Problem with "URL:MAL" (one more!)

system · 2015-07-14T20:02:36.000Z

Hello everyone,

First, sorry for some possible mistakes in my English.
I think quite a lot of people had the same problem than me. Nearly every 5min I have several alert messages from avast : “an infection has been blocked”, and different links, for example :

URL : http://opticguardzip.net/4141/ReactorTurbo_142667302564216.dll
Infection : URL:Mal
Processus : C:\Windows\System32\svchost.exe

URL : http://alwaysisobar.com/4141/AppendRunner_142669424824243.dll
Infection : URL:Mal
Processus : C:\Windows\System32\svchost.exe

It starts to be really annoying, and as I am not good at all with computers (I understand nothing to how it works…), I am asking for some help to solve this problem.

Thank you in advance for your answers,

Camille

Pondus · 2015-07-14T20:07:53.000Z

Follow instructions here https://forum.avast.com/index.php?topic=53253.0
Attach malwarebytes and farbar recovery scan tool logs. … 3 logs total

Any questions, just ask

dbrisendine · 2015-07-15T05:04:51.000Z

I or others will help you; the requested logs will help ensure that all the malware is handled. Thanks.

system · 2015-07-15T17:34:27.000Z

Thank you for your fast answers and your help.

Here are the different files you asked for. I still had some alert messages from Avast after using Malwarebytes.

dbrisendine · 2015-07-15T23:46:07.000Z

Open notepad by pressing the Windows Key + R Key, typing in Notepad in the Run dialog and then pressing Enter. Please copy the contents of the Code box below. To do this highlight the contents of the box and right click on it and select copy (or you can just click on the (select) next to Code Box). Paste this into the open notepad. Save it to your desktop as fixlist.txt


Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Camille\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
C:\Users\Camille\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg
U4 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]
2015-06-20 21:03 - 2015-06-21 00:07 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-06-20 21:03 - 2015-06-20 21:03 - 00000000 ____D C:\Program Files (x86)\7cbdeaa8-e450-4080-8a13-bdcbebafcb60
2015-06-20 20:46 - 2015-07-13 12:45 - 00000000 ____D C:\Users\Camille\AppData\Roaming\8D1DA144-1434825977-884F-996E-76E5EF6334E5
2015-06-20 21:05 - 2015-04-01 20:22 - 00000000 __SHD C:\Users\Camille\AppData\Local\EmieBrowserModeList
2015-06-20 21:05 - 2015-01-28 21:08 - 00000000 __SHD C:\Users\Camille\AppData\Local\EmieUserList
2015-06-20 21:05 - 2015-01-28 21:08 - 00000000 __SHD C:\Users\Camille\AppData\Local\EmieSiteList
C:\Users\Camille\AppData\Local\Temp\McCSPInstall.dll
C:\Users\Camille\AppData\Local\Temp\mccspuninstall.exe
C:\Users\Camille\AppData\Local\Temp\MouseKeyboardCenterx64_1036.exe
C:\Users\Camille\AppData\Local\Temp\Quarantine.exe
C:\Users\Camille\AppData\Local\Temp\sqlite3.dll
C:\Users\Camille\AppData\Local\Temp\Uninstall.exe
C:\ProgramData\RefreshReg.vbs
2014-10-23 22:57 - 2014-10-23 22:57 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It’s important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 by right clicking on the FRST64.exe file, selecting “Run as Administrator…”. The User Account Control may open up; if it does, select Yes to continue to let FRST open and load.

The tool will check for an updated version of itself every time it loads; please allow it to do this and the program will either inform you it is downloading an updated copy (and to wait until it is safe to continue) or show nothing (meaning there is no update found) and you can continue on. Press the Fix button just once and wait. The tool will create a restore point, process the script and ask for a restart of your system.

http://i1351.photobucket.com/albums/p785/dbreeze2/just%20stuff/Press%20the%20FIX%20button_zpsdd5zi3mt.png

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply. Also, tell me how your system is running now.

system · 2015-07-16T16:10:30.000Z

Thanks a lot for your help, here is the fixlog.txt doc
For now I don’t have any alert message.

dbrisendine · 2015-07-16T23:32:31.000Z

Other than the alert message, how is your system running now?

system · 2015-07-17T17:07:37.000Z

My computer was quite slow when I had the alert messages, and looks to run “normally” now. I think the problem is solved, thank you a lot

dbrisendine · 2015-07-17T19:31:17.000Z

If you are happy, let’s remove the tools and off you go …

Clean up of Malware Removal Tools
Now that we are through using these tools, let’s clean them off your system so that should you ever need to have malware removed again (we hope not) fresh, updated copies will be downloaded.

Download Delfix from here to your desktop and double click it to start the program
- Ensure Remove disinfection tools is ticked
  Also tick:
- Activate UAC
- Create registry backup
- Purge system restore
- Reset system settings

http://i1351.photobucket.com/albums/p785/dbreeze2/just%20stuff/DelFixSelectall_zps0f04cec4.png

Click Run
- The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply.
  You can delete any log files left on your desktop as these are no longer needed.

system · 2015-07-19T17:31:18.000Z

Here is the last document after using Delfix.
Is it useful to use softwares like “adw cleaner” or “malwarebytes” as prevention, just to check regularly if everything is fine ?

Pondus · 2015-07-19T17:55:40.000Z

Is it useful to use softwares like "adw cleaner" or "malwarebytes" as prevention, just to check regularly if everything is fine ?

Yes ;)

and if you use removable storage media that you move from computer to computer also add MCShield (free) http://www.mcshield.net

Announcements