Repeated 'Trojan Horse Blocked' / 'Malicious URL' alerts

[jeffce]

Hi,

Let's look over your keyboard registry key...

• Click Start > Run type Notepad click OK.
  
• This will open an empty Notepad file.
• Copy/Paste the contents of the box below into Notepad.

Code: [Select]

@echo off
regedit.exe /e "%userprofile%\Desktop\look.txt" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Kbdclass"
Notepad.exe %userprofile%\Desktop\look.txt
Del look.txt
Del %0


• Click Format and ensure Wordwrap is unchecked.
• Save as RegExp.bat
• Save as file type All Files or it won't work.
• Now double click on RegExp.bat to run it.
• A file look.txt will open on your Desktop, please post the contents in your next reply.

[jesamine]

@echo off
regedit.exe /e "%userprofile%\Desktop\look.txt" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Kbdclass"
Notepad.exe %userprofile%\Desktop\look.txt
Del look.txt
Del %0

[jeffce]

Did you have troubles with the instructions I provided?  There should have been a log created on your Desktop for you to attach. 

[jesamine]

Sorry, thought I'd managed it....that was what you gave me!  Yes, said I couldn't save it to that location (All Files), eventually I did save it, but when I clicked on the file a black screen momentarily appeared then vanished.

[jesamine]

Well today my computer became slow and unresponsive (it's low on RAM) and my profile page was re-directed to: http://agrifarma.com/p/as?64206 before Avast could kick in to stop it (first time that has happened) and I then received a WOT red warning on it.

[jeffce]

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
  
• when the window opens, click on Change Parameters
  
• under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
  
• click OK
  
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    
  • Then click Continue > Reboot now
    
• Copy and paste the log in your next reply
• A copy of the log will be saved automatically to the root of the drive (typically C:\)
  

[jesamine]

I double clicked the TDSSKiller.exe on the desktop, was given a sole option to 'run', which I clicked and then nothing happened, I sat with a busy mouse icon for ten minutes with no window showing?

[jeffce]

Hi,

Ok give it a run from Safe Mode and if a log is made attach it. 

[jesamine]

Just followed online advice here to rename it: http://www.bleepingcomputer.com/forums/topic372491.html, it has worked....scan box is now showing. 

[jesamine]

It says: No threats found. How do I find a copy of the log please? I can see it on the scan details, but can't copy it.

[jeffce]

Hi,

If it said no threats found that is fine.

GMER

Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  
  
  Click the image to enlarge it
  
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
• IAT/EAT
• Drives/Partition other than Systemdrive (typically C:\)
• Show All (don't miss this one)

• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
  
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries.
----------

[jesamine]

Hi,

Towards the end of the scan my computer abruptly stopped....a blue screen appeared: "A problem has been detected and Windows has been shut down to prevent damage to your computer" This is the second crash I have had, I'm too afraid to pursue this any further. I didn't see any issues listed up to that point. Would you kindly tell me how to remove GMER Rootkit Scanner, TDSSKiller.exe and OTL.

[jeffce]

I just want to clarify...Are you saying you don't want help any longer?  I only ask because I don't want to remove tools unless you are certain. 

[jesamine]

Although I don't like the idea of having 'nasties' on my computer and I do have complete faith in you, having a computer that is up and running is my main concern....I can't be without it. I have just had the same blue screen shutdown I had with the last scan, when I tried to carry out a dsk chk (which was clean after I managed to re-boot successfully). It said: Drive IRQL not less or equal....please check new installations (plus further instructions)?? I am worried that something has gone wrong, I have never had this type of shutdown before.

[jeffce]

It said: Drive IRQL not less or equal

Were you able to get the complete message that was shown by chance? 

Let's check to make sure you don't have a failing hard drive. 

Please download HD Tune (the free version not the trial), run an error scan on your primary harddrive (full not quick) and report back if any blocks aren't green. It tests your hard drive for bad sectors.