Malicious URL blocked explorer.exe

Viruses and worms
1

I’ve been getting the Avast Malicious URL blocked freguently while using MS Explorer and ocassionally with Chrome. I ran TFC and rebooted. I ran Malwarebytes and it did not find anything (report attached). I ran TOSSKiller with the options checked and it found 7 suspicious items (no option to clean so I skipped). REport is attached. I ran OTL and generated two reports(attached). I tried to run aswMBR but it froze while scanning with teh message: Antirootkit has stopped working. A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is found. The program was closed, the windows would not boot for about 3 tries, it finally booted ok, but I still get the malicious URL notice.

2

malware removers are notified. It may take several hours before one arrive so be patient

3

Thank you. waiting patiently.

4

Hi it appears that a new crop is making the rounds, I have very little data on this to date so we may need to do some digging

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL IE - HKLM\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XPxdm003YYUS&ptb=50A15029-E23B-450C-BB29-5F3181F1380F&psa=&ind=2010100322&ptnrS=XPxdm003YYUS&si=&st=sb&n=77cfb262&searchfor={searchTerms} IE - HKU\S-1-5-21-3107575427-713325675-2747041482-1000\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XPxdm003YYUS&ptb=50A15029-E23B-450C-BB29-5F3181F1380F&psa=&ind=2010100322&ptnrS=XPxdm003YYUS&si=&st=sb&n=77cfb262&searchfor={searchTerms} O3 - HKU\S-1-5-21-3107575427-713325675-2747041482-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\S-1-5-21-3107575427-713325675-2747041482-1000\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found. O3 - HKU\S-1-5-21-3107575427-713325675-2747041482-1000\..\Toolbar\WebBrowser: (no name) - {C2DB4FE6-8409-45CE-8010-189A7B5CCE86} - No CLSID value found. O3 - HKU\S-1-5-21-3107575427-713325675-2747041482-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Please download MiniToolBox, save it to your desktop and run it.

https://dl.dropbox.com/u/73555776/minitoolbox.JPG

Checkmark the following checkboxes:

[]Flush DNS
[]Report IE Proxy Settings
[]Reset IE Proxy Settings
[]Report FF Proxy Settings
[]Reset FF Proxy Settings
[]List content of Hosts
[]List IP configuration
[]List Winsock Entries
[]List last 10 Event Viewer log
[]List Installed Programs
[]List Devices
[]List Users, Partitions and Memory size.
[*]List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using “Reset FF Proxy Settings” option Firefox should be closed.

5

Essexboy:

Thank you for all your help, for me and all the other folks with problems. You truely provide a valuable service that is greatly appreciated.

I have atted two files; The OTL quick scan ran after the Run FIx you sugggested, and the results of the mini tool box

6

Are the alerts still occuring ?

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

7

I ran ComboFix as instructed. I have attached the report, but there were issues. I’m not sure if it is relevant but here is what happened. ComboFix made a restore point then started scanning. At some point it then rebooted my computer (I was away from the computer at the time), and brought up the report window with the results. I saved the report to the desktop. When I ried to click on the report to open it I got the following error message: Illegal operation attempted on a registry key that has been marked for deletion. Then, which ever program from the destop or the programs list I tried to open, I received the same error notice. SOo I rebooted the computer. Upon restart, after all the desktop icons loaded, a blue/green warning box poped up. It stated ‘Warning’ with an excamation point inside a triangle. I closed it out. I then opened my browser to get to this thread, and upon opening my browser I recieved the following message: About to leave a secure browser. Do you want to continue? I said yes and when my browser opened, all of my tabs save the first one in the list were missing. All the links to open tabs under tools/ Internet options/ General were missing. However, I can now open the comboFix Report and my other programs without the error message stated above

The Combo Fix Report is attached

8

OK Combofix has reset IE to high security defaults

So go to control panel > Internet options > Advanced
Select restore advanced settings

The marked for deletion error is include within the combofix instructions and as stated a reboot will clear that.

More to the point are you still getting the alerts ?

9

So far I haven’t received any more alerts. I will monitor for 24 hours to make sure. Can you tell me what virus/malware I had and where it was located?

Thanks

10

It was either TVFanatic or a poisoned DNS cache not quite sure which yet