Skegnessasc Malware. Help!

Viruses and worms
1

Hi there,

Throughout today I have been receiving alerts from avast that it has blocked the threat skegnessasc.org. I have run a full system scan and also run a Malwarebytes scan, both have come back with nothing. I hope someone here can help!

Attached are the logs as per the pinned topic.

2

Can you make screenshot of Avast message?

3

This is the avast popup.

4

This will restart your system so save your work before this.

  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
RemoveProxy:
cmd: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SearchList /d "" /f
Reboot:
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
5

I have done that, here is the log. Thanks for your help

6

Does Avast still shows alerts for Skegnessasc?

7

It does, yes

8
  • Run FRST
  • Paste following text in text box
skegnessasc.org
  • Click on Search registry
  • Attach Search.txt to your message
9

Here is the log, doesn’t show anything though

10
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
Hosts:
cmd: bitsadmin /RESET /ALLUSERS
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
11

Here is the log. Thanks again for your help. What shall I do now?

12

Are you still getting popups for blocked URLs?

13

Hello

I was still getting popups, but since restarting I have not seen any. Should it be gone now? I was never able to pick it up on scans so it is hard to tell. Thanks for your help!

14

Yup, it is gone now.

• Sledeća procedura će implementirati završno čišćenje.

:arrow: Preuzmi “Xplode”-ov DelFix alat i snimi ga na Desktop.
Dvoklikom pokreni alat i štikliraj kućice ispred sledećih opcija;

[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore[/i]

Klikni na dugme Run i pričekaj trenutak dok alat ne završi svoj rad.
Od ovog trenutka, svi korišćeni alati u ovoj temi bi trebali biti obrisani.
Alat će takođe formirati izveštaj za tebe. (C:[b]DelFix.txt[/b])

Alat će snimiti i zdravo stanje registy-ja i napraviti backup koristeci integrisan program “ERUNT” u %windir%\ERUNT\DelFix
Alat briše stare system restore tačke i pravi novu, svežu tačku nakon čišćenja.