Help Solving Alert Js:ScriptIp-inf

Viruses and worms
1

Portuguese-Brazil Message :

Olá,pessoal!
Tudo bem?

De uns tempos para cá, não importando a página na qual eu esteja, o Avast exibe um alerta de uma ameaça bloqueada (em anexo) “Js:ScriptIP-inf” . É o meu sistema operacional que já está infectado com esse vírus? Ou como faço para me livrar dessas tentativas insistentes de invasão e consequentemente parar com esses avisos do Avast? Desde já muito agradecido pelas orientações e soluções :slight_smile:

English Message :

Hello guys!
All right?

From time to time, no matter what page I’m on, Avast displays an alert for a blocked threat (attached) “Js: ScriptIP-inf”. Is my operating system already infected with this virus? Or how do I get rid of these persistent intrusion attempts and consequently stop these Avast warnings? Thank you very much for the directions and solutions :slight_smile:

2

Follow instructions and attach requested logs > https://forum.avast.com/index.php?topic=194892.0

  • Malwarebytes
  • Farbar Recovery Scan Tool

when done a malware expert will assist you

3

Hello!
This is my logs! :slight_smile:

4

Malware expert is probably not online before tomorrow, so check back tomorrow :wink:

5

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[b] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/b]
Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

- Right-click on

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
- Press the Fix button just once and wait.
- If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
- When finished FRST will generate a log on the Desktop, called Fixlog.txt.
Please attach it to your reply.

How is your system running now?

6

Hello Dbrisendine !
The browser has become lighter now. Before, it was visible the slowness in the mouse cursor and so far, when I write my answer, Avast did not sound any virus alert. I’ll keep you posted. Attached is my log!

Thank you for your interest in helping me! :slight_smile:

7

Let us know how things go; if your system is still fine in a few days, we clean our tools off of it and get you a good starting point to continue from set up.

8

Should I delete Farbar and all logs from the system now or not yet? In these 24 hours after cleaning the avast alert is no longer displayed. I await further guidance. Immensely grateful to help me solve what nobody close to me was able to solve! :slight_smile:

9

Oh no! :cry:

Update: Now the Avast alert has just returned!

10

Please provide fresh log files.

11

New Mbam and Farbar log files?

12

Additional info on the malware from that IP e.g. GET -/banners/ad728.html HTTP/1.1
Host: -wwwp.link
United States
AS13335 CloudFlare, Inc. -104.27.171.124 Cloudflare PUP malware abuse…
HTTP/1.1 200 OK → https://cymon.io/104.27.171.124 & https://www.threatcrowd.org/ip.php?ip=104.27.171.124

Wait for dbrisendine’s reaction and instruction.

polonus

13

Yes, new Mbam and Farbar logs.
Let’s see if we missed something.

14

The news logs is attached! :slight_smile:

15

I have scanned your new logs and don’t see much in the way of malware. But there may be some settings in your Firefox profile that does not show in the regular scanners. Please run the following tools and allow them to fix what they find. Please post the logs the tools produce. Thanks.

FIRST >>>>

Junkware Removal Tool
Please download JRT from here to your desktop.

Note: Temporarily disable/shut down your protection software now to avoid potential conflicts, how to do so can be read here.

Double click the JRT.exe file to run the application.

The application will open an Command Prompt window and run from there (this is normal for this program, so not to be alarmed).

When it is asked, press any key to allow the program to continue / run.

This will create a log on the desktop; please copy and paste the JRT.txt log text in your next post.

Note: After the log file is created, please enable your protection software / reboot your system and verify your protection software is enabled.

SECOND >>>>

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.

Click the Scan button and wait for the scan to finish.

After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don’t want to remove.

Click the Clean button.

Everything checked will be deleted.

When the program has finished cleaning a report appears.

Once done it will ask to reboot, allow this

http://1.bp.blogspot.com/-vitKqfMQS4o/UEDylIQ7HJI/AAAAAAAABLc/Hx-IwqKoaxg/s1600/adwcleaner_delete_restart.jpg

On reboot (if one is needed) a log will be produced; please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C#].txt

Optional:
NOTE: If you see AVG Secure Search being targeted for deletion, Here’s Why and Here. You can always Reinstall it.

16

Sorry for the delay ! I was trying during these days on the JRT but unfortunately I did not succeed. I left the day and the whole dawn and he always kind “stops” in “shortcuts”. I temporarily disabled Avast and the firewall, I performed in administrator mode while it performed the procedures but it still did not advance it always “stops” in “shortcuts”.
Attached is my log by AdwareCleaner ! :slight_smile:

17

How is the system running now?

Thanks for the effort with JRT; it does stall on some systems so do not worry.

18

Unfortunately, Dbrisendine remains slow, the mouse cursor is also slow, almost stoped when I use Mozilla Firefox and being in it always comes the threat alert blocked JS: Script-IP-inf some similar program that does almost the same as the JRT? I look forward to your guidance. :slight_smile:

19

Have you tried Refreshing Firefox? ( https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings )

20

Yes. Also I uninstalled and reinstalled Firefox and unfortunately it did not help. The Avast alert persists. :cry: