I have just downloaded avast and almost every site I go to I am getting the “oh dear, threat detected” message.
The details are these:
Object: http://sql3.true-secure.com/?id=928731&bro=CH
Infection: URL:Mal
Process: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
I’m not really sure exactly what it means or how to fix it, so if you could give me some advice on what to do that would be great
Hi,
Post these logs so I can check that …
Please download Farbar Recovery Scan Tool (
http://www.mcshield.net/personal/magna86/Images/FRST_canned.png
) by Farbar and save it to your desktop.
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.
[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Here are the files
Please can someone have a look and advise me on what to do next? The message is coming up every time I go to a webpage, and even if I click back on an open tab on a page I have already been to.
magna86 is working your case…
he is a volunteer and use his free time here to help, so you need to be a bit patient… he will be back
Hi,
Do you have or know anything abaut proxy server?
ProxyServer: proxy.wildern.hants.sch.uk:8000
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
FRST’s FixList
Start
C:\ProgramData\Browser Manager
C:\Users\test\AppData\Local\Temp\drm_dialogs.dll
C:\Users\test\AppData\Local\Temp\drm_dyndata_7330014.dll
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.claro-search.com/?affID=117449&tt=4612_6&babsrc=HP_ss&mntrId=caca63b40000000000007e2f68b275f2
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.claro-search.com/?affID=117449&tt=4612_6&babsrc=HP_ss&mntrId=caca63b40000000000007e2f68b275f2
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.claro-search.com/?q={searchTerms}&affID=117449&tt=4612_6&babsrc=SP_ss&mntrId=caca63b40000000000007e2f68b275f2
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\test\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\plugin/npABPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\test\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\test\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0\plugin/npUrlAdvisor.dll No File
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.crx [2011-12-12]
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
Zoek
Please download zoek.zip or zoek.rar by smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive…
[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.
[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…
Click on More Options and check box only for
http://www.mcshield.net/personal/magna86/Images/checkmark.png
AutoClean option
[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)
[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”
How are the things now?
The proxy allows me to use the internet at the school where I work. Do you think that could be part of the problem?
No, I’m just asking …
Feel free to continue with fix. 
(ignore this I got it working)
Saying that do i need to do the second part?
The problem has stopped with the first part alone, and here is the fixlog
It does not matter, run zoek via AutoClean certainly. Zoek has great junk cleaning & detection routines that are indeed usefull.
Run zoek and post here the results.
Here are the results
Sorry the reply was late, I popped out to walk my dog
Ok, now run zoek with this fix. This fix should be finished very fast …
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions];R
"{b64982b1-d112-42b5-b1e4-d3867c4533f8}"=-;R
jfmjfhklogoienhpfnppmbcbjfjnkonk;CHR
I do not need zoek log …
Then…tell me how’s your computer running now?