Malicious URL Blocked constantly

Viruses and worms
1

Received a alert from avast notifying me of a malicious url being blocked. This notification has been popping up every 5-10 minutes since. I have run a quick virus can along with Malwarebyte’s. Any idea what I’m looking at? I’m a noob. Any help would be appreciated.

Here’s a screenshot of the alert:http://cdn.imghack.se/images/6e67f4bab36138c4f259cab4b4a503b4.png

2

Go here : http://forum.avast.com/index.php?topic=53253.msg451454#msg451454

Read what essexboy needs you to use and post the results in this thread you started as attachments.

See an example here: http://forum.avast.com/index.php?topic=105816.msg842175#msg842175

Oh, and welcome to the forums!

3

Okay here’s an update with the logs! Something came up though, right after running AdwCleaner a trojan was blocked by avast. After this my pc restarted and Avast ran what I assume was a full scan. During this scan avast found several threats. I wasn’t sure what to do so I sent them to the chest. Here’s the chest in avast: http://cdn.imghack.se/images/c1a3aef366ba2acbcbbea59e4c40f672.png

Since this I have been getting two errors on start up (I’m assuming due to the first two items in the chest?) Where do I go from here?

4

Darn Avast beat me to it… But it did not remove the run keys

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL
O4 - HKU\S-1-5-21-2673863287-3866301668-4005909547-1002..\Run: [npmasi] rundll32.exe "C:\Users\Matthew\AppData\Roaming\npmasi.dll",AClose File not found
O4 - HKU\S-1-5-21-2673863287-3866301668-4005909547-1002..\Run: [preroc] rundll32.exe "C:\Users\Matthew\AppData\Roaming\preroc.dll",UnboundLocalError File not found
O4 - HKU\S-1-5-21-2673863287-3866301668-4005909547-1002..\Run: [serialui] C:\Users\Matthew\AppData\Local\Microsoft\Windows\685\serialui.exe File not found
[2012/09/19 14:47:50 | 000,000,000 | ---- | M] () -- C:\Users\Matthew\AppData\Local\¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ

:Files
C:\Users\Matthew\AppData\Local\Microsoft\Windows\685

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

5

Thanks for the quick reply. It’s much appreciated. Just to clarify, will this fix the errors I’m having? Should I leave the infected files in the chest or attempt to repair or delete?

6
Just to clarify, will this fix the errors I'm having?
that is the idea ;)
Should I leave the infected files in the chest or attempt to repair or delete?
no rush to delete anything from chest .....

Essexboy will be back tomorrow with advice …

7

Okay here’s the log.

8

That looks good, any outstanding problems ?

9

Nah, everything seems to be great. Thanks a lot.

10

Run OTL and press the cleanup button to remove it ;D