Malicious URL Blocked Keeps Popping Up

Avast Free Antivirus / Premium Security
1

Hi, wondering if you can help me with a problem I seem to have picked up on my computer.
I keep getting the Avast Malicious URL Blocked pop-up which is happening on about 90% of the pages I view. Really annoying and not sure how to go about cleaning my computer.

Infection details:
URL ://includeit.info/include.js?id
Process C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
Infection URL:Mal

I downloaded Malwarebytes and did the quick scan but it didn’t pick up anything. Not sure what to do next - can anyone help?

2

HI,

  1. ALSO REDO MALWARE BYTES FULL SCAN AND SEE WHAT IT FINDS. This will scrub deeper into your computer. Remove what it finds & Reboot

  2. Do a avast boot time scan and do entire hard drive to see what it picks up and remove what it finds. Also what operating system are you using?.

3

I’ve done a full malwarebytes scan and it hasn’t come up with anything. Also done the avast boot time scan on the hard drive and again nothing found.
My operating system is Windows Vista Home Premium.

4

It won’t as it is probably the complity toolbar or vshare

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Local\AutoProxyCache /s
CREATERESTOREPOINT
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

5

Hi essexboy, thanks for responding.
Quick scan done with OTL and both files attached.

6

Let me know if this stops them

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL IE - HKU\S-1-5-21-2026864239-2546147487-2415521456-1000\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=mgptCZNSe3fepNXp2Q3CrM_y-fc?q={searchTerms} [2012/02/23 18:23:35 | 000,000,000 | ---D | M] (Complitly - Speed up your search with your personal search suggestions tool) -- C:\Users\Rhona\AppData\Roaming\Mozilla\Firefox\Profiles\yd6s1ah1.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516} O2 - BHO: (Complitly) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\Rhona\AppData\Roaming\Complitly\Complitly.dll (SimplyGen) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) [2012/02/23 18:23:31 | 000,000,000 | ---D | M] -- C:\Users\Rhona\AppData\Roaming\Complitly

:Files
ipconfig /flushdns /c
C:\Users\Rhona\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

7

That seems to have fixed it!! No pop-ups so far.
Done the quick scan again and file attached.

8

Yep it appears to be gone, always be cautious when installing programmes and look out for unwanted toolbars ;D

Run OTL and hit the cleanup button to remove it

9

Really appreciate your help, thank you!

10

Hello essex I have the exact same problem

i attach my logs