Author Topic: Mal:URL  (Read 6954 times)

0 Members and 1 Guest are viewing this topic.

Offline cariad140

  • Newbie
  • *
  • Posts: 18
Re: Mal:URL
« Reply #15 on: March 01, 2012, 04:35:25 PM »
That I didn't know

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83009
  • No support PMs thanks
Re: Mal:URL
« Reply #16 on: March 01, 2012, 05:00:49 PM »
Not many do ;D
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40631
  • Dragons by Sasha
    • Malware fixes
Re: Mal:URL
« Reply #17 on: March 01, 2012, 08:41:34 PM »
Hi I am seeing TrendMicro, AVG and Avast as resident.  You need to determine which one to keep and uninstall all the others

On completion of this run can you let me know if the alerts persist

  Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Quote
    :OTL
    IE - HKU\S-1-5-21-3917816277-2301944540-3967082003-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = http://ame.bascom.net/proxy.pac
    FF - prefs.js..network.proxy.autoconfig_url: "http://ame.bascom.net/proxy.pac"
    FF - prefs.js..network.proxy.type: 2
    FF - prefs.js..browser.search.selectedEngine: "Search the Web"

    :Reg
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "adaware_XP"=-

    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [CREATERESTOREPOINT]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83009
  • No support PMs thanks
Re: Mal:URL
« Reply #18 on: March 01, 2012, 09:01:49 PM »
Thanks for joining us essexboy.
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline cariad140

  • Newbie
  • *
  • Posts: 18
Re: Mal:URL
« Reply #19 on: March 01, 2012, 09:06:55 PM »
Trend  came with the pc and was never run or activated.  I thought I'd uninstalled it, obviously something is lingering. I will check when I go back into work. However, I'm done for the weekend, I don't go back in until Monday so please don't think I'm ignoring your advise and fix. I will take care of both on Monday and post again. Have a good weekend.

Thanks. :)

Lynne

Offline cariad140

  • Newbie
  • *
  • Posts: 18
Re: Mal:URL
« Reply #20 on: March 05, 2012, 03:02:48 PM »
Unfortunately it's not fixed. Within 5 minutes of turning the pc on this morning, without opening any browser the Mal:URL pop up graced my screen.

I just ran the 'fix' above and rebooted and nothing within the last 5 minutes. Log attached.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83009
  • No support PMs thanks
Re: Mal:URL
« Reply #21 on: March 05, 2012, 03:20:05 PM »
Sounds like you were reinfected, not that it wasn't fixed as you had a few days with nothing (last post to this one), is that correct ?

So it looks like the fix was working, but you still have the vulnerability which is allowing this back in.

Have you completely removed the TrendMicro and AVG anti-viruses from your system ?
Also see http://singularlabs.com/uninstallers/security-software/, this has a collection of manufactures removal tools, so that should remove any remnants, registry, etc.
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline cariad140

  • Newbie
  • *
  • Posts: 18
Re: Mal:URL
« Reply #22 on: March 05, 2012, 03:33:32 PM »
There's nothing in control panel add remove programs that suggests nothing but avast is installed.

I ran the fix this morning, but since then 2 alerts have popped up. I'm still at a loss.  ??? :-\

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83009
  • No support PMs thanks
Re: Mal:URL
« Reply #23 on: March 05, 2012, 03:43:35 PM »
I would still suggest checking using the uninstall tools to remove all possible remnants.

You didn't answer this one.
Quote from: DavidR
Sounds like you were reinfected, not that it wasn't fixed as you had a few days with nothing (last post to this one), is that correct ?

Essexboy will have to revisit this one and see if he can find anything either restoring this or a vulnerability allowing reinfection. It will be a few hours before essexboy is back from work and on-line, now 2:45pm in the UK he is normally back on line around 7pm.

In the meantime can you run OTL, etc. again following the guide and attach the logs requested
http://forum.avast.com/index.php?topic=53253.0 so when he is available he has something to work with.
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline cariad140

  • Newbie
  • *
  • Posts: 18
Re: Mal:URL
« Reply #24 on: March 05, 2012, 04:45:42 PM »
After running combo fix on Thursday, the pop ups ceased. The pc wasn't turned on at all after Thursday as I was off Friday and the weekend.

The pop ups started almost immediately on turning the pc on this morning (Monday 9am est)

Ran Essexboy's fix and rebooted, the pop ups are still coming. Granted not as frequently, but still there. Most concerning webgetclick.com

I can't see AVG showing up anywhere, but trend still appears in the OTL logs as a firefox extension, although the only extension I see in Firefox when I open it is fireftp.

Yes I did run the uninstall from the website you posted.



Attached is the lates OTL scan.

I really hate computers!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83009
  • No support PMs thanks
Re: Mal:URL
« Reply #25 on: March 05, 2012, 05:07:45 PM »
OK, we will have to wait for essexboy or one of the other qualified malware removal specialists to analyse the log file.
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 83009
  • No support PMs thanks
Re: Mal:URL
« Reply #26 on: March 05, 2012, 05:32:35 PM »
Whilst I'm no malware removal specialist, I have had a look over the OTL log, I see is it is reported that you have Mozilla Firefox 9.0.1, this is out of date and may well mean it is vulnerable. The latest version is Mozilla Firefox 10.0.2, which aside from bug fixes I believe it closes some security issues.

I don't know what add-ons you have installed, but I would look at those and remove any that you don't actively use or can't recall installing. I would also suggest (when you have the latest version of firefox) installing the firefox NoScript add-on. This blocks scripts from running until you specifically allow then for the site you are visiting.

You also appear to have an old version of JAVA the latest is JAVA 7 Update 3.
- I would also suggest a visit to this site, which scans your system for out of date programs that have patches to close vulnerabilities, http://secunia.com/software_inspector/.
WinXP ProSP3/ Core2Duo E8300/ 4GB Ram/ avast! free 18.5.2342/ Firefox ESR, uBlock Origin, uMatrix/ MailWasher Pro7.11.0/ DropMyRights/ WinPatrol+/ Drive Image 7.1/ SnagIt 10.0/ avast! mobile security
Windows 10 Home 1909 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 20.2.2401 (build 20.2.5130.570) UI-1.0.505/ WinPatrol+/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40631
  • Dragons by Sasha
    • Malware fixes
Re: Mal:URL
« Reply #27 on: March 05, 2012, 08:47:04 PM »
Hi it is a different infection

Download aswMBR.exe ( 4.1mb ) to your desktop.
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan 



On completion of the scan click save log, save it to your desktop and post in your next reply



Then delete the current copy of combofix and download then run a fresh copy

Download ComboFix from one of the following locations:
Link 1
Link 2

Offline cariad140

  • Newbie
  • *
  • Posts: 18
Re: Mal:URL
« Reply #28 on: March 06, 2012, 03:35:21 PM »
aswMBR log attached

Offline cariad140

  • Newbie
  • *
  • Posts: 18
Re: Mal:URL
« Reply #29 on: March 06, 2012, 03:51:22 PM »
Incidentally, I ran tdsskiller at the end of the day (Monday) yesterday.

This pc has been on since 8:45 am (est) it's now, 1:45 and I haven't had any MAL:URL pop ups.
« Last Edit: March 06, 2012, 07:46:19 PM by cariad140 »