Malcious URL Blocking report

Viruses and worms
1

I’m getting this too

2

Malware report

3

OTL reports

4

asw log

5

So I’ve run all the basic scans…and this seems to be getting worse. Please help

6

I’m getting the same darn blocking pop ups. Need to run scans and post but this seems to be a problem affecting a LOT of people.

7

This is getting annoying, it been mos of the week, I’ve posted all the logs asked for, and I’m still dealing with this issue. Could a Mod or someone please look at this and help out? >:(

8

Are the alerts in FF, IE or chrome. Could you post a screenshot of the alert

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL
O3 - HKU\S-1-5-21-3977178954-1729343814-119130554-1000\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
[2012/09/14 17:30:44 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2011/04/04 19:08:59 | 000,000,026 | -H-- | C] () -- C:\ProgramData\.811261211181235583101118113995
@Alternate Data Stream - 168 bytes -> C:\Users\Chaos\Documents\Wooden Camera Tax.jpeg:3or4kl4x13tuuug3Byamue2s4b

:Files
ipconfig /flushdns /c
netsh int ip reset c:\resetlog.txt  /c
ipconfig /release /c
ipconfig /renew /c

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

9

New Log OTL Scan

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3977178954-1729343814-119130554-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}\ not found.
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\x64 folder moved successfully.
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64 folder moved successfully.
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 folder moved successfully.
C:\ProgramData.811261211181235583101118113995 moved successfully.
ADS C:\Users\Chaos\Documents\Wooden Camera Tax.jpeg:3or4kl4x13tuuug3Byamue2s4b deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Chaos\Downloads\cmd.bat deleted successfully.
C:\Users\Chaos\Downloads\cmd.txt deleted successfully.
< netsh int ip reset c:\resetlog.txt /c >
Reseting Interface, OK!
Restart the computer to complete this action.
C:\Users\Chaos\Downloads\cmd.bat deleted successfully.
C:\Users\Chaos\Downloads\cmd.txt deleted successfully.
< ipconfig /release /c >
Windows IP Configuration
No operation can be performed on Local Area Connection while it has its media disconnected.
Wireless LAN adapter Wireless Network Connection:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::1884:5f1:a771:9c94%11
Default Gateway . . . . . . . . . :
Ethernet adapter Local Area Connection:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : sgt.cpqcorp.net
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : 2001:0:9d38:953c:a8:1095:9cd0:4e9f
Link-local IPv6 Address . . . . . : fe80::a8:1095:9cd0:4e9f%14
Default Gateway . . . . . . . . . : ::
Tunnel adapter isatap.gateway.2wire.net:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
C:\Users\Chaos\Downloads\cmd.bat deleted successfully.
C:\Users\Chaos\Downloads\cmd.txt deleted successfully.
< ipconfig /renew /c >

10

Are the alerts still present ? If so could you post a screenshot of the alert so that I can see the trigger

11

I have not had any since I ran this.

12

If you are happy then run OTL and press the cleanup button