Avast keeps blocking malicious URLS that I am not trying to visit

Viruses and worms
1

Right after windows starts up, I get a whole bunch of malicious URLS being blocked that I am not even trying to visit.

When this happens (several times in a row) then it forces a BSOD.

I can boot up in safe mode and this doesn’t happen. I can run MBAM but when I try to “delete” the issues it BSOD. So I saved a log pre-delete attempt.

I have attached several logs.

Please help me.

Thank you all

Danbert

2

Looks like a new one

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL DRV - File not found [Kernel | On_Demand | Unknown] -- -- (.dfsc) O4 - HKLM..\Run: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe File not found O4 - HKLM..\Run: [IntelAgent] C:\Windows\Temp\temp68.exe File not found O4 - HKLM..\Run: [WoTuDITMYEaeiyp.exe] C:\ProgramData\WoTuDITMYEaeiyp.exe ( ) O4 - HKU\.DEFAULT..\Run: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe File not found O4 - HKU\.DEFAULT..\Run: [Mshost Manager] C:\Windows\System32\config\systemprofile\AppData\Roaming\svchost.exe ( ) O4 - HKU\S-1-5-18..\Run: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe File not found O4 - HKU\S-1-5-18..\Run: [Mshost Manager] C:\Windows\System32\config\systemprofile\AppData\Roaming\svchost.exe ( ) O20 - HKU\.DEFAULT Winlogon: Shell - ("C:\Windows\system32\config\systemprofile\winlogon.exe") - File not found O20 - HKU\S-1-5-18 Winlogon: Shell - ("C:\Windows\system32\config\systemprofile\winlogon.exe") - File not found [2012/04/03 17:30:56 | 000,000,000 | ---D | C] -- C:\Users\Legs\AppData\Roaming\Antivirus Protection [2012/04/07 10:47:56 | 000,306,176 | ---- | M] ( ) -- C:\ProgramData\WoTuDITMYEaeiyp.exe [2009/07/13 20:14:41 | 000,353,792 | -H-- | M] ( ) MD5=61BC5B5088F99C070E9B587EBD00F7DA -- C:\Windows\$NtUninstallKB58381$\systemprofile\AppData\Roaming\svchost.exe [2009/07/13 20:14:41 | 000,353,792 | -H-- | M] ( ) MD5=61BC5B5088F99C070E9B587EBD00F7DA -- C:\Windows\System32\config\systemprofile\AppData\Roaming\svchost.exe

:Files
ipconfig /flushdns /c
xcopy %Temp%\smtmp\1 “%AllUsersProfile%\Start Menu” /H /I /S /Y /C
xcopy %Temp%\smtmp\2 “%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch” /H /I /S /Y /C
xcopy %Temp%\smtmp\3 “%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar” /H /I /S /Y /C
xcopy %Temp%\smtmp\4 “%AllUsersProfile%\Desktop” /H /I /S /Y /C

:Commands
[purity]
[resethosts]
[emptyjava]
[emptyflash]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download the latest version of TDSSKiller from here and save it to your Desktop.

[*]Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_1.jpg

[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_2.jpg

[*]Click the Start Scan button.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_3.jpg

[*]If a suspicious object is detected, the default action will be Skip, click on Continue.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_4.jpg

[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_5.jpg

[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of “TDSSKiller.[Version][Date][Time]_log.txt”. Please copy and paste its contents on your next reply.

3

Excellent

Thank you so much for your help.

I was actually able to run Windows in normal mode with out a ton of messages popping up and causing BSOD.

I have attached the txt file as the pasted text exceeds the max allowed characters.

Thanks again for your help.

4

Re-run TDSSKiller and if this element appears select delete:

\Device\Harddisk0\DR0 ( TDSS File System )

How is the computer behaving now

5

Sorry was out all day today. I truly appreciate your help.

It has ran all day with out incident. I will re-run TDSSKiller Monday after work.

Again, Thanks

Dan