http://54.187.243.98 pop up every 10min

system · July 20, 2014, 1:50pm

Hello, i notice 3 (so far) similar topic so i open new one as i have same problem.
So today i download installation package for some program. I open it and he started to downloading some stuff from internet. When it came on 50% avast block this site:

http://54.187.243.98/ e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720

I thought it was some virus and avast block it, but avast started to blocking that site every 10min when im online.
Here is WebShield log (startin when avast block it for first time):

* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, July 20, 2014 9:23:59 AM
*

20.7.2014. 9:51:35	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 10:01:35	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 10:11:35	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 10:21:36	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)

*
* Shield stopped: Sunday, July 20, 2014 10:27:33 AM
* Run-time was 1 hour(s), 3 minute(s), 3 second(s)
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, July 20, 2014 10:28:56 AM
*

20.7.2014. 10:31:24	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 10:32:40	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 10:32:40	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 10:32:40	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)

*
* Shield stopped: 20. srpanj 2014. 10:35:51
* Run-time was 6 minute(s), 6 second(s)
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Sunday, July 20, 2014 11:55:37 AM
*

20.7.2014. 12:15:59	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)

*
* Shield stopped: 20. srpanj 2014. 12:38:41
* Run-time was 43 minute(s), 43 second(s)
*

*
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: 20. srpanj 2014. 14:06:08
*

20.7.2014. 14:06:29	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 14:16:29	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 14:26:29	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 14:36:30	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 14:46:30	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 14:56:34	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 15:06:31	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 15:16:31	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)
20.7.2014. 15:26:31	http://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7DVDyxECyFPg7x9Ae0KBfUKAe4MBG0VWznLDe4PBNq9geFI&publisher=377&dd=4&country=HR&ind=4895159338839730436&exid=0&ssd=15612736309535192031&hid=14447342630781547395&osid=601&channel=0&sfx=1&jc=1&category_name=PriceChop&install_date=20130720 [L] URL:Mal (0)

In attachment are all needed logs.

I am waiting for your replay what to do next so i can fix it. Thanks

system · July 20, 2014, 1:53pm

Here is avast pop-up message

magna86 · July 20, 2014, 2:20pm

Поздрав земљаче, ;D

Please download Zoek tool by Smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here and save it to your Desktop.
Unpack the archive…

[*]Close any open browsers and temporarily disable your AntiVirus program. (if it is necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool. Please wait while the tool does not start…
[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

Uninstall-List;
QuickScan;
ipconfig /flushdns >> %temp%\log.txt;b
bitsadmin /reset /allusers >> %temp%\log.txt;b
EmptyFoldersCheck;Delete 
EmptyCLSID;
ResetHosts;
ResetIEProxy;
AutoClean;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

system · July 20, 2014, 4:20pm

magna86 post:3:

Поздрав земљаче, ;D

Please download Zoek tool by Smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here and save it to your Desktop.
Unpack the archive…

[*]Close any open browsers and temporarily disable your AntiVirus program. (if it is necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool. Please wait while the tool does not start…
[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:
Uninstall-List;
QuickScan;
ipconfig /flushdns >> %temp%\log.txt;b
bitsadmin /reset /allusers >> %temp%\log.txt;b
EmptyFoldersCheck;Delete 
EmptyCLSID;
ResetHosts;
ResetIEProxy;
AutoClean;
[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

Here are logreport.

Man this script deleted two of my program YTD Video Downloader and Garena+. Why? Is any other program deleted?

magna86 · July 20, 2014, 6:57pm

Hi,

YTD Video Downloader and Garena+

The first program is targeted for lot of Malware Removal tools. And personaly I don’t know why to risk some ads and legitimacy when you have a lot free cloud (online) based downloader/converter eg:

http://www.clipconverter.cc/
http://www.youtube-mp3.org/
…etc.

Garena+ shouldn’t be targeted. This is generic FP. I shall take a peek into zoek Quarantine folder to see what is contains. Then I can contact the Zoek developer to create whitelist for Garena.

Btw, you can re-install these programs with no problems.

Please re-run Zoek one more time as you did before with this script and when it finish post me the fresh created zoek logfiles.

zoekbackups;

Btw, just to get your attention, we do not support the hack/crack tool. You have one installed and running …

==== Other Scheduled Tasks ======================
“C:\Windows\system32\tasks\AutoKMS” [C:\Windows\AutoKMS\AutoKMS.exe]

system · July 20, 2014, 9:25pm

Im using those programs for a long time and have no problem with them. They are both clean so i am going to reinstall them.

I will investigate for that program thats running. If its hack/crack tool i will remove it. Thanks for pointing me on it

I like to thanks you for help. After i run script i dont have any pop-ups from avast so it must fix the problem.
Do you known what was my problem and how this scrip fix it (im curious guy )?

magna86 · July 21, 2014, 12:22pm

Just a BITSjob that are trying to call every 10 minutes the hosts server with 54.187.243.98 IP adress for some future malware downloading …
I was tell zoek to cancel these jobs.

I’ll still need the Zoek’s Quarantine logreprot.

system · July 21, 2014, 8:06pm

Here is it.

So this BITSjob (based on what zoek remove) were located in one of these three files:

C_Users_JuJu_AppData_Local_cache (F=70 D=3 1642473 bytes)
C_Users_JuJu_AppData_Local_TempDIR (F=0 D=0 0 bytes)
C_Users_JuJu_Searches (F=3 D=0 1020 bytes)

probably in C_Users_JuJu_AppData_Local_cache?

magna86 · July 22, 2014, 12:57pm

Thank you. Smeenk has whitelisted the Garena+ (Garena was not targeted, it was generic detection for Garena folder content) and it will considers for YTD as well.

So this BITSjob (based on what zoek remove) were located in one of these three files:

No, what you listed is related to zoek’s junk-cleaning routine, it clears the default temp & cache.

BITS job are recorded in qmgr0 and qmgr1 dat files. This act is legit and original it serves for M$ Windows Update. You can google it BITS services and how it works for more info.

So, you say you do not have problems? If so I can give you the post-cleaning procedure for removing the used tool here.

system · July 24, 2014, 6:28pm

No i have no problems so far. You can give me cleaning procedure, please.

Do you known can software Ccleaner from Piriform clean qmgr0 and qmgr1 dat files (if it can what settings to clean do i need to select)?

magna86 · July 25, 2014, 5:10pm

Hi juuki,
Just for info, Smeenk has whitelist the YTD as well. It shall not be targeted anymore.

There is no need for any additional BITSjob action. All jobs has been canseled and removed from data, and legit software shall re-write these data again. And as there is no active malware on your board … there is no need for any additional action.

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

system · July 28, 2014, 8:17am

Ok, i uderstand but i wont to have some software that can delite that files from time to time (periodic system clean) just like Ccleaner cleans temp files, because malware can get in those files (like in my case) and no antivirus/malware cant detect them.

Some tips:

1.Why you use Zoek as disinfection tool in Avast forum but the same Avast antivirus is detecting this tool as malware? https://www.virustotal.com/hr/file/bef3fbd9d0b315d80675f2ac456e4c155abfa7e0f64011d6cd3378db36267846/analysis/1406535315/

2.You gave me DelFix as tool for “cleaning procedure for removing the used tool here”, but DelFix delite not just tool we use here (Zoek and FRST) but also programs that im using on my own and having them installed on my computer (adwcleaner, GetSystemInfo, HiJackThis) as you can see from DelFix log:

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\zoek_backup
Deleted : C:\AdwCleaner
Deleted : C:\Program Files\Trend Micro\Hijackthis
Deleted : C:\zoek-results.log
Deleted : C:\zoek-results2014-07-20-161133.log
Deleted : C:\Users\JuJu\Desktop\adwcleaner_3.216.exe
Deleted : C:\Users\JuJu\Desktop\GetSystemInfo5.0.exe
Deleted : C:\Users\JuJu\Desktop\HiJackThis.lnk
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis
Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR

magna86 · July 28, 2014, 1:28pm

You can ue TFC by OldTimer if you like.
Official link:
http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/

Additional link:
http://www.bleepingcomputer.com/download/tfc/

The detection is FP. I recently wrote an explanation here on forum why is it so.
That is the purpose of DelFix. AdwCleaner (and GetSystemInfo) you can download again as it is advisable to use the latest version. HiJackThis is outdated software, only M$ XP OS compatible and not valid for a long time…

http://54.187.243.98 pop up every 10min

Announcements