"Infection Blocked" hxxp://s.vb3k.com/crossdomain.xml three times

Viruses and worms
1

Hi All, I’ve had this infection come up 3 times in 15 minutes hxxp://s.vb3k.com/crossdomain.xml

Here’s my Malwarebytes Log

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 1/8/2015
Scan Time: 12:05:40 PM
Logfile: malwarebytes log.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.01.08.14
Rootkit Database: v2015.01.07.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Admin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 331171
Time Elapsed: 13 min, 13 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.StormAlerts.A, C:\Users\Admin\AppData\Local\Weather_Warnings_LLC, Quarantined, [b2e64fa53b4e3ff75b13f953798a03fd],

Files: 2
PUP.Optional.AZLyrics.A, C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage, Quarantined, [3662c232ef9a4de9ccabde8e3fc447b9],
PUP.Optional.AZLyrics.A, C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage-journal, Quarantined, [3a5eea0adfaa290de1965f0d0201659b],

Physical Sectors: 0
(No malicious items detected)

(end)

working on Farbar now

2

Farbar and aswMBR results

3

Could you let me know if this stops it

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: SearchScopes: HKLM-x32 -> DefaultScope value is missing. Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Task: {6337C9A8-70B8-4FF3-896C-15954E0A9C18} - \UpdaterEX No Task File <==== ATTENTION EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

4

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-01-2015
Ran by Admin at 2015-01-08 14:59:28 Run:1
Running from C:\Users\Admin\Downloads
Loaded Profile: Admin (Available profiles: Admin)
Boot Mode: Normal

Content of fixlist:

CreateRestorePoint:
SearchScopes: HKLM-x32 → DefaultScope value is missing.
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Task: {6337C9A8-70B8-4FF3-896C-15954E0A9C18} - \UpdaterEX No Task File <==== ATTENTION
EmptyTemp:
CMD: bitsadmin /reset /allusers

Restore point was successfully created.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value deleted successfully.
HKCR\CLSID{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found.
“HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{6337C9A8-70B8-4FF3-896C-15954E0A9C18}” => Key deleted successfully.
“HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{6337C9A8-70B8-4FF3-896C-15954E0A9C18}” => Key deleted successfully.
“HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UpdaterEX” => Key deleted successfully.

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

EmptyTemp: => Removed 12 GB temporary data.

The system needed a reboot.

==== End of Fixlog 15:00:47 ====

AdwCleaner v4.107 - Report created 08/01/2015 at 15:39:17

Updated 07/01/2015 by Xplode

Database : 2015-01-03.1 [Live]

Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

Username : Admin - BECKY

Running from : C:\Users\Admin\Desktop\AdwCleaner.exe

Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\Greener Web

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd
Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Update Greener Web
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\Util Greener Web
Key Deleted : HKLM\SOFTWARE\Classes\CLSID{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : HKLM\SOFTWARE\Classes\Interface{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes{31090377-0740-419E-BEFC-A56E50500D5B}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{31090377-0740-419E-BEFC-A56E50500D5B}
Key Deleted : HKCU\Software\DriverSupport

***** [ Browsers ] *****

-\ Internet Explorer v11.0.9600.17496

-\ Mozilla Firefox v34.0.5 (x86 en-US)

-\ Google Chrome v39.0.2171.95

[C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.census.gov/search-results.html?q={searchTerms}&search.x=0&search.y=0&search=submit&page=1&stateGeo=none&utf8=%E2%9C%93&affiliate=census

AdwCleaner[R0].txt - [5769 octets] - [20/06/2014 14:30:30]
AdwCleaner[R1].txt - [2977 octets] - [08/01/2015 15:35:57]
AdwCleaner[S0].txt - [4686 octets] - [20/06/2014 14:38:25]
AdwCleaner[S1].txt - [2654 octets] - [08/01/2015 15:39:17]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2714 octets] ##########

5

Have the alerts ceased ?