....

I'm getting the same issue just after an update. I updated and ran Avast full scan found nothing, updated and ran malwarebytes full scan found nothing, ran a Kaspersky TDSSKiller nothing.

I'm confused ? should i be worried or is this just a glitch.

says I have the same problem and here's what I did and it didn't work can you help me? then you commented saying don't hijack the thread. Read before you post. donjuangirl and myself are back to normal that's all that counts that's what these forums are for.

Thx for all the help and have a great day everyone.

[essexboy]

donjuangirl thank you for the MBR - Avast now has a name for it - I have uploaded for further analysis 

Once you are happy let me know and I will remove my tools

[Luvj19]

Hey Essexboy...I was having the same issue as well as it killing my svchost and bogging my system down...I followed your steps and system is running sweet...very helpful..thanks a ton! I was close to deleting a bunch of unnecessary crap too!!!

[essexboy]

 Luvj19 you need to be cautious as some fixes are specifically crafted for that system

But glad all is OK 

[Luvj19]

Whew...glad I didn't screw anything up then and its purring like a brand new machine...I know next time

[Luvj19]

essexboy....It's back..but attacking my dlbtpplc32.exe file HELP! Also, I'm getting pop ups from AVAST asking me to send stuff for analysis or something too