can someone advise please? ......got rid of su2.ff.avast.com, but have new prob.

[system]

Hello …

With the help of my daughter’s boyfriend, I have gotten rid of the annoying MWB popup that said it was blocking a malicious website…what he did was reset my IE security through Internet Options back to Default. I had changed it some time ago. He also ran several malware scans, and lastly, a BOOT SCAN, which took 3-1/2 hours and found a hidden piece of malware that none of the other scans found. Since then, no popups so far…

Unfortunately, I now have a new problem I’ve never experienced before, and daughter’s BF says he “doesn’t know anything about Amazon”…great…

When I add items to my cart while shopping, then sign in on Amazon, as soon as I click on CART to check out…boom…all my items disappear and I am no longer signed in!!! Does anyone have a clue as to why this is occurring? Should I try to contact an Amazon ‘tech’? If anyone can help, I would be grateful!!

I haven’t tried to shop on any other site yet, so I don’t know if it is just happening on Amazon.

[Staticguy]

You need to attach the requested scan logs and other logs as mentioned here https://forum.avast.com/index.php?topic=53253.0.

After you have attached the requested logs, an malware expert will then assist you.

[system]

Hi Staticguy,

first log file…MWBthreatscanlog091615

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 9/16/2015
Scan Time: 7:00 PM
Logfile:
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.09.16.06
Rootkit Database: v2015.08.16.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Jonna

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 377890
Time Elapsed: 29 min, 57 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

[Staticguy]

Don’t post the logs. Attach the logs. Not only for Malwarebytes antimalware scan logs there’s other logs as well. Attach them don’t post them as mentioned here https://forum.avast.com/index.php?topic=53253.0

The other logs are from Farbar Recovery Scan Tool. This tool will produce two logs FRST.tx and Additions.txt

Once you have done that, I will notify a malware expert to assist you.

Just now I have notified an malware expert named essexboy. He will monitor this and help you out.

[system]

FRST and Addition logs attached…

Also, I just started getting the Malwarebytes popup warning again, of malicious website blocked, with the same IP address 92.242.140.21, but the website address is different…idcs.interclick.com…

[system]

MWB Threat Scan log attached…

[system]

aswMBR log attached…

[essexboy]

MBAM does get a bit paranoid with site blocking, which is why I do not use that function

Let me know what problems you are experiencing after this

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-1059708350-3765293519-1878549072-1000\...\Run: [Amazon Music] => C:\Users\Jonna\AppData\Local\Amazon Music\Amazon Music Helper.exe [5887808 2015-07-21] () SearchScopes: HKLM -> {8F2148B9-EADC-444D-98CB-51C7606F23A5} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S0].txt as well.

[system]

hi essexboy, thanks so much for your assistance! fixlog.txt attached…

[system]

adwCleaner log file attached…

[essexboy]

OK the initial problem was due to your ISP messing around with the DNS host

@JBG post:29

Hi All,
there’s a legacy piece of code trying to reach obsolete domain su2.ff.avast.com. It wasn’t doing any harm up until recently as every DNS server should be reporting that domain as non-existent.

Note this response from Google DNS servers:

nslookup su2.ff.avast.com 8.8.8.8
Server:         8.8.8.8
Address:        8.8.8.8#53

** server can't find su2.ff.avast.com: NXDOMAIN

What seems to be happening is this. Some ISPs are possibly using this service www.barefruit.co.uk for returning custom (advertising?) content to many network related errors, like non-existent domains. And MBAM seems to start having issues with this content or a set of IP ranges, reporting it as a malware content.

We’ll disable queries to this domain into the next available release which should resolve the problem with this particular non-existent domain. But the other part of the problem lies elsewhere, ISP serving custom content on invalid requests (DNS, HTTP) and MBAM reporting it as malware.

Regards.

How is the computer now ?

[system]

that’s a little bit tech speak for me, but I get the gist of it…it’s supposed to be solved now, correct? I’m currently not having any popups. My browser is starting up a little bit slower, but I can deal with that.

I think I might just get rid of IE and just use Safari exclusively, as that solved the problem I was having with trying to complete a purchase on Amazon…couldn’t do that at all on IE, but switched to Safari and that solved the problem.

[essexboy]

You cannot uninstall IE as it is part of windows but, there is no need to use it

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix
Select the options as shown

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe