http://wpad.Home/wpad.dat

Viruses and worms
1

Hello!

I’ve stumbled into a problem here. I turned on my laptop today and kept getting pop-ups from Avast that it has blocked my computer from accessing a website or file (http://wpad.Home/wpad.dat). The pop-up is rather annoying and I’m also worried if this “thing” is dangerous or not.

As per instruction, I’ve included logs from OTL and MBAM. I couldn’t provide logs from aswMBR.exe as I am using Windows 8.

Thanks for your help :slight_smile:

2

Let me know if this stops it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www2.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=30AD0008CA8230C4
FF - prefs.js..extensions.enabledAddons: superstart%40enjoyfreeware.org:6.12
[2014/01/17 12:23:54 | 000,000,000 | ---D | M] (Super Start) -- C:\Users\Amir\AppData\Roaming\mozilla\Firefox\Profiles\umrgnpxd.default\extensions\superstart@enjoyfreeware.org
[2014/01/17 23:52:51 | 000,407,752 | ---- | M] () (No name found) -- C:\Users\Amir\AppData\Roaming\mozilla\firefox\profiles\umrgnpxd.default\extensions\jid0-w1UVmoLd6VGudaIERuRJCPQx1dQ@jetpack.xpi
[2014/01/03 20:06:50 | 000,833,482 | ---- | M] () (No name found) -- C:\Users\Amir\AppData\Roaming\mozilla\firefox\profiles\umrgnpxd.default\extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi
[2013/08/21 13:22:52 | 000,000,000 | ---D | M] -- C:\Users\Amir\AppData\Roaming\Awesomium
[2013/05/02 08:12:13 | 000,000,000 | ---D | M] -- C:\Users\Amir\AppData\Roaming\Babylon

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

3

After the initial reboot from OTL, there was a single pop-up. But after the second reboot from Adwcleaner, everything seems to be quiet. Will notify if there are any occurrence after this post. Thanks :slight_smile:

Edit: Its still there unfortunately :/. Another pop-up came out. But the rate of the pop-ups did decrease. Before this I would get around 2-4 pop-ups in 10 minutes.

As ordered, the logs are as attached.

4

Let me know when you are happy and we will tidy up :slight_smile:

5

Another pop-up came out right after I read your reply. Darn it! Guess its not over. Whats the next step Capt’n?

6

OK lets use this next

Please download Junkware Removal Tool to your desktop.

[]Right-mouse click JRT.exe and select “Run as Administrator” the tool will open and start scanning your system
[]please be patient as this can take a while to complete depending on your system’s specifications
[]On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
[]post the contents of JRT.txt into your next message.

7

Alright. Done. Awaiting instructions.

8

Is it still occurring ? This file is getting a list of updated servers, and sometimes it can just be a game trying to update from a bad site

9

Its still occurring. I’m surprised there’s a lot of new threads regarding this problem. What is it actually? I’ve read in some older threads before mine that it could be an FP. Is this the case for me?

10

There is that possibility, I am looking for a common programme that would use that to update its list of servers
There is a programme on your system that is requesting an updated list and for some reason Avast does not like that server. I will continue looking :slight_smile:

But on the bright side you are now clear of any adware

EDIT: I have forwarded this thread to Avast for them to check out

11

Great! Good to hear I’m free of Adware.

Alright. Thanks for all your help :)! So, what do I have to do now? Do I just wait it out and keep checking this thread in case of a solution?

12

As soon as I either find the culprit or Avast releases a streaming update to fix it I am afraid so

13

Got it. I’ll wait it out then. Thanks for all your help Capt’n :)! I’ll keep visiting this thread in case of updates.

14

Hello,
domain will be unblocked in next stream update.

Milos

15

Thank you Milos :slight_smile:

16

Would like to thank essexboy and the Avast! team on such great efficiency on tackling this problem on such a short notice. Great job you guys and thanks alot! :slight_smile:

17

Kudos to the analysis team … I am just a little gofer :slight_smile: