avast! Web shield has blocked a harmful webpage or file
Infection: HTML:Iframe-inf
Action: Conection aborted
Process: …firefox.exe
It happened time to time, even I am not browsing. I have read something about, and I had run MBAM (which found nothing), and also the tool from OldTimer, rebouted and still nothing, I am still warned from ten to ten minutes.
Pls help, What should I do?
Follow this guide from our expert malware remover Essexboy
http://forum.avast.com/index.php?topic=53253.0
(post the log(s) here in this topic and not in the guide)
To avoid using multiple post with copy and paste you have to attach the log(s)
Lower left corner: Additional Options > Attach ( OTS log(s) )
Esexboy will then check the log(s) when he arrives later today
Don’t you have any other antiviruses installed?
No, I haven’t Though, I am using an relatively new laptop, running Win 7 starter, with avast free from the first run.
If I remember correctly, I had, my machine came with McAfee installed which stays for one month, than it was uninstalled, before Avast taken its place.
OTL will not fix anything unless told to - could you attach the logs
Ok, thanks, I’ll do that
If I understood well, it will be the OTS Text notepad, which it doesn’t seem to be like your notepad text from your:http://forum.avast.com/index.php?topic=53253.msg451454#msg451454
ok this is the file
In the mean time, avast continues to annoys me with pops up, and with a long list of logs.
Do you use a router ? And are any other systems using the router affected ?
Start OTS. Copy/Paste the information in the quotebox below into the panel where it says “Paste fix here” and then click the Run Fix button.
[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-2711803707-843163146-1541970072-1003\] > ->
YN -> HKEY_USERS\S-1-5-21-2711803707-843163146-1541970072-1003\: Main\\"Start Page" -> http://www.google.ro/
< FireFox Settings [Prefs.js] > -> C:\Users\Catalin Spantu\AppData\Roaming\Mozilla\FireFox\Profiles\9uyb0mxk.default\prefs.js
YN -> browser.search.defaultenginename -> "Secure Search"
< FireFox Extensions [User Folders] > ->
YY -> "BetterPrivacy" -> C:\Users\Catalin Spantu\AppData\Roaming\Mozilla\Firefox\Profiles\9uyb0mxk.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-2711803707-843163146-1541970072-1003\] > -> HKEY_USERS\S-1-5-21-2711803707-843163146-1541970072-1003\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{21FA44EF-376D-4D53-9B0F-8A89D3229068}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
YN -> WebBrowser\\"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Run [HKEY_USERS\S-1-5-21-2711803707-843163146-1541970072-1003\] > -> HKEY_USERS\S-1-5-21-2711803707-843163146-1541970072-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "Core Temp" -> C:\Exe files\Core temp\Core Temp.exe ["C:\Exe files\Core temp\Core Temp.exe"]
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here
I will review the information when it comes back in.
Yea, I am using a router, but I can try log using cable and check again, but may be loosing time
No need as there may be a router infection
Run the script first to see if that kills it - if not I will talk you through resetting the router
Oh god, how much it will take.
My laptop are running OTS since than, with “not responding” in to the bar and in to the status bar "Checking RpcSs Service: Do not intrerupt…
There are almost 30 min…
OK it is trying to create a restore point - close the programme and see if you are still getting the alerts
I had changed connection to the internet threw an 3g USB, and still getting alerts.
It means the problem is not solved.
OK before we reset the router lets get final confirmation that it may be at the root of the problem
Download ComboFix from one of these locations:
* IMPORTANT !!! Save ComboFix.exe to your Desktop
[]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
[]Double click on ComboFix.exe & follow the prompts.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
God my laptop it freezes, I can’t use any shortcut, open anything, because they are “prepared for deletion”
Reboot the system - this appears to be a ruter problem
Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled “reset” located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
Thanks essex. But I don’t think the problem came from the router, because in this morning I have the same warnings on my desktop, which have different internet provider, cable pluged, OS Win XP Pro.
Also I forgot tell you that the warns appears only when I am surfing, browsing using Firefox. I had made an online scan with BitDefender just before a warn, and didn’t found anything. When I am using IE 8, on both machines, no warnings. Though need use more IE, test it, which it is not my beloved browser. Still I am thinking if I will reinstall firefox will solve the problem, or in the same time this new VR.6 of avast doesn’t have any conflicting areas, because this warnings started after the program update.
I find that there are a lot of nooks and crannies in firefox that malware finds to hide. So I would suggest a full uninstall of FF
Do you think it will be an good idea reverting to previous Vr. of Avast to see what happen? If so, how to do that?
Thanks essex. But I don't think the problem came from the router, because in this morning I have the same warnings on my desktop, which have different internet provider, cable pluged, OS Win XP Pro.ISP makes no difference - do you use the same router ?