Hello there! Like some others, I have a “threat has been detected” pop happening over and over again. It is always Malicious URL Blocked, and the object always ends in /task/6/. I read on another post that this is a virus trying to “phone home”.
I am going through the process you have offered - Logs to assist in cleaning malware - running adwcleaner now, and hope someone out there will read my logs and help me.
Thank you!
adwcleaner log attached
Attached are the malware and the 2 OTL logs… anyone out there? 
And now I can’t run aswMBR.exe because it is not a valid Windows 32 file or something. Hopefully someone can help me with what I posted so far as the pops still going non stop… all objects ending in /task/6/
anyone out there?yep....and next time, do this in the virus and Worms forum section...thats what is was made for ;)
try run aswMBR from safe mode
malware removers are notified, it may take hours before they arrive…
Hey sorry. I’ll get on running that in safe mode.
Shall I move now or remain here?
Stay here now
Could you let me know if this kills the alerts
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:Commands
[CREATERESTOREPOINT]
:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=fmtoby&chnl=fmtoby&cd=2XzuyEtN2Y1L1QzutDtDtBtCyD0DtB0BtBtD0F0E0DtB0CtCtN0D0Tzu0CtBtDtBtN1L2XzutBtFtCtFtDtFtAtDtC&cr=120480611
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=fmtoby&chnl=fmtoby&cd=2XzuyEtN2Y1L1QzutDtDtBtCyD0DtB0BtBtD0F0E0DtB0CtCtN0D0Tzu0CtBtDtBtN1L2XzutBtFtCtFtDtFtAtDtC&cr=120480611
IE - HKU\S-1-5-21-1159065996-402827216-737821929-1004\..\SearchScopes\{36474992-3D9F-4B8A-9191-98E61750BB4A}: "URL" = http://search.conduit.com/Results.aspx?ctid=CT3300019&SearchSource=45&UM=2&q={searchTerms}
[2013/07/21 10:32:28 | 000,000,000 | ---D | M] ("Trusted Saver") -- C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\Profiles\tk6znb9o.default\extensions\9b7182cf-0847-4d17-8a3f-c850f8c4a23e@51bca2a9-a5e9-4d98-8d77-40c0e8212d2a.com
[2013/07/20 14:34:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ken\AppData\Roaming\Mozilla\Firefox\Profiles\tk6znb9o.default\extensions\9b7182cf-0847-4d17-8a3f-c850f8c4a23e@51bca2a9-a5e9-4d98-8d77-40c0e8212d2a.com\chrome\content\extensionCode
[2013/06/26 12:22:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/06/26 12:22:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKU\S-1-5-21-1159065996-402827216-737821929-1004..\Run: [SPMTray] "C:\Program Files (x86)\PC Speed Maximizer\SPMTray.exe" File not found
[2013/08/25 14:58:46 | 000,001,842 | ---- | M] () -- C:\Windows\tasks\Trusted Saver-firefoxinstaller.job
:Commands
[resethosts]
[emptytemp]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN
Run AdwCleaner again and scan, once completed select all and press clean
Here is the OTL report after running your fix. Pop ups still happening. Will run the adwhere thing again.
Ran adwcleaner again. Still have pop ups. 
Essexboy will be back tomorrow. It is almost 1 AM back in the UK.
Regards.
Could you attach a screenshot of the Avast alert please as that will give more information
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.
Notes:
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Oops, had to go to work, screen shot attached, headed now to do other thing.
Cant find combotext log… rebooted and all, will perhaps run it again.
Attached two more visuals for ya of what is repeatedly and still happening…
Okay, took me a second time, but found the log from the combofix… read it was outputting to this 3277 file thingy dingy.
When I tried to attach and/or look at the file, I got a message saying I have no permission to do so.
I can’t find the “text” file you refer to… searched computer for “combo” to no avail.
Avast blocking pop ups still happening over and over…
Please see attached file. Sooooo thankful for your help in getting this laptop working! Not sure what else a gal would do without the likes of folks like you! :o
Wait wait! Something happening! More soon.
Still can’t find text log. Have a computer icon called “Combofix” on my C drive. Any ideas what next?
Wait for a reply from essexboy. He is the one helping you.
Patience is a virtue.
Hi could you now re-run combofix please as it will sometimes require two hits to kill the bad boy
Yes, Bob, thank you. As evidenced by the many hour lapses in my responses I am happy to be patient. But I will be sure and remember your sound advice.
Essex, ran combofix again… I think the attached is the log you are requesting- have a whole file of combofix stuff now. Pop ups still happening. Not sure combofix ran completely as there were multiple crashes along the way? Maybe I will run it again while I await your response.
Soooo thankful for your continued work on this!!!
That almost looks like an MBR infection but none of the other usual data points are there. Does this happen in all browsers
Download the latest version of TDSSKiller from here and save it to your Desktop.
[*]Doubleclick on TDSSKiller.exe to run the application
https://dl.dropbox.com/u/73555776/tdss%20start.JPG
[*]Then click on Change parameters.
https://dl.dropbox.com/u/73555776/tdss%20Change%20param.JPG
[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
[*]Click the Start Scan button.
[*]If a suspicious object is detected, the default action will be Skip, click on Continue.
https://dl.dropbox.com/u/73555776/tdss%20threat.JPG
[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
[*]Get the report by selecting Reports
https://dl.dropbox.com/u/73555776/tdss%20report.JPG
[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
Please copy and paste its contents on your next reply.