Avast Web Shield has blocked a harmful webpage or file

system · 2015-07-11T22:35:11.000Z

I keep on getting this message popping up on the bottom right of my screen.

“Avast Web Shield has blocked a harmful webpage or file.”
Page it wpad.browserupdate.check.in/wpad.dat

I have run combofix, avast, malwarebytes, Adware Cleaner, hitman pro. All found many virus and have cleaned them. Now shows no issues if I run them again. I ran Farbar like I saw you say to do in other posts and have attached the files.

Besides the fix file can you tell me what I am fixing, you don’t have to go indepth but I like to know what is happening.

Pondus · 2015-07-11T22:43:25.000Z

I have run combofix, avast, malwarebytes, Adware Cleaner, hitman pro. All found many virus and have cleaned them.

Also attach these logs ;)

Removal team will probably not reply before tomorrow

essexboy · 2015-07-12T10:36:57.000Z

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HKU\S-1-5-21-2576120905-1580876099-891788021-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HKU\S-1-5-21-2576120905-1580876099-891788021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKU\S-1-5-21-2576120905-1580876099-891788021-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2576120905-1580876099-891788021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X] S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X] 2015-07-05 12:20 - 2015-07-10 21:10 - 00000000 ____D C:\Program Files (x86)\71c22501-d9b1-4c0a-b925-13248c99c249 2015-06-29 18:19 - 2015-07-10 21:10 - 00000000 ____D C:\Program Files (x86)\3fbaabd2-f59c-4d35-9124-d7f57248e9a1 2015-06-27 12:42 - 2015-07-10 21:10 - 00000000 ____D C:\Program Files (x86)\a4002c51-f5c9-4a91-962f-dddae2d4c4ad 2015-06-27 12:42 - 2015-07-10 21:10 - 00000000 ____D C:\Program Files (x86)\53189e7c-fa17-41cb-85ee-0b59fae63a59 2015-07-10 21:10 - 2015-04-25 18:02 - 00000000 ____D C:\Program Files (x86)\2f6e8f75-abc0-48d2-9e07-9ae8f9cf65b5 2015-06-12 15:28 - 2014-11-12 19:46 - 00000000 __SHD C:\Users\brett\AppData\Local\EmieBrowserModeList 2015-06-12 15:28 - 2014-04-24 07:48 - 00000000 __SHD C:\Users\brett\AppData\Local\EmieUserList 2015-06-12 15:28 - 2014-04-24 07:48 - 00000000 __SHD C:\Users\brett\AppData\Local\EmieSiteList 2015-04-19 08:20 - 2015-07-11 14:01 - 0000626 _____ () C:\Users\brett\AppData\Roaming\PxmH5wB8n 2015-06-25 20:43 - 2015-07-05 12:24 - 0000112 _____ () C:\ProgramData\280qeJq.dat CustomCLSID: HKU\S-1-5-21-2576120905-1580876099-891788021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\brett\AppData\Roaming\nitionto\terence.dll No File <==== ATTENTION CustomCLSID: HKU\S-1-5-21-2576120905-1580876099-891788021-1001_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\brett\AppData\Roaming\nitionto\terence.dll No File <==== ATTENTION ATTENTION: System Restore is disabled Task: {063C1A69-F527-4432-97EF-85AA2328E14E} - \3ea8106f-d830-4c43-a3c2-d22414835b1a-1-7 No Task File <==== ATTENTION Task: {100D3731-8592-4DF8-83FB-2ACC8E72C9FF} - \61f8dcdd-5689-4892-af3c-a824db692a0f-1-6 No Task File <==== ATTENTION Task: {272F27CC-5C6B-4F7A-A05C-00B28997E4C0} - \3ea8106f-d830-4c43-a3c2-d22414835b1a-3 No Task File <==== ATTENTION Task: {28C4499B-8F2D-4B86-A004-86B9336E9FCA} - \20a5766a-c0d8-457e-8129-c5fdfe6f55d7-5_user No Task File <==== ATTENTION Task: {3550A776-EC77-45BD-94B6-F7200D715884} - \Winsta Update No Task File <==== ATTENTION Task: {35B01EC8-C8B0-4674-B19B-69769BAFFECC} - \abf03480-4ae9-44c5-9831-d93629c1523a-1-6 No Task File <==== ATTENTION Task: {369F5A95-3EAA-4194-9B1A-30216D9D83B7} - \Bidaily Synchronize Task[8da6] No Task File <==== ATTENTION Task: {374692CE-F8F3-4693-B993-AE1E629B8073} - \3ea8106f-d830-4c43-a3c2-d22414835b1a-5_user No Task File <==== ATTENTION Task: {38742FBC-69D1-469C-9E36-61A906C42E10} - \61f8dcdd-5689-4892-af3c-a824db692a0f-6 No Task File <==== ATTENTION Task: {3A1412C4-2907-4BFB-B07A-BD7849320851} - \DFOZSNJILP No Task File <==== ATTENTION Task: {3B621919-66E5-432F-9953-5ADDC3268C5A} - \3ea8106f-d830-4c43-a3c2-d22414835b1a-6 No Task File <==== ATTENTION Task: {3B6F7951-5D17-468B-B604-6FFD3A18728C} - \3ea8106f-d830-4c43-a3c2-d22414835b1a-10_user No Task File <==== ATTENTION Task: {3EA9AF53-BDAB-4DA6-BD63-49748AC526E8} - \abf03480-4ae9-44c5-9831-d93629c1523a-5_user No Task File <==== ATTENTION Task: {40EF9DB0-811A-407E-8D65-D557EF4B7416} - \GlobalUpdate-zmzjyznxnms2bwz No Task File <==== ATTENTION Task: {4C078F98-57BF-478F-B4E8-DDB91A3F4DD9} - \CIMT_daily_S-1-5-21-2576120905-1580876099-891788021-1001 No Task File <==== ATTENTION Task: {4F385A43-8C7B-4234-82D8-114DEB07BC6B} - \20a5766a-c0d8-457e-8129-c5fdfe6f55d7-1-7 No Task File <==== ATTENTION Task: {520634FF-6E30-4EB1-A08A-C5824F827446} - \abf03480-4ae9-44c5-9831-d93629c1523a-6 No Task File <==== ATTENTION Task: {52FAB751-03DF-4C7B-80F0-4E12C2D8D4C9} - \20a5766a-c0d8-457e-8129-c5fdfe6f55d7-7 No Task File <==== ATTENTION Task: {55F0D2E4-66BE-4E12-9A14-82E1A2BB5B7A} - \0 No Task File <==== ATTENTION Task: {621C35A9-3DC1-4B27-98CC-80D91FD2962C} - \61f8dcdd-5689-4892-af3c-a824db692a0f-5 No Task File <==== ATTENTION Task: {6A21EF1E-48BB-4942-9A1E-A42056A3B891} - \SPBIW_UpdateTask_Time_333934303737373637392d5755326c785a5a5737414534 No Task File <==== ATTENTION Task: {6F2F3DF6-54DD-4103-AF36-1FCEBDDC567E} - \1492a0b0-8af2-428d-9d1c-d8d48dbc4e8f-5 No Task File <==== ATTENTION Task: {741ED09D-1DCE-4C13-9440-406DC412B274} - \abf03480-4ae9-44c5-9831-d93629c1523a-1-7 No Task File <==== ATTENTION Task: {78AC412E-0CEE-44CF-8B00-2235FF582390} - \CIMT_S-1-5-21-2576120905-1580876099-891788021-1001 No Task File <==== ATTENTION Task: {80CE0098-D6A9-4711-A9ED-35480A3A9F50} - \61f8dcdd-5689-4892-af3c-a824db692a0f-5_user No Task File <==== ATTENTION Task: {8347FF50-F0E0-46DD-A49E-FA12BA7FF305} - \1492a0b0-8af2-428d-9d1c-d8d48dbc4e8f-6 No Task File <==== ATTENTION Task: {86EAD57B-2A62-49DB-9F65-6008CFBFC2B4} - \QNBKJTVHX1 No Task File <==== ATTENTION Task: {8A3777F7-9152-420E-9F4B-9025CB75080D} - \20a5766a-c0d8-457e-8129-c5fdfe6f55d7-1-6 No Task File <==== ATTENTION Task: {8DEA80D5-1E91-4362-B3DC-F187B4601D43} - \20a5766a-c0d8-457e-8129-c5fdfe6f55d7-5 No Task File <==== ATTENTION Task: {99916890-1683-4D2D-A734-390D58F39744} - \abf03480-4ae9-44c5-9831-d93629c1523a-5 No Task File <==== ATTENTION Task: {9BF32B2C-30BE-4601-B4DC-4D7E669F2048} - \Miuhgoiho No Task File <==== ATTENTION Task: {9D697030-2E1A-487F-BB34-D3261CCF29B9} - \DE10 No Task File <==== ATTENTION Task: {A586BE48-3846-4EBC-BB9E-7C745C52F505} - \abf03480-4ae9-44c5-9831-d93629c1523a-7 No Task File <==== ATTENTION Task: {A8DBD49C-782E-44DD-98F7-20D47FE80991} - \3ea8106f-d830-4c43-a3c2-d22414835b1a-7 No Task File <==== ATTENTION Task: {A9B87E90-E7BA-4E70-B030-499559AE170D} - \20a5766a-c0d8-457e-8129-c5fdfe6f55d7-3 No Task File <==== ATTENTION Task: {B12EA5F2-1DCB-4ED3-AEAB-BD88ABCB9931} - \61f8dcdd-5689-4892-af3c-a824db692a0f-3 No Task File <==== ATTENTION Task: {B7F19869-D571-4D32-8E58-3055712520DB} - \3ea8106f-d830-4c43-a3c2-d22414835b1a-1-6 No Task File <==== ATTENTION Task: {BE74330C-FCB6-4A8C-A9D6-4B9B874C8807} - \1492a0b0-8af2-428d-9d1c-d8d48dbc4e8f-1-6 No Task File <==== ATTENTION Task: {C6571351-196E-4A74-BF38-FDD50CAD570A} - \1492a0b0-8af2-428d-9d1c-d8d48dbc4e8f-5_user No Task File <==== ATTENTION Task: {CBDF4C6C-8FE1-48EA-A4C7-95CC88E79AA0} - \1492a0b0-8af2-428d-9d1c-d8d48dbc4e8f-1-7 No Task File <==== ATTENTION Task: {D1134C60-4863-43CC-8FDD-A1472E3360ED} - \1492a0b0-8af2-428d-9d1c-d8d48dbc4e8f-7 No Task File <==== ATTENTION Task: {D47C3CB7-D4D4-4290-80AB-F2EFEBD5853D} - \61f8dcdd-5689-4892-af3c-a824db692a0f-7 No Task File <==== ATTENTION Task: {D8DC0B3C-9064-4BC9-AD84-75ADAF521D72} - \20a5766a-c0d8-457e-8129-c5fdfe6f55d7-10_user No Task File <==== ATTENTION Task: {DC67FF3B-3F28-4C85-BDB4-A2A93A3EDC04} - \3ea8106f-d830-4c43-a3c2-d22414835b1a-5 No Task File <==== ATTENTION Task: {F69C91EB-691A-46C9-83E7-620715C49459} - \ProPCCleaner_Start No Task File <==== ATTENTION Task: {F946A143-DCC7-4FCB-A4C6-0A54D5A365F5} - \20a5766a-c0d8-457e-8129-c5fdfe6f55d7-6 No Task File <==== ATTENTION Task: {FB53E048-3BBE-408E-8ED7-850087DFBBE7} - \61f8dcdd-5689-4892-af3c-a824db692a0f-1-7 No Task File <==== ATTENTION C:\Users\brett\AppData\Roaming\nitionto RemoveProxy: CMD: netsh advfirewall reset CMD: netsh advfirewall set allprofiles state ON CMD: ipconfig /flushdns CMD: netsh winsock reset catalog CMD: netsh int ip reset c:\resetlog.txt CMD: ipconfig /release CMD: ipconfig /renew CMD: netsh int ipv4 reset CMD: netsh int ipv6 reset EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.

If you have bookmarks, let’s save them by exporting them - Export Bookmarks
Then I need you to go Google Sync and sign into your account
Scroll down until you see the “Stop and Clear” button and click on the button. At the prompt click on “Ok”
Now we need to uninstall chrome using control panel .
Note: When asked about user data or settings you must remove this also so please check the box.
Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
Import your bookmarks back into Chrome
Sign back in to your Chrome browser so that your bookmarks sync with your online account.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S0].txt as well.

FINALLY

Start FRST and in the search box copy/paste the following :

browserupdate.check.in

Then press search registry
A log will be produced post that

Announcements