Latest update has blocked access to my isp's homepage

Avast Free Antivirus / Premium Security
21

Yes that is the post I’ve cut and pasted it below.

“Ok by accident I have a clue to what’s going on and I can reach the site.
If I type http://www.spark.co.nz/ it wont work, which is the link a google search will give you for spark nz.
But if I type https://www.spark.co.nz tI lets me go there, the difference being a secure link rather than a standard link”

I was pointed to that section of the forums after trying things here.
So having found that a secure link works why wont the standard link work without turning of the webshield and is this now the right place to be posting about this issue?

22

This is the correct board in as much as the issue does not involve a “virus”, as opposed to in the event that the issue did involve a virus in which case the alternate “viruses and worms” board would be what should be used.

23

Zavrix, please run Farbar again and attach the new log files.

24

Okay have run FRST again and here are the logs

25

I see you have ZoneAlarm running.
In the past there have been issues when using ZA and avast at the same time.
I suggest you remove ZA

If the problem isn’t solved…

  • Create a backup from the registry
  • Use Farbar (as you have done before) with the underneath code/fixlist.
Start
CreateRestorePoint:
Closeprocesses:
Emptytemp:
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
FF SearchEngineOrder.3: Bing 
FF NetworkProxy: "autoconfig_url", "https://secure.premiumize.me/pac/us.pac"
FF NetworkProxy: "type", 0
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-02-06]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-02-06]
2015-03-22 13:38 - 2015-03-23 20:21 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-24 07:07 - 2014-02-09 10:38 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-23 20:25 - 2014-02-09 10:38 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.132.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.140.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelog.dll No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
CMD: ipconfig /flushdns
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh winsock reset catalog
CMD: bitsadmin /reset /allusers
End
26

Okay I have done all of the above and still not letting me access the site using http address.
I’m going to reinstall ZA as I find that very useful.

27

bump, in case anyone else has any other suggestions before I uninstall avast and try a different virus scanner.

28

Have you removed the proxy service ?

29

Yep

30

Just to make sure,
us.pac is not anymore in the Farbar log file if you run it now ?

31

No us.pac in logs

32

Hmm, I really though that was (part of) the culprit.
Let’s try something else.
Find and download the latest drivers for your network card (or if it is onboard, for your chipset).
Delete the network connection.
Delete the network device.
Install those latest drivers and create a new network connection.

33

I get the following when attempting to access spark:

http://www.screencast-o-matic.com/screenshots/u/Lh/1427718580108-6889.png

34

Okay I have deleted the connection installed the latest drivers for my network card and still the same result.
This is so crazy, still no problem connecting to any other site I have tried. Disable webshield and I get straight in to spark.co.nz.

35

Hi there,

thanks for the report! To find where the problem is, we will need some information. The easiest way how to provide it to us is to use Avast support tool. (info about it and how to use it - https://www.avast.com/en-us/faq.php?article=AVKB33). Send the package through the interface to use (there is an option for it) and then post the package id here, please :slight_smile:

Hope to hear from you soon,
B.

36

Thanks Eddy for the help on this issue, as I, you have spent a lot of time on this problem. I’ve been a keen user of Avast for a very very long time now and only ever had 2 issues in that whole time. But after trying the last suggestion from Eddy I finally gave up and uninstalled Avast. I have installed another product and no longer have the same issue. I’ll give this issue a rest for the time being until I get the urge to reinstall avast again and run the support tool.
Thanks again for your efforts.

37

Thank you zavrix.

Trying to help is all I (and other users here) can do.
Please keep us updated if you have found out more or if the problem is solved.

38

It would have been better had zavrix complied with the request from Avast to solve the problem.
Removing Avast is sidestepping a possible problem (infection) that may not yet be detected by another AV and is now being spread.

39

Okay I see your point, although we have done a lot to make sure there is no infection on the system. I will uninstall the other av and reinstall avast so I can run the tool and submit the results.

40

Okay here is the package id GYRQK