malicious url blocked ?

Viruses and worms
1

:'(it keep popping up and i dont know what wrong help me. it says last blocked connection dl.gameplaylabs.com/cb/js/cf.js?zone=8296&subid=iorig&pid={pid} any ideas ? ever time i search for some thing or refresh on Firefox it pop up with that URL blocked

2

the url is malware and avast have block the attack from harming your computer.

http://www.mywot.com/sv/scorecard/dl.gameplaylabs.com

you could scan with malwarebytes antimalware to see if your system is clean.

http://filehippo.com/download_malwarebytes_anti_malware/

plus a scan with avast.

good luck let us know if something comes up on the scan.

3

thanks i did scan with avast but nothing was found just did the other scan nothing was found maybe i should do a boot scan with avast ? Malwarebytes’ Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5557

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/19/2011 2:40:16 PM
mbam-log-2011-01-19 (14-40-16).txt

Scan type: Quick scan
Objects scanned: 127986
Time elapsed: 13 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

4

This is removing some redirects

Kaspersky TDSSKiller http://support.kaspersky.com/viruses/solutions?qid=208280684

if that does not work

Follow this guide from our expert malware remover Essexboy
http://forum.avast.com/index.php?topic=53253.0
(do not post log`s in the guide)

To avoid using multiple post with copy and paste you have to attach the log`s
Lower left corner: Additional Options > Attach ( OTL.Txt and Extras.Txt.)

5

here the log please help

6

was there no OTL.extra.txt ?

Essexboy is notified, check back tomorrow. He is usually in her 8:00pm - 11:59pm UK time

7

here the other file

8

Did TDSSKiller find anything ?

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

9

Did TDSSKiller find anything ? it found one thing and i remove it but i did what you said it still popping up sorry wrong log for it will post right one

10

here the log you ask for

11

I do not mean to hijack this thread and hats off to essexboy! I have the same exact problem as OP. I think it is related to the secret crush from fbook. Any help would be greatly appreciated please and thank you! I followed your instructions and OTL log is attached

12
I do not mean to hijack this thread
then you should start a new tread, bc helping multiple users in the same tread will only create chaos

to avoid uing multiple post with copy and paste you attach the logs

lower left corner > additional options > attach

you start a new topic here http://forum.avast.com/index.php?board=4.0
top right there is a “new topic” button

13

Wow Pondos your quick… I did not hijack I was jut stating before hand that it could look that way. My problem is identical to OP’s so thought it would be best fit here. The other problems were getting fixed and addressed as you was typing your response… If there is a problem please let me know

14

when Essexboy start posting the OTL script commands, they are probably not the same to both of you. meaning he must post it double in the same tread…chaos …

15

Pondos I can see chaos happening rite now so I will start a new thread on the same subject. Funny any other forum everyone would freak out on me if I started a new one on same subject and was trying to avoid being rude at all cost. And attach was not working for me at first that’s why the misunderstanding. I will let this rebuttal hang for a few and remove it then re thread… My apologies

16
Pondos I can see chaos happening
and the name is Pondus ;D

wellcome to the forum… :wink:

17

Mohawk640

Just do this easy
open firefox click on tools scroll down to Add-ons open when you see secret crush click uninstall…restart firefox…done problem gone…That was hard

18

As I am playing around with system settings each fix is unique to that machine - no two sets of malware are the same

@mohawk640

I will need to use a stronger tool now

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

[*]Double click on ComboFix.exe & follow the prompts.

[*]As part of it’s process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it’s strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

[*]Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it’s malware removal procedures.

http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

http://img.photobucket.com/albums/v706/ried7/whatnext.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

19

jcandet i did what you said it not popping up any more am i fine now ? here the log essexboy

20

A few bits removed by Combofix, has it gone now ?

@jcandet - thanks for the input, added to my little ? List of fixes