Malicious URL Blocked explorer.exe no virus?

[system]

Hi guys,

Been trying to figure this out all day but not getting anywhere, would be really grateful for any help.

When I try and visit some sites I get an Avast Malcious URL warning, Avast says the infection is URL:Mal and the Process is C:\Windows\explorer.exe

I ran Malwarebytes which found two threats and removed them, have since Malwarebytes and an Avast scan but they are finding nothing.

First thing this morning I was getting the Malicious URL warning for every site, now it’s just some (don’t think they are problematic sites because it’s Facebook etc). I’ve looked online and checked the recommended places in regedit but they don’t contain the problematic files that other people have listed (and said that the removal rectified the problem).

Any advice very gratefully received! Thanks for reading.

[DavidR]

This needs further analysis by a malware removal specialist:
Go to this topic http://forum.avast.com/index.php?topic=53253.0 for information on Logs to assist in cleaning malware. Use the information about getting and using the tools and attach the logs here, not in the LOGS topic.

[system]

Thanks David. I’ve posted the most recent log from Malwarebytes (hope I’ve done this correctly) and am downloading OTL now so I will post that asap.

Thanks again

Database version: v2012.04.04.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Kate :: KATE-PC [administrator]

25/06/2012 13:05:00
mbam-log-2012-06-25 (13-05-00).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 198396
Time elapsed: 5 minute(s), 38 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[DavidR]

You’re welcome.

What may help the malware removal specialist more (when they are able to get to the topic) is the MBAM log showing the detections that were removed, rather than the clean log.

[system]

Sorry problems trying to upload…

[system]

Ok I’ve posted the OTL log and the extras log from OTL should now be attached also…

The MBAM log from earlier is below but the trojans it detected were a keygen for some old software. It’s removed them but I don’t think they would have been anything to do with this problem.

Thanks for all your help thus far.

alwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.04.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Kate :: KATE-PC [administrator]

25/06/2012 10:27:57
mbam-log-2012-06-25 (10-27-57).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 66318
Time elapsed: 17 minute(s), 11 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Program Files\Adobe\Adobe Photoshop CS4 (64 Bit)\PhotoShopCS4_X32_Crk.exe (Trojan.Agent) → Quarantined and deleted successfully.
C:\Program Files\Adobe\Adobe Photoshop CS4 (64 Bit)\PhotoShopCS4_X64_Crk.exe (Trojan.Agent) → Quarantined and deleted successfully.

(end)

[DavidR]

Did you actually install photoshop and what it legit as the file name looks strange and given MBAM thinks it a trojan agent (may come if a cracked version software installed) ?

[mchain]

@DavidR post:7

Did you actually install photoshop and what it legit as the file name looks strange and given MBAM thinks it a trojan agent (may come if a cracked version software installed) ?

DavidR and Kate5555,

This might help: http://www.threatexpert.com/files/photoshopcs4_x32_crk.exe.html

Also this: http://www.google.com/#hl=en&output=search&sclient=psy-ab&q=PhotoShopCS4_X32_Crk.exe&oq=PhotoShopCS4_X32_Crk.exe&aq=f&aqi=g-CK1&aql=&gs_l=hp.12..0i33i30.14707.14707.0.21478.1.1.0.0.0.0.167.167.0j1.1.0...0.0.l3U-_Cns_3U&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.,cf.osb&fp=24bd4001b4cd61d4&biw=1280&bih=885

Note numerous file-sharing sites and keygen sites listed here.

[DavidR]

Yes, my thoughts were it is a cracked (or purporting to be) version of photoshop, who installed it is a tricky question (who has access to the computer) as installing it could have been the start of the problems.

[essexboy]

In addition to the crack there is also Norton installed, this is a case of where more is not better

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll File not found O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

:Files
ipconfig /flushdns /c
C:\PROGRA~2\WIA6EB~1

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

• IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[system]

Hi there,

Thanks for the quick replies. It was a cracked version, I didn’t install it (don’t have enough knowledge to understand patches, keygens etc!) but it was done a few months ago. I only started having problems within the last 24 hrs so not sure if that would be linked? Also MBAM removed the trojan so would it still be causing problems?

Bit of further info - the Malicious URL warning comes up far more often on Internet Explorer than it does when using Firefox and yesterday a family member who had had a virus on their computer plugged a USB key into another of my computers. I use the same wireless network so could this have somehow infected my computer? (The computer they plugged the USB into is absolutely fine).

Re Norton being installed - Norton has never been installed but the computer came with it partially preloaded. This ran out but I still get popups from Norton asking if I want to activate although it does state that Norton is not activated at all currently.

Sorry for the stupid questions, I don’t have much knowledge about this (obviously lol)

Thanks again

[system]

Quick update - I think I may have found the problematic file. I started to get a ‘sound pop up’ when I viewed the volume mixer it showed i was coming from Adobe. I did install an Adobe flash player update about 10 days ago and have had a few Adobe flash player error messages throughout the week.

Also, when checking what programs were executed upon startup Adobe was one of them but I assumed it was safe (stupidly).

I uninstalled the update and (so far) I haven’t had the malicious URL, my CPU is now normal although it is creeping up at points.

Does anyone know of any files that would appear in the regedit if the virus was still in there? I’ve searched online but can’t find too much info although it does seem there was a virus masquerading as an Adobe flash player upgrade.

Thanks for any advice

[essexboy]

If you continue with the fixes I have posted then we shall ensure that it is all gone

[mchain]

Suggest you not make changes to your system while essexboy is helping you get rid of this. Would help if you ran the fixes, that way the malware is completely gone with minimal changes to your system. You are in good hands.

Wrong move, possibly worse than before.

[system]

Thanks for the replies, sorry it’s taken me a couple of days to reply, I wasn’t able to follow Essexboy’s instructions until today.

Before I do the OTL runfix and Combofix I just wanted to update on what’s happened since my last post in case I gave the wrong info before.

I had some issues with online banking and my bank contacted me and told me install Rapport before doing anything because it should stop a vrius accessing the account and also something to do with insurance if my account was hacked.

Anyway, as soon as Rapport installed it said my system wasn’t safe and then explorer.exe kept crashing. I restarted and Rapport has found a virus called Torpig and it said to restart to complete removal. I restarted and the same thing happened, I restarted again and it hasn’t come up. (Neither Avast or Malwarebytes found Torpig).

Based on this should I go ahead and run the OTL fix and Combofix? Thanks for all the help so far, really really appreciate it

[system]

wait until essexboy advices You…

Until then i would like to inform You that u had crack software installed on your system…and the bad guys use these crack thingy’s to spread infections…as according to essexboy these things are number 1 vector to these type of infections…I would highly recommend You to NOT install or download cracks or illegal softwares…

[system]

Thanks for the advice.I had some software installed for me quite a while ago, perhaps that allowed the virus to get in. Will definitely not be doing it again!!

Edit: Sorry, should have said. Since Rapport removed it the computer has run better than before, CPU is going from 16%-49% depending on what I’m using (it was at 80-100% before) and there aren’t any noticable problems…to a complete novice anyway!

[essexboy]

Yes continue with the fixes as posted