BlocknSurf adware!!! help

Viruses and worms
1

my nephew downloaded this thing blocknsurf and they installed it after that everytime I open any internet browser like google chrome ,firefox & IE. There were lots of ads that will prompt beside .
I already uninstall blocknsurf, and reset the settings of each browser ,scanNned and cleaned add-ons using avast internet security 2015 but still nothing happened… :‘( :’(
sample:
http://s265.photobucket.com/user/fernskiosk/media/Untitled_zpsac2e8af7.jpg.html

2

clear your browsers with AdwCleaner http://www.bleepingcomputer.com/download/adwcleaner/

then follow instructions here https://forum.avast.com/index.php?topic=53253.0
attach AdwCleaner / Malwarebytes / Farbar Recovery Scan Tool logs

a malware expert will then assist you when online…it may take some hours before anyone is online

3

Thanks for the reply.
here’s the malware log.

4

farbar recovery scan tool logs.

5

aswMBR log.

6

MalwareBytes doesn’t cost money.

2014-12-08 19:38 - 2014-12-08 19:38 - 00013612 _____ () C:\Users\acer 355726\Downloads[kickass.so]malwarebytes.anti.malware.pro.1.65.0.1400.final.full.with.key.h33t.iahq76.torrent

Remover Notified.

Edit: As I believe you are Aussie(?) http://www.news.com.au/technology/online/illegal-downloading-in-governments-sights-as-online-copyright-infringement-discussion-paper-takes-aim-at-consumers-isps/story-fnjwneld-1227004467973
http://www.techly.com.au/2014/05/08/australias-new-piracy-laws-horse-already-bolted/

Edit2: Seems people didn’t like 1 of the websites I posted. Removed.

7
Remover Notified.
@Michael ..... you are very very late ::)
8

Hi Michael,

I would refrain from an advice to torrent. It is a way to get malware as these methods are frowned upon by content industry and therefore often are being manipulated to be infested with intentional malcode to discourage users to use such questionalble methods.

polonus

9

Removed…

https://www.techinasia.com/cybercrime-law-place-filipinos-face-jail-time-piracy/ <== Or Filopino…

10

Thanks, Michael, you are a responsible chap and look here why we should avoid torrents:
That site you removed could give one an additional goodie like sidebar-left1 and that is adware: http://www.symantec.com/security_response/writeup.jsp?docid=2004-010214-1430-99
Now let us look at this torrent site →
Apparently nothing here: https://www.virustotal.com/nl/url/97e13d175a3f7e841930613c7e7e1cf4c93f50c0ab2b954f871b12ce734a6080/analysis/1418041056/
But Sucuri thinks differently and alerts for malware: http://sitecheck.sucuri.net/results/igrotorrent.ru
→ Anomaly behavior detected (possible malware). Details: http://sucuri.net/malware/malware-entry-mwanomalysp8

script type="text/javascript">var script = document.createElement("script");script.src = "/.s/src/dsstat.js";document.getElementsByTagName("head")[0].appendChild(script);</script><script type="text/javascript">new Image().src = "http://ucounter.ucoz dot net/"+Math.random()+".gif?cid=ucoz&r64="+window.btoa(document.referrer)+"&cb="+Math.random();</script></div>

Haven’t we been there before: https://forum.avast.com/index.php?topic=150904.0
IP with IDS alert for ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related (see recent report on same IP).
IP badness history results: https://www.virustotal.com/nl/ip-address/213.174.157.137/information/
See: http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~LockScr-J/detailed-analysis.aspx
(look at requested sites at the bottom - e.g. am15 dot net/sb.php?s=23216)

polonus

11

yeah… aussie here mate
well, sorry for that torrent mate just wonder if premium is better than the free one that’s why…
i just deleted torrent now causing anomaly thingy…

is there anything i can do to remove this blocknsurf ad?
or nothing
just reformat? :-\ :-\

12

There is a removal instruction here: http://www.malwarekillers.com/block-n-surf-ads-removal/
But if you like that better I could ask a qualified remover to guide you through that removal routine,
I will PM one to look into your adware predicament. Wait for him to appear,

polonus

13
But if you like that better I could ask a qualified remover to guide you through that removal routine, I will PM one to look into your adware predicament. Wait for him to appear,
@polonus i did that hours ago .... paitient, they will be online when home from work ;)
just reformat?
reformat for some AdWare is a bit overkill .... essexboy will remove this in 5min
14

Sorry Pondus, apologies that I bumped it, must be the intermezzo in between, but again the victim just could feel more at ease with guidance else he would have removed it already or never got it on his wires.

Damian

15

The difference between Premium and Free is the Website and File Anti-Malware. Not needed for most. MBAM is just an ODS for me (On-Demand Scanner).

Edit: Well Was… It’s licensed now because I prefer more protection. But, for the average user, MBAM Free is perfectly suitable.

16

done uninstalling the premium andi changed it to the free one thanks mate… @michael :slight_smile:

17
just reformat?
reformat for some AdWare is a bit overkill .... essexboy will remove this in 5min [/quote] whahah.. "overkill" :P :P well, no need in hurry thou.. i'll just wait to essexboy ^_^

thanks btw polonus & pondus xD

18

You’re quite Welcome. I am a little bit surprised Essexboy hasn’t arrived yet?

19

Hi Michael,

Here people haven’t started coming home from work and the UK has an hour earlier.
Local time 16.05 in the afternoon when I write this posting.
In a couple of minutes am just leaving for a couple of hours to do my shift.
So do not be surprised when it takes a while for the qualified remover volunteer to appear.

polonus

20

  • Step #1 Fix with AdwCleaner

      [li]Download [b]AdwCleaner[/b] by [i][b]Xplode[/b][/i] to your [i]Desktop[/i] from the following link.

[list]
[li]Download Link #1
- Download Link #2
[/li]
- Right-click on AdwCleaner.exe and choose Run as administrator;
- Click on Scan and let the program run unhindered;
- When done, click on Clean and allow the system to reboot after it is done;
- A log will be opened automatically after the restart;
- Attach the log in your reply.
[/list][/li]

  • Step #2 Fix with Junkware Removal Tool
    Download Junkware Removal Tool by thisisu to your Desktop from the link below.
    Download Link 1
    Download Link 2

      [li]Disable your anti-virus to avoid potential conflicts. For more information please acknowledge yourself [url=http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/]this[/url] article;
  - Run the program either by double-clicking(Windows XP) or Right-clicking and choosing [i]Run as administrator[/i](Windows Vista and above);
  - Please be patient as the tool cleans your system;
  - After completion of the process a log named [b]JRT.txt[/b] will automatically open and is save to your Desktop;
  - Attach the log in your next reply.

    [/li]

Post a fresh FRST scan log.

  • Required Log(s):

      [li]AdwCleaner Log
  - Junwkare Removal Tool Log
  - FRST Scan Log(s)

    [/li]
    Regards,
    Valinorum