please help site blocked pop ups

Viruses and worms
1

hi my boyfriend has just moved in and after having to reformat his pc i put avast on it and it was running fine he downloaded a load of stuff andc added some randomn toolbars to firefox iv uninstalled and removed all harmfull downloads but i keep gettin a malicious url blocked pop up every ten minutes or so with a couple of addresses how dio i stop this as i run an internet radio and need to not have pop ups pingin up lol iv put parental settins on pc now so the downloads are limited x

2

also firefox keeps redirecting and coming up with harmfull site do not continue xx

3

Try this

Malwarebytes Anti-Malware 1.46 http://filehippo.com/download_malwarebytes_anti_malware/
always update the program before you scan
click the remove selected button to quarantine anything found
please post the scan log here

4

thank u for replyin iv gt malware bytes it removed a load of stuff mp3 tube seemed to be main culpret it wont lwet me put the log on jhere says its too big? x

5
it wont lwet me put the log on jhere says its too big? x
Lower left corner > additional options > attach
6

think thats it thank you for ur help xx

7

This was done 4 days ago, so update Malwarebytes do a new scan and post a new log

your log say NO ACTION TAKEN so you need to click the remove selected button after the scan to quarantine the infections

8

ok am scanning now xx

9

did the remove selected after the last scan new scan log is here it says clear but am still gettin poop up constantly x

10

OK i will leave you with Essexboy and his magic tools :wink:

11

sounds intereting lol :wink: hehe x

12

and where is essex boy?

13

He is here, lurking around ;D

14

Lurk lurk ;D

Hi dere first we will see what you have

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]Select All Users
[*]Under the Custom Scan box paste this in

[b]netsvcs
%SYSTEMDRIVE%*.exe
/md5start
explorer.exe
winlogon.exe
/md5stop
%systemroot%*. /mp /s
CREATERESTOREPOINT

[/b]

[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

15

here is the scan results

16

He does have some rather iffy stuff there

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.) FF - prefs.js..browser.search.defaultengine: "Yahoo-Mp3Tube" FF - prefs.js..browser.search.defaultenginename: "Yahoo-Mp3Tube" FF - prefs.js..browser.search.defaultthis.engineName: "NCH Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2117678&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Yahoo-Mp3Tube" FF - prefs.js..browser.search.selectedEngineURL: "http://mp3tubetoolbarsearch.com/?tmp=toolbar_Mp3Tube_results&prt=pinballtb01ff&clid=593abb94bff3498c89d727275505abb0&subid=&Keywords={searchTerms}" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..keyword.URL: "http://mp3tubetoolbarsearch.com/?prt=pinballtb02ff&Keywords=" [2010/11/20 14:48:46 | 000,002,612 | ---- | M] () -- C:\Documents and Settings\taz\Application Data\Mozilla\Firefox\Profiles\n9x7ozra.default\searchplugins\kickasstorrents.xml [2010/11/22 15:33:46 | 000,001,215 | ---- | M] () -- C:\Documents and Settings\taz\Application Data\Mozilla\Firefox\Profiles\n9x7ozra.default\searchplugins\Mp3Tube.xml [2010/11/13 09:29:07 | 000,000,888 | ---- | M] () -- C:\Documents and Settings\taz\Application Data\Mozilla\Firefox\Profiles\n9x7ozra.default\searchplugins\torrentsto.xml [2010/11/26 13:51:16 | 000,001,196 | ---- | M] () -- C:\Documents and Settings\taz\Application Data\Mozilla\Firefox\Profiles\n9x7ozra.default\searchplugins\winamp-search.xml O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.) O4 - HKCU..\Run: [Raptr] C:\PROGRA~1\Raptr\raptrstub.exe File not found [2010/11/27 00:23:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\eSellerate [2010/11/20 08:34:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\taz\Desktop\Lesbian.B.F.Fs.XXX.DVDRip.XviD-CLiT [2010/11/19 00:13:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\taz\Application Data\Kyvo [2010/11/13 08:17:18 | 000,000,000 | ---D | C] -- C:\Program Files\ConduitEngine [2010/11/13 08:17:17 | 000,000,000 | ---D | C] -- C:\Program Files\Vuze [2010/11/13 08:17:08 | 000,000,000 | ---D | C] -- C:\Program Files\Vuze_Remote [2010/11/27 08:11:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\taz\Application Data\Kyvo

:Files
ipconfig /flushdns /c
C:\PROGRA~1\Raptr

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

[*]Double click on ComboFix.exe & follow the prompts.

[*]As part of it’s process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it’s strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

[*]Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it’s malware removal procedures.

http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

http://img.photobucket.com/albums/v706/ried7/whatnext.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

17

ok here the log

18

it says its a trojen wen i download it x

19

ok done

20

I have just submitted it as a false positive to Avast