Malware Blocked: http://wpad.browserupdatecheck.in/wpad.dat

Viruses and worms
1

Avast keeps popping up with this:

Avast Notification:
URL: http://wpad.browserupdatecheck.in/wpad.dat
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

I’ve gotten as many as 51 popups notifying me that it has been blocked. Among svchost.exe, I’ve seen other processes as well, such as an updater for Lightshot which is a program I know is clean and have used for a long while now. The popup notifications blocking this infection just started happening a few days ago, potentially after a restart of my computer.

I have run Malwarebytes, and Avast and both came up with a few results like bad cookies and whatnot of which I fixed/removed, however the infection above seems persistent.

Any help would be appreciated, it’s getting to the point where I don’t even want to be on my computer much anymore due to the perpetual popup notification of Avast blocking this thing.

2

Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253.0

3

Alright, I’ll download those programs and follow the instructions.

Logs on the way.

4
I have run Malwarebytes, and Avast and both came up with a few results like bad [b]cookies[/b]
Strange, as Malwarebytes and avast dont target cookies ... unless something has changed?
5

My bad, probably not cookies. I just know it was a few low risk files and some from Mozilla so I just assumed cookies of some sort. Ah well.

All scans done. Log files attached.

6

OK, now you’ve to wait a bit…

7

Not a problem and thanks for the quick replies :slight_smile: I’ll gladly wait if it means potentially removing this nuisance.

8

Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.

  1. If you have bookmarks, let’s save them by exporting them - Export Bookmarks
  2. Then I need you to go Google Sync and sign into your account
  3. Scroll down until you see the “Stop and Clear” button and click on the button. At the prompt click on “Ok”
  4. Now we need to uninstall chrome.
    Note: When asked about user data or settings you must remove this also so please check the box.
  5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
  6. Import your bookmarks back into Chrome
  7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.

THEN

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-3952203236-1806241531-2117749803-1001\...\Winlogon: [Shell] C:\Windows\expstart.exe [925184 2015-09-30] () <==== ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION FF user.js: detected! => C:\Users\Beckah\AppData\Roaming\Mozilla\Firefox\Profiles\ar917fgv.default\user.js [2015-09-02] FF user.js: detected! => C:\Users\Beckah\AppData\Roaming\Mozilla\Firefox\Profiles\lzhomgws.default-1427615047405\user.js [2015-09-02] CHR HKLM-x32\...\Chrome\Extension: [bghejdcdajlenjngcknlkkoakmmjfanb] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [eeafbffkmccheohnooflcnppngmobeoe] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2015-06-29] CHR HKLM-x32\...\Chrome\Extension: [ellbonkjdmgdghkojcjmomekmjpdffde] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [fllgpcmelbfhcligbphaaplminjpbiad] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-09-29] CHR HKLM-x32\...\Chrome\Extension: [hpjocjloojeicikiokfiekcdpojgfefc] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [jmnkgjdfgnjhmnopgmkcpigenfhgajdj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [kfbhfniohjdklgcmbmemnpaimpdaikea] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [manaobgbdfpjjjnheogfghmjbikhjnlf] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [oaobejgaaiojgggjojlcpbembaoajbmc] - hxxps://clients2.google.com/service/update2/crx 2015-09-30 11:03 - 2015-09-30 12:20 - 00000000 ____D C:\Program Files (x86)\9AF0E821-1443625430-E111-8D4D-DC0EA1AA4A46 2015-09-30 03:56 - 2015-09-30 11:29 - 00000000 ____D C:\Windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP 2015-09-30 03:00 - 2015-09-30 03:00 - 00186880 _____ (TODO: ) C:\Windows\system32\rsrcs.dll 2015-09-30 02:44 - 2015-09-30 11:26 - 00000000 _____ C:\autoexec.bat 2015-10-01 03:38 - 2015-03-24 02:27 - 00000390 _____ C:\Windows\Tasks\update-sys.job 2015-09-30 10:45 - 2015-03-25 04:00 - 00925184 _____ C:\Windows\expstart.exe 2015-09-29 23:26 - 2015-04-13 13:20 - 00000000 ____D C:\Program Files (x86)\Coupons 2015-09-07 12:54 - 2015-06-14 23:28 - 00000089 _____ C:\Users\Beckah\Documents\aionmemo_7efe4a4d.dat Task: {25300AC1-BD89-42E3-95CA-9013A4115B81} - \Inst_Rep -> No File <==== ATTENTION Task: {D6246272-C8AE-44C0-ABC6-148EEE95A33B} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2014-11-28] () Task: C:\Windows\Tasks\update-S-1-5-21-3952203236-1806241531-2117749803-1001.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe Task: C:\Windows\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe Reg: reg delete "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" /f Reg: reg delete "HKEY_USERS\S-1-5-21-3016000360-1041427054-1883944200-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" /f Reg: reg add "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" /f Reg: reg add "HKEY_USERS\S-1-5-21-3016000360-1041427054-1883944200-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" /f Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

NEXT

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S0].txt as well.

FINALLY

Start FRST and copy/paste the following into the search box :

browserupdatecheck.in;wpad.dat

Press rearch registry and then post the resultant log

9

All new logs listed. AdwCleaner left me with two .txt logs in the folder, neither with the exact name listed in the above instructional post, so I provided both to be on the safe side.

10

Could you let me know if the alerts cease after this

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: Reg: reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-ee-bd-ac-90-3e" /f Reg: reg delete "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5708C8F7-EE0F-4E01-B28D-6726A396C9CA}" /f Reg: reg delete "HKEY_USERS\S-1-5-21-3952203236-1806241531-2117749803-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-ee-bd-ac-90-3e" /f Reg: reg delete "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-ee-bd-ac-90-3e" /f Reg: reg delete "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5708C8F7-EE0F-4E01-B28D-6726A396C9CA}" /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

11

The blocked infection notification popups seem much less aggressive now. I haven’t had one in hours, keeping my fingers crossed this remains.

Attached new log.

12

You should not see it any more, if all is well tomorrow let me know and I will tidy up

13

Great and thank you so much for your help