something keeps trying to access go.wvydeo.com/xxx ... xxx

Viruses and worms
1

Ive scanned with everything under the sun for a week and can not find anything. Ive system restored and still I hear DING DING DING.
Can someone save my sanity?

2

follow instructions and attach requested logs https://forum.avast.com/index.php?topic=53253.0

3

Malwarebytes Log attached

4

FRST log attached

5

aswMBR log attached

6

Now I’m also getting http://sitestatistic.net/www/delivery blocked over and over and over…
They are both trying to access regsvr32.exe

7

The human eye is better than any automated programme :slight_smile:

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKLM-x32\...\Run: [] => [X] HKU\S-1-5-21-875269125-2373890352-835586103-1001\...\Run: [YhzlPack] => C:\Windows\SysWOW64\regsvr32.exe "C:\Users\Joe Lotts\AppData\Local\Esxtion\EzdrvFactory.dll" ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => No File C:\Users\Joe Lotts\AppData\Local\Esxtion Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that