Avast Infection Block: blackled.info

Viruses and worms
1

Hi usually when I start my PC I get this message from avast saying (in the Infection blocked details window):
URL: //blackled.info/4242/PathGeneration_142669364744408.dll <NOTE: http removed from the start before //>
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

I have run malwarebytes and its scan says its clear.

How do I remove this? All help much appreciated!

2

Hello,

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
bitsadmin /reset /allusers;b
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

3

OK ZOEK has been run. Took ages to run on firefox items.

Log attached.

So where did\does this malware hide?

How come Avast doesn’t\can’t clean it up?

4

First, let me ask you how is your PC behaving now?

5

PC seems OK. Didn’t really notice anything while running. More was at logon was the biggest issue with the avast alert.

Have rebooted a few times and seems ok on logon.

Will see how it goes over the next few days.

6

Keep me updated.

7

Will it looks like it is all clear!

So where did\does this malware hide?

How come Avast doesn’t\can’t clean it up?

I think it came from an F1 streamimg site (w w w.vipleague.se/sports/formula-1.html) - that was the only new thing because here in Australia we don’t get all the F1 races on free to air. And when I went to the site last weekend malwarebytes said it was a malicious website and stopped it. But Avast! was fine with it, even gives it the green tick of approval on google search pages!

8

It was some adware and temporary files, nothing too serious.

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

9

Cheers. All cleaned up and really appreciate your help! Thankyou!!