Help removing malware please!

Viruses and worms
1

I installed Avast and it is a great program. However, it keeps giving me the “Malicious URL Blocked” pop-up message at a very annoying rate. I googled how to stop this and ended up at the thread started by essexboy, the steps of which I am now following. Attached is my first log from AdwCleaner.

2

Monitoring

3

My log from Malwarebytes’ Anti-Malware

4

Once I have the OTL log we can proceed :slight_smile:

5

Here is the OTL log and the Extras log that comes with it. Should I continue on to aswMBR?

6

If we need AswMBR we can run it later

After this run could you let me know if you are still getting the alerts

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
IE:64bit: - HKLM\..\SearchScopes\{5A95BD3B-5332-4719-8F22-A003378E0ABD}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE - HKLM\..\SearchScopes\{5A95BD3B-5332-4719-8F22-A003378E0ABD}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE - HKLM\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XPxdm002YYus&ptnrS=XPxdm002YYus&ptb=1772DE5B-CFB8-4752-A80F-DA0C4FCB9E6C&psa=&ind=2011041602&st=sb&n=77de0f42&searchfor={searchTerms}
IE - HKU\.DEFAULT\..\URLSearchHook: {0696f815-a3a9-490a-bb14-9ec3350b1276} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {0696f815-a3a9-490a-bb14-9ec3350b1276} - No CLSID value found
IE - HKU\S-1-5-21-2096344181-725984487-1892924114-1000\..\SearchScopes\{5A95BD3B-5332-4719-8F22-A003378E0ABD}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
IE - HKU\S-1-5-21-2096344181-725984487-1892924114-1000\..\SearchScopes\{948735B8-267A-43E2-99FB-9C0C291C3C0D}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3286042&CUI=UN19593962099253164&UM=2
IE - HKU\S-1-5-21-2096344181-725984487-1892924114-1000\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XPxdm002YYus&ptnrS=XPxdm002YYus&ptb=1772DE5B-CFB8-4752-A80F-DA0C4FCB9E6C&psa=&ind=2011033020&st=sb&n=77ddedbc&searchfor={searchTerms}
IE - HKU\S-1-5-21-2096344181-725984487-1892924114-1000\..\SearchScopes\{ABD93EAF-D775-BC54-E63B-2804F22FD156}: "URL" = http://search.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=startnow&provider_code=&partner_id=999&product_id=10&affiliate_id=&channel=&toolbar_id=&toolbar_version=&install_country=&install_date=20120919&user_guid=E92990C56458454F8745D9C38A90CCAD&machine_id=95c9fa89f0ae400970f77fdef47a0c5f&browser=IE&os=win&os_version=6.1-x64-SP1&iesrc={referrer:source}
IE - HKU\S-1-5-21-2096344181-725984487-1892924114-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 127.0.0.1:8080
[2013/05/08 20:49:38 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Matthew Schroeder\AppData\Roaming\Mozilla\Firefox\profiles\[ofr2][opt]rs0\extensions\ffxtlbr@babylon.com
[2013/05/08 20:48:22 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\Matthew Schroeder\AppData\Roaming\Mozilla\Firefox\profiles\[ofr2][opt]rs0\extensions\plugin@yontoo.com
[2013/04/08 18:50:13 | 000,000,000 | ---D | M] (InfoAtoms) -- C:\Program Files (x86)\Mozilla FireFox\extensions\infoatoms@infoatoms.com
O3 - HKLM\..\Toolbar: (no name) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {C98D5B61-B0EA-4D48-9839-1079D352D880} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {C98D5B61-B0EA-4D48-9839-1079D352D880} - No CLSID value found.
O3 - HKU\S-1-5-21-2096344181-725984487-1892924114-1000\..\Toolbar\WebBrowser: (no name) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - No CLSID value found.
O4 - HKLM..\Run: [OtShot] C:\Program Files (x86)\OtShot\otshot.exe ()
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
[2012/10/11 18:05:53 | 000,000,000 | ---D | M] -- C:\Users\Matthew Schroeder\AppData\Roaming\com.fastcashcommissions.fasttrafficmagnet
[2012/10/11 18:00:58 | 000,000,000 | ---D | M] -- C:\Users\Matthew Schroeder\AppData\Roaming\com.fastcashcommissions.fasttrafficsniper
[2010/04/13 22:22:20 | 000,000,000 | ---D | M] -- C:\Users\Matthew Schroeder\AppData\Roaming\DialIdol.com

:Files
C:\Program Files (x86)\OtShot
C:\Program Files (x86)\Pando Networks
C:\Users\Matthew Schroeder\AppData\Local\Google\Chrome\User Data\Default\Extensions\cijeeimilokkhlfjombmalgpabbonmah

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Please download Junkware Removal Tool to your desktop.

[]Right-mouse click JRT.exe and select “Run as Administrator” the tool will open and start scanning your system
[]please be patient as this can take a while to complete depending on your system’s specifications
[]On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
[]post the contents of JRT.txt into your next message.

7

Here is the log from the quick scan. I’ll install the Junkware Removal Tool now.

8

Here is the log from JRT

9

Do you have an idea of what I need to do with the info you have so far?

10

Are you receiving the Avast alerts still ?

11

Yes I am

12

OK could you now run AswMBR please and also attach a screenshot of the Avast alert if posssible

13

When I try taking a screenshot it is too large to be attached or something. Below the avast logo the window is red with white writing. At the top it says “MALICIOUS URL BLOCKED”, and many of them will appear, causing a counter to generate in the upper left corner of the pop-up. Each one will have a different url (though sometimes I will recognize one that I’ve seen previously), and the process for them all is “C:\Windows\System32\svchost.exe”. Here is the log from running aswMBR.

14

Upper right corner of the pop-up*

15

OK the svchost was a giveaway

Download the latest version of TDSSKiller from here and save it to your Desktop.

[*]Doubleclick on TDSSKiller.exe to run the application

https://dl.dropbox.com/u/73555776/tdss%20start.JPG

[*]Then click on Change parameters.

https://dl.dropbox.com/u/73555776/tdss%20Change%20param.JPG

[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

[*]Click the Start Scan button.

[*]If a suspicious object is detected, the default action will be Skip, click on Continue.

https://dl.dropbox.com/u/73555776/tdss%20threat.JPG

[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

[*]Get the report by selecting Reports

https://dl.dropbox.com/u/73555776/tdss%20report.JPG

[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

Please copy and paste its contents on your next reply.

16

I followed all of the instructions correctly, but it will not let me copy and paste from the report window.

17

I’ve run it multiple times to see if it was just a glitch, and it is physically not letting me. I cant right click the script and ctrl+v does not work either. There are the same 9 threats detected each time I run it, and I can only skip because I don’t have the cure option for any of them.

18

Could you go to C:\TDSSKiller and locate the log there it will have a date time attached to it

19

Here you go

20

OK MBR is good

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now