HTML:Sript-inf

Viruses and worms
1

Web Shield keeps prompting me on every website that i wanted to go in.

Attached are logs that were created using the recommended method suggested by Avast in this forum.

thanks

2

Attached is the screen shot of the prompt by webshield.

thanks

3

Hi,
There is no malware here, only PUP leftovers. We shall remove that and go into additional check:

Re-run OTL.exe.

[*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.

:OTL
IE - HKU\S-1-5-21-3970154693-3549084155-3964641705-1000\..\SearchScopes\{A602735B-8BB4-4F87-BC6C-7487EE43BDD7}: "URL" = http://www.mysearchresults.com/search?c=2402&t=15&q={searchTerms}
O3 - HKU\S-1-5-21-3970154693-3549084155-3964641705-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O15 - HKU\S-1-5-21-3970154693-3549084155-3964641705-1000\..Trusted Ranges: Range1 ([http] in Trusted sites)
O15 - HKU\S-1-5-21-3970154693-3549084155-3964641705-1000\..Trusted Ranges: Range1 ([https] in Trusted sites)
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:054203E4
:FILES
C:\Windows\*.tmp
C:\Users\Radiikal\AppData\Roaming\Baidu
:COMMANDS
[CREATERESTOREPOINT]
[EMPTYTEMP]

[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.[/list]

If the log doesn’t appear, it can be found here:

c:_OTL\MovedFiles\mmddyyyy_hhmmss.log

------ Next ------

Please download zoek.zip or zoek.rar by smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive…
[list]
[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

AutoClean;
Uninstall-List;
FilesRCM;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

4

Hi!
thx for the reply!

I re run OTL as per your instruction.

however, the next step, zoek ran, but then nothing showed up. there was a pop up saying that zoek is now running blah blah blah, but then it disappeared. i can’t paste in the script that you included.

i restarted the computer, and the avast prompt still appears, unfortunately.

anyway, attached are 2 log files from OTL and Zoek.

thanks

5

i re ran zoek…and this time it allows me to paste the script.

attached is the log file…

however, the webshield prompt still appears…

thanks

6

Re-run Zoek one more time but with this script:

EmptyCLSID;
bpeeaiojkaldfmpepieinbflaefiehkp;CHR
C:\Program Files (x86)\OApps;FS
AutoClean;

When zoek ask for reboot, allow it and then post me fresh created zoek logs.

7

read in the forum another user also facing similar issue, and i followed the instruction and ran AdwCleaner…

looks like no more prompting by webshield!

anyway, attached the log here