Url: Bad/ webgetclick.com

[Dimbo]

Avast keeps on blocking a bad url from webgetclick.com and I have no idea how to get rid of it.

Anyone who can help me?

[essexboy]

Hi I need to dive right in with the big hammer on this one

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[Dimbo]

The scanning took me quite some time and I didn't expect an answer this quick (thanks for that!)

I will run Combofix tomorrow and post the log here

[essexboy]

No problem I usually arrive at about 7:30 GMT

[Dimbo]

I started running ComboFix, did not mouse click it, but turned back to this forum to check on the next steps.
After this the ComboFix screen did not appear anymore.
Searching for ComboFix.txt on my computer does not give any results.

How should I proceed?

[Dimbo]

btw I have not encountered the original problem frequently since starting up today.
That is only 2 or 3 times instead of once every 2 or 3 minutes.

[essexboy]

Could you try combofix from safe mode please and let me know the outcome

[Dimbo]

Here the report from combofix out of the safe mode

[essexboy]

OK next question, do the redirects appear in Firefox, IE or both ?

 

[Lunalei1]

Hello... I am also having this same problem... I can tell you it involves Internet Explorer as it is currently the only browser on the computer..  Is this a new virus or worm?  My Avast is popping up even when I don't have the browser open, I am guessing it is because I am still connected to the internet... Any help you can give me would be soooo appreciated

[Dimbo]

They appear in IE essexboy. I didn't use Firefox for quite a while

[essexboy]

Hmm this is something new - so we may have to do some digging around

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  IE - HKU\S-1-5-21-2419282362-3302599347-3895743432-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
  O3 - HKU\S-1-5-21-2419282362-3302599347-3895743432-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  O3 - HKU\S-1-5-21-2419282362-3302599347-3895743432-1000\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download the latest version of TDSSKiller from here and save it to your Desktop.
 
 

• Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
   
  
   
  
• Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
   
  
   
  
• Click the Start Scan button.
   
  
   
  
• If a suspicious object is detected, the default action will be Skip, click on Continue.
   
  
   
  
• If malicious objects are found, they will show in the Scan results and offer three (3) options.
• Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
   
  
   
  
• Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

[Dimbo]

Here the 2 reports (the extra.txt did not change).

Avast intervened when running Kaspersky. Is this ok?

Edit: OTL.txt will follow in seperate post due to max total size

[Dimbo]

OTL.txt

[essexboy]

While I look at the OTL log

Please re-run TDSSKiller and when this part is shown select delete

\Device\Harddisk0\DR0 ( TDSS File System )