What is this? Shows up almoust every site I go

[JanneH]

Please help me with this. Avast warns me almoust every site I go.

[mchain]

Hi JanneH,

Likely Avast! is blocking malware on your system.

Is it only in Google Chrome this shows?

Please visit http://forum.avast.com/index.php?topic=53253.0, run Malwarebytes, OTL, and aswMBR only, and attach all logs produced in your next reply.

A malware specialist will be along shortly to assist you.  Please do not make any further changes to your system unless told to do so.

[JanneH]

yes only crome shows this message.

[mchain]

yes only crome shows this message.

I suggest you run the three programs listed above and attach the logs so that we can get going and fix your problem.

Thank you for attaching the screenshot.

[JanneH]

first log file

[mchain]

first log file

JanneH,

essexboy has been notified. 

Thanks to the wonders of Google Translate, log is understandable. 

OTL, and aswMBR.exe need to be run, but as diagnostic tools only, same as with Malwarebytes.  Essexboy will come along soon, and craft a fix or two just for your system based on the logs you attach here.

[JanneH]

MBAM log

[JanneH]

OTL and Extras. If you have problem with language in earlier logfile, feel free to ask my help 

[JanneH]

and the last log file aswMBR

[essexboy]

On completion of this can you let me know if the alerts cease

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from "Start with Windows"
Reboot and then run OTL


Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  IE - HKLM\..\SearchScopes\{C1CF7F2B-BAD6-47FD-B3C5-648322173D57}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=e68ce693-0fc4-11e1-a8d0-001a9f92c52a&q={searchTerms}
  IE - HKLM\..\SearchScopes,DefaultScope = {56256A51-B582-467e-B8D4-7786EDA79AE0}
  IE - HKU\S-1-5-21-2011540971-2591290903-1419152939-1003\..\SearchScopes\{C1CF7F2B-BAD6-47FD-B3C5-648322173D57}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=e68ce693-0fc4-11e1-a8d0-001a9f92c52a&q={searchTerms}
  O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found
  O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
  O4 - HKU\S-1-5-21-2011540971-2591290903-1419152939-1003..\Run: [] File not found
  [2011.11.15 23:03:50 | 000,000,000 | ---D | M] -- C:\Users\Tekniikkaopisto\AppData\Roaming\VshareComplete
  
  :Files
  ipconfig /flushdns /c
  C:\Users\Tekniikkaopisto\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj
  C:\Users\Tekniikkaopisto\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda
  C:\Users\Tekniikkaopisto\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[JanneH]

OTL logfile. I haven`t seen that alert after that scan and reboot.

[essexboy]

OK could you run for a day and if there is no further problem I will remove my tools 

[JanneH]

Ok thats sounds good for me. What was the problem and what tools? 

[JanneH]

Do you think I should use somekind anti-malware program (Malwarebytes or Spywareblaster) ?

[essexboy]

No I feel it is a problem with certain versions of VshareComplete toolbar