Infection URL:Mal

OK lets now try FRST as I think we are on the track of the blighter now

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CMD:ipconfig /release CMD:netsh int ip reset CMD:ipconfig /renew REBOOT:

Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

Seems like FRST64 has the same result as running manually the commands.
It seems that is something directly hooked into the network connection as the popups appear immediately after activating the wireless interface.

Could you disable Avast self protection and run the FRST fix again please

Disabled all Avast shields and rerun the fix and the result is the same :frowning:
I see that some other people are having issues with that specific command (http://www.eightforums.com/network-sharing/18945-error-when-resetting-tcp-ip-stack.html). :frowning:

OK we will need to activate the super admin account. We must turn this off on completion

To open an Administrator Cmd prompt from the Desktop use Win + X and choose Command Prompt (Admin) from the list.

In the black box type in/copy the following command :

net user administrator /active:yes

Validate by pressing Enter.

Now log off and select the administrator account that should appear

To open an Administrator Cmd prompt from the Desktop use Win + X and choose Command Prompt (Admin) from the list.

In the black box type in/copy the following commands, each one followed by enter :

ipconfig /flushdns
netsh int ip reset c:\resetlog.txt
ipconfig /release
ipconfig /renew

Then reboot the computer to your normal account

If the fix is a success turn off the super admin :

To open an Administrator Cmd prompt from the Desktop use Win + X and choose Command Prompt (Admin) from the list.

In the black box type in/copy the following command :

net user administrator /active:no

Validate by pressing Enter.

netsh int ip reset c:\resetlog.txt has the same result using Administrator account :frowning: so maybe it is just not working completely on windows 8.1.

OK I will check how to retake permissions on that reg key

When you disabled Avast self protection did you remove the tick in Settings > Troubleshooting

OK this small programme should reset all registry key permissions to default, which should allow us to revert the changes

Download and run Reset Registry Permissions from here http://www.tweaking.com/content/page/reset_registry_permissions.html
Once it has finished then try the netsh int ip reset command again

Yes, that was what I did and also disabled the shields.

Could you run reset reg permissions programme please… That may well fail. Do you have your windows cd

I have:

  • run the registry tweak and finished
  • run the netsh can seems to have worked
C:\WINDOWS\system32>netsh int ip reset c:\resetlog.txt Resetting Interface, OK! Resetting Neighbor, OK! Resetting Path, OK! Resetting , OK! Restart the computer to complete this action.
  • rebooted, the popups are still there when I activate the wireless interface
  • tried to re-run netsh again, now it returns the error from before

I give up …

Temporary fix (no more warning popups for now), without activating Gaming mode :):

  • added in hosts file
0.0.0.0 getmuzicas.info 0.0.0.0 getusaaall.info

But I want to find the malware somehow so to understand if my system is safe or not, as I am unsure of the overall effects of the infection (only popups, or something else).

The thing is that the tcpip stack is compromised, I was thinking about trying to repair it from the recovery console hence the cd question

I have windows 8.1 that came with the notebook, I have no CD, neither does the notebook have a CD drive :slight_smile:

As I read here http://www.winhelp.us/repair-your-computer-in-windows-8.html#F8 I can access the recovery console, but what should I do from there?
Also, I would like to continue using the current Windows installation and I am not yet ready for a reinstall if it crashes :slight_smile:

OK I will PM a link for the windows 8.1 RC and then we will try it from there

Download the following three programmes to your desktop :

  1. Rufus

For 64bit systems
2. Windows 8.1 64bit RC
3. Farbar Recovery Scan Tool x64

Insert the USB stick Then run Rufus

https://dl.dropbox.com/u/73555776/rufus.JPG

Select the ISO file on the desktop via the ISO icon.

Press Start Burn

https://dl.dropbox.com/u/73555776/RufusISO.JPG

Then copy FRST to the same USB

http://dl.dropbox.com/u/73555776/frstwintoboot.JPG

Insert the USB into the sick computer and start the computer. First ensuring that the system is set to boot from USB
Note: If you are not sure how to do that follow the instructions Here

Windows 8 screen shots

When you reboot you will see this.

Select the language on this screen and keyboard on the next

https://dl.dropbox.com/u/73555776/select%20language8.JPG

Select the Trouble shoot option

https://dl.dropbox.com/u/73555776/Select%20option8.JPG

Select Advanced option

https://dl.dropbox.com/u/73555776/advanced8.JPG

Select Command prompt

https://dl.dropbox.com/u/73555776/command%208.JPG

At the command prompt type the following :

https://dl.dropbox.com/u/73555776/notepad.JPG

The notepad opens. Under File menu select Open.
Select “Computer” and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

I was unable to reboot from the USB stick, don’t know why the notebook ignored it even if I selected it as a boot device.
However, I booted in Windows 8.1 recovery and ran FRST64, the result is attached.

Download the attached fixlist .txt to the same location as FRST
Run FRST and press fix
Reboot to normal windows and let me know exactly when you get the alerts again (if you do)

Running the fixlist from Recovery produces an empty file (see fixlog copy).
Anyway I run it from Windows and the log is attached.

In any case, the popups seems to be gone.
I disabled the previously mentioned hosts entries and disconnected and reconnected the wireless and the popups do not show as they did yesterday.
I am unsure what happened, maybe something I did or the malware is just gone, or Avast can no longer stop it.
I will leave for now the hosts entries and hope everything is well.
Thanks for your patience and your help in trying to fix this.

No if it was still there Avast would continue blocking it. Looks like the recovery mode option did the job. Monitor it for a while though and when you are happy let me know and I will tidy up