Another hxxp://54.187.243.98 issue...

Viruses and worms
1

I’d like to take a moment before posting my info here to A. Thank Avast for making such a good antivirus that I legitimately believed I could recklessly browse unsafe sites, and B. Thank the hard working volunteers who have already helped other people on this forum with the same issue I’m now having.

About every 20-40 minutes Avast pops up and warns me that they’ve blocked an infection from hxxp://54.187.243.98. I followed the pinned instructions; MBAM found nothing. The following four logs are attached: MBAM’s log, the FRST and Addition log, and the aswMBR log.

Thanks for any help I can get.

2

I’m looking at your logs now.

3

One of the malware removal specialists will take a more thorough look at your logs. Thank you for posting, and thank you for the compliments to Avast. I’m sure they, and I appreciate them. :slight_smile:

In the meantime, please do the following:

  • Turn off your iCloud and do not sync anything with your machine (including your phone or any other device).
  • If you are on a Network, disconnect this machine from the Network.
  • Do not use the machine until instructed by the malware removal specialist. This includes playing games, Skype, etc.
  • Do not attempt to try and repair the machine yourself or by anyone else’s instruction other then the malware removal specialist. They come on the forum at different times, so please be patient.

Do you have any questions?

4

I understand. iCloud has been disabled.

Avast is running a full system scan which should last all night, but asides from that the machine is not being utilized. Thank you!

5
Avast is running a full system scan which should last all night,
not necessary, wait for instructions......
6

Thanks Pondus…you beat me to it. ;D

7

It looks like Avast stopped the main download but missed this one little bit

This should stop the alerts

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CMD: bitsadmin /reset /allusers CMD: DEL %TEMP%\*.* /F /S /Q CMD: RD /S /Q %TEMP% REBOOT:

Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

8

Thank you. So far no alerts since the reboot…

It won’t let me attach the Fixlog.txt file- Windows is saying it’s 4.2MB??- How would you like me to proceed?

9

Upload to a fileshare site and post download link here

10

No problem as that is all probably temp files… A final check for any adware I feel

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.