Frequent "avast! Web Shield has blocked..." popup messages

Viruses and worms
1

I had this pop messages from Avast! about blocked web that, because of their names, I assume they are malware.

I already follow the instructions to get the cleaning malware logs: Malwarebytes’ Anti-Malware, Farbar Recovery Scan Tool, aswMBR.exe. I had some serious troubles with the last one, just cant get the log file because it keeps crashing even in safe mode (I choosed Safe mode with network access)

Plus, I found two extensions on Chrome (unisaLes and uonnisales) which I removed but keep appearing as installed and as ads over some web pages

Find attached the log files I obtained and a screenshot of one of the many Avast warning pop-ups

2

Hi there the first thing you must do is uninstall Chrome. If you wish to retain your bookmarks then follow the steps here to export them https://support.google.com/chrome/answer/96816?hl=en-GB

After Chrome has been uninstalled

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: 
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-1559155459-2037828786-3423419552-1000 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.look-for-it.info/?l=1&q={searchTerms}&pid=2788&r=2015/02/06&hid=12990514120446379645&lg=EN&cc=EC&unqvl=82
BHO: uniusales -> {5b48e9af-a609-4fef-af5d-07f7f8f6faa7} -> C:\Program Files (x86)\uniusales\rEETGO2zeIGuk8.x64.dll No File
BHO: unisaLes -> {7796fa75-1872-470d-85f7-ba37a9542cef} -> C:\Program Files (x86)\unisaLes\YZMMzGuzHIMcXc.x64.dll No File
BHO-x32: uniusales -> {5b48e9af-a609-4fef-af5d-07f7f8f6faa7} -> C:\Program Files (x86)\uniusales\rEETGO2zeIGuk8.dll No File
BHO-x32: unisaLes -> {7796fa75-1872-470d-85f7-ba37a9542cef} -> C:\Program Files (x86)\unisaLes\YZMMzGuzHIMcXc.dll No File
BHO-x32: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} ->  No File
BHO-x32: No Name -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} ->  No File
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL No File
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/", "hxxp://www.mystartsearch.com/?type=hp&ts=1423201592&from=wpc&uid=KINGSTONXSVP200S3120GXXXXXXXXXXXXXXXXX_50026B72251083EB"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Profile: C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (myPlex Queue Extension) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\agmheakklldmclgmkfnncddgkiibboil [2013-09-18]
CHR Extension: (Google Docs) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-08-03]
CHR Extension: (Google Drive) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-08-03]
CHR Extension: (Gliffy Diagrams) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmicilclplefnflapjmnngmkkkkpfad [2014-07-26]
CHR Extension: (YouTube) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-08-03]
CHR Extension: (Google Cast) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-01-03]
CHR Extension: (Búsqueda de Google) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-08-03]
CHR Extension: (Google Play Música) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\fahmaaghhglfmonjliepjlchgpgfmobi [2014-10-28]
CHR Extension: (PanicButton) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\faminaibgiklngmfpfbhmokfmnglamcm [2014-07-26]
CHR Extension: (Plex) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpniocchabmgenibceglhnfeimmdhdfm [2014-07-26]
CHR Extension: (Avast Online Security) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-08-04]
CHR Extension: (Google Keep: notas y listas) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2013-08-24]
CHR Extension: (VNC® Viewer for Google Chrome™) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabmpiboiopbgfabjmgeedhcmjenhbla [2014-07-26]
CHR Extension: (Hangouts) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\knipolnnllmklapflnccelgolnpehhpl [2014-10-31]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2014-11-04]
CHR Extension: (Poppit!) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2013-08-04]
CHR Extension: (Pocket) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjcnijlhddpbdemagnpefmlkjdagkogk [2014-07-26]
CHR Extension: (Hangouts) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckgahadagoaajjgafhacjanaoiihapd [2014-10-31]
CHR Extension: (Save to Pocket) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj [2014-07-27]
CHR Extension: (Google Wallet) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Gmail) - C:\Users\JCMV\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-08-03]
CHR HKLM\...\Chrome\Extension: [aaaaadgepjkdffhjbkfjgnnffnfcffbg] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaadgepjkdffhjbkfjgnnffnfcffbg.crx [2015-01-29]
CHR HKU\S-1-5-21-1559155459-2037828786-3423419552-1000\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - No Path
CHR HKLM-x32\...\Chrome\Extension: [aaaaadgepjkdffhjbkfjgnnffnfcffbg] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\aaaaadgepjkdffhjbkfjgnnffnfcffbg.crx [2015-01-29]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswwebrepchrome-sp.crx [2014-08-04]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-27]
CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx [2014-06-08]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
StartMenuInternet: Google Chrome - Chrome.exe
2015-02-06 10:04 - 2015-02-06 10:04 - 00003156 _____ () C:\Windows\System32\Tasks\{AFA20382-C0DA-4403-B936-B88D5827BA3A}
2015-02-06 01:18 - 2015-02-06 01:18 - 00003136 _____ () C:\Windows\System32\Tasks\{21C35419-7840-4267-B81B-676D14BCCCB2}
2015-02-06 01:16 - 2015-02-06 01:16 - 00000000 ____D () C:\ProgramData\1e2481de00000140
2015-02-06 00:34 - 2015-02-06 00:34 - 00000000 ____D () C:\ProgramData\114550a000006e4f
2015-02-05 23:45 - 2015-02-05 23:45 - 00000000 ____D () C:\ProgramData\gefncpfjinkhindmkdbonpedkfahoaof
2015-02-05 23:42 - 2015-02-05 23:42 - 00000000 ____D () C:\ProgramData\bepmkonjpnfllhfedknngkgldoepbalc
2015-02-05 23:42 - 2015-02-05 23:42 - 00000000 ____D () C:\ProgramData\7867068334531228112
2015-02-05 23:41 - 2015-02-06 00:09 - 00000000 ____D () C:\ProgramData\{51aefb43-ac09-8d33-51ae-efb43ac0ed0e}
2015-01-29 22:15 - 2015-01-29 22:15 - 00003154 _____ () C:\Windows\System32\Tasks\{79175EB9-B173-4BF2-91D3-F957CEEF47B8}
CustomCLSID: HKU\S-1-5-21-1559155459-2037828786-3423419552-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\JCMV\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1559155459-2037828786-3423419552-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\JCMV\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
Task: {15E40389-26C2-403B-8457-589C7A067A83} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1559155459-2037828786-3423419552-1000UA => C:\Users\JCMV\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-30] (Google Inc.)
Task: {9E6BD0C8-4A63-49EC-A335-5F3B79A816A3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-03] (Google Inc.)
Task: {C2913DA9-D106-4CE3-B52B-6FD9AB58A853} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-03] (Google Inc.)
Task: {E7C14D51-23E5-4D82-87D1-D5A37D86AF33} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1559155459-2037828786-3423419552-1000Core => C:\Users\JCMV\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-30] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1559155459-2037828786-3423419552-1000Core.job => C:\Users\JCMV\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1559155459-2037828786-3423419552-1000UA.job => C:\Users\JCMV\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\uniusales
C:\Program Files (x86)\Google
C:\Users\JCMV\AppData\Local\Google
EmptyTemp: 
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.