Malicious URL blocked message constantly popping up (Avast)

system · May 7, 2012, 3:10pm

Sorry, could not upload a better pic,

Here’s what it says:

MALICIOUS URL BLOCKED

avast Network Shield has blocked a harmful site.

Object: http:/

Infection: URL:Mal

Process: C:\Windows\system32\svchost.exe

It does not specify the website (http:/)

essexboy · May 7, 2012, 3:18pm

Hmm that would suggest a net service or the like

Download the latest version of TDSSKiller from here and save it to your Desktop.

[*]Doubleclick on TDSSKiller.exe to run the application

http://dl.dropbox.com/u/73555776/TDSSFront.JPG

[*]Then click on Change parameters.

http://dl.dropbox.com/u/73555776/TDSSConfig.JPG

[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

[*]Click the Start Scan button.

[*]If a suspicious object is detected, the default action will be Skip, click on Continue.

http://dl.dropbox.com/u/73555776/TDSSFound.JPG

[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

[*]Get the report by selecting Reports

http://dl.dropbox.com/u/73555776/TDSSEnd.JPG

[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

Please copy and paste its contents on your next reply.

system · May 7, 2012, 4:37pm

Sorry, I could not copy & paste the report as it exceeds 1000 characters. I have attached it as a text file…

essexboy · May 7, 2012, 5:54pm

OK that is another area ruled out… Does this occur in firefox, IE or both ?

system · May 7, 2012, 6:25pm

I use Chrome and firefox and the alerts usually start after I open firefox.

essexboy · May 7, 2012, 6:44pm

OK what I would like you to do is start Firefox in safe mode - details here http://support.mozilla.org/en-US/kb/Safe%20Mode

I believe it is a rogue add on within firefox… And they can be difficult to find

Once you have started firefox in safe mode could you let me know if the alerts persist

system · May 8, 2012, 7:41am

I have been using firefox on safe mode and after that the alert has not appeared again.

Appreciate all your help!

essexboy · May 8, 2012, 5:22pm

OK now we need to determine which addon is responsible

So the way forward is to enable one add on and then see if the problem recurs, if it does not then enable another and so on until the culprit is revealed…

Do you have an add on called translator 2.0 ?

system · May 10, 2012, 7:26am

Sorry for the late reply, I was caught up with some work. I kinda lost my patience and removed all firefox add-ons, uninstalled firefox and then re-installed it.

In the last two days, the pop up did not appear. I have also removed all the tools like ComboFix.

Everything seems fine at the moment. Thanks a lot for all your help.

essexboy · May 10, 2012, 5:17pm

No problem - let me know if it comes back

system · June 28, 2012, 5:23pm

Hi essexboy,

The same alert has started appearing again since the last 2 to 3 days. Should I start another topic or can I post all the logs in this one itself?

MALICIOUS URL BLOCKED

avast Network Shield has blocked a harmful site.

Object: http:/

Infection: URL:Mal

Process: C:\Windows\system32\svchost.exe

It does not specify the website (http:/)

essexboy · June 28, 2012, 5:33pm

Hi there … OK lets see what you have

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
services.*
WSHELPER.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
CREATERESTOREPOINT
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Post both logs

system · June 28, 2012, 5:57pm

MBAM and OTL Logs

essexboy · June 28, 2012, 6:31pm

Did you set the proxy in Firefox ?

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

system · June 28, 2012, 7:09pm

Yes, I did set the proxy in FireFox. ComboFix log attached.

essexboy · June 28, 2012, 7:12pm

Seeing nothing so far … Are the alerts still occuring ?