Constand avast notifications

Viruses and worms
1

Hello,

I am receiving constant notifications from avast.

Attached are the logs from each of the applications I’ve found in other posts.

Any assistance would be much appreciated!

2

The avast “Threat has been detected” notifications have been increasing lately.

The objects keep change, but threat is always URL:Mal

The path always revolves around IE.

I’ve attached updated log files.

Any help would be greatly appreciated!!

3

Hi. I’mvery sorry we missed you. If we don’t reply within 2 days, bump the thread.

You have POWELIKS, which isn’t overly difficult to remove. Sit tight. I will ask someone to come here for you

4

Hi sorry you were bypassed

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-751245470-4243323807-197423911-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks! HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = SearchScopes: HKU\S-1-5-21-751245470-4243323807-197423911-1001 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = SearchScopes: HKU\S-1-5-21-751245470-4243323807-197423911-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = BHO-x32: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File CustomCLSID: HKU\S-1-5-21-751245470-4243323807-197423911-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 251 more characters). <==== Poweliks? HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service" EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

5

Attached are the (2) additional logs.

I’ve been connected to the internet for a few minutes now and no pop-ups which is very promising!

6

This is a fairly simple one to remove, are you experiencing any further problems ?