Avast popups, Trojan Horse Blocked! Please Help!

system · December 5, 2012, 4:21pm

I upgraded from Avast Free to Avast! Internet Security and have been getting popups everyday since and have run full system scans to isolate them or quarantine but get more and more blocks everyday. Just while I have been searching this forum it went from 10 popup warning messages to 22 and they started before I even pulled up my browser. I run Chrome as my browser. I am not sure what to do to get rid of them but am getting more and more frustrated by the hour. When I have run the scans it tells me to run a boot scan but when I try it just has a black screen with a few micro dots that are different colors at the very top edge of screen and stays that way for up to two days before I finally hit escape several times and the computer just rebooted. I hope that someone can help me.
Here is a list of all 22 popup details:
First the popup that comes up says:
TROJAN HORSE BLOCKED
avast! Web Shield has blocked a harmful webpage or file.
Object:
Infection:
Process:
Then says more details and when I click on the icon it takes me to Avast which tells me I just dodged a bullet and gives me the details as pasted below.

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: HTML:Script-inf

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: HTML:Fraud-J

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: JS:ScriptSH-inf [Trj]

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: HTML:Redirector-AE [Trj]

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: JS:ScriptSH-inf [Trj]

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: HTML:Script-inf

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: HTML:Fraud-J

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: JS:ScriptSH-inf [Trj]

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: HTML:Redirector-AE [Trj]

Infection Details
URL: http://urlfilter.vmn.net/vmnsbf/data/121…
Process: C:\ProgramData\Anti-phishing Domain Advi…
Infection: JS:ScriptSH-inf [Trj]

I would appreciate any help given.

Asyn · December 5, 2012, 4:29pm

Run AdwCleaner…!!
Instructions: http://forum.avast.com/index.php?topic=53253.0

system · December 5, 2012, 4:41pm

I tried to run the download and came up with this error message ShellExecuteEx failed; code 255
the extended attributes are inconsistent.

Asyn · December 5, 2012, 4:46pm

Try it in safe mode.

Pondus · December 5, 2012, 4:58pm

Process: C:\ProgramData\[b]Anti-phishing Domain Advisor[/b]

if you dont get AdwCleaner to run…try going to ad remove program and uninstall this toolbar http://software.visicommedia.com/en/products/antiphishing/
the problem is they use uncrypted signatures from Panda…and that is what avast is detecting

if still no success, attach a OTL log and one of the removal experts will create a fix and remove it…

system · December 5, 2012, 5:11pm

Now a Avast Sandbox popup comes up preventing the download saying
C:\Users\James Davis\Downloads\antiphishing.exe
The extended attributes are inconsistent.

system · December 5, 2012, 7:52pm

Okay I have downloaded and scanned with everything down to the aswMBR.exe and have attached all the log files. Now what?

system · December 5, 2012, 7:53pm

Here is the final log

essexboy · December 5, 2012, 8:02pm

Let me know if this stops it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
IE - HKU\S-1-5-21-140398804-4266983811-1124460310-1001\..\SearchScopes\{ABBC71D9-0AE0-4820-91BE-4B3954613ED9}: "URL" = http://mp3tubetoolbar.com/?tmp=toolbar_sb_results&prt=pinballtbfour01ie&Keywords={searchTerms}&clid=e797eb92f3c44b02a9e233b7b84376a0
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..extensions.enabledAddons: plugin@yontoo.com:1.20.00
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultengine: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..defaultenginename: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..order.1: "Yahoo-Mp3Tube"
FF - prefs.js..browser.search..selectedEngine: "Yahoo-Mp3Tube"
[2012/12/05 10:50:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\James Davis\AppData\Roaming\mozilla\Firefox\Profiles\dto6f9ui.default\extensions\{7d9e1adc-7db1-4eaf-b6c7-7e062074e6be}
[2012/10/21 07:50:29 | 000,000,000 | ---D | M] (Flash and Video Download) -- C:\Users\James Davis\AppData\Roaming\mozilla\Firefox\Profiles\dto6f9ui.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

system · December 5, 2012, 8:32pm

Okay here is the OTL log after the fix.

essexboy · December 5, 2012, 8:48pm

Are you still getting alerts ?

system · December 5, 2012, 8:50pm

Nope, Thank you so much for helping me.

So do you think my system is secure or should I change passwords on my banking sites?

I appreciate your help so much!

essexboy · December 5, 2012, 8:55pm

No real need as it was just an unencrypted url being downloaded, Avast does not like bad URL’s

If you are now happy then Run AdwClear and press uninstall
Run OTL and press cleanup

system · December 5, 2012, 10:39pm

Where can I get the Adwar Clear?

system · December 5, 2012, 11:06pm

okay ran the Adw Cleaner and then pressed uninstall then ran the OTL and pressed cleanup. Thank you for all your help! Glad that it is all taken care of.

Avast popups, Trojan Horse Blocked! Please Help!

Announcements