Threat detected s.vb3k.com/crossdomain.xml

Viruses and worms
1

I’ve been getting notifications for s.vb3k.com/crossdomain.xml every couple of minutes. Is there a fix for this?

2

They will make a fix for you if you follow instructions here https://forum.avast.com/index.php?topic=53253.0

3

Hi tehuberahsem,

In the meantime and before the qualified removal expert appears here,
read a bit about the backgrounds of this adware and analysis thereof:

http://sethsec.blogspot.nl/2014/07/crossdomain-bing.html (posted by Seth Art)

An example of a valid crossdomain.xml


<?xml version="1.0" ?>
<cross-domain-policy>
  <site-control permitted-cross-domain-policies="master-only"/>
  <allow-access-from domain="*"/>
  <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

A cross-domain policy file is an XML document that grants a web client—such as Adobe Flash Player, Adobe Reader, etc.—permission to handle data across multiple domains - here it seems to go to nasty adware that should be kicked out of your computer under guidance of one of our qualified malware removal experts. The multiple domains here are insecure domains,
you will be redirected to against your will. It has to be properly removed and your browser also needs to be reset.
Produce your logfiles, attach and wait for the qualified remover to assist you.

polonus

4

Alright, here’s the malwarebytes log.

5

Here are the farbar logs

6

Here’s the aswmbr file

7

Could you attach a screenshot of the alert please

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKLM\...\Run: [SMI_SSE_V5] => C:\Windows\SMIKsSTI.EXE [212992 2015-05-15] (Silicon Motion) 2015-04-24 15:53 - 2015-04-24 15:53 - 00000000 _____ () C:\Users\Zac\AppData\Local\{9BFEADCC-9A2F-431C-B5AF-75632CD16559} Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: CMD: netsh advfirewall reset CMD: netsh advfirewall set allprofiles state ON CMD: ipconfig /flushdns CMD: netsh winsock reset catalog CMD: netsh int ip reset c:\resetlog.txt CMD: ipconfig /release CMD: ipconfig /renew CMD: netsh int ipv4 reset CMD: netsh int ipv6 reset EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

8

I don’t have a screenshot of the alert, I restarted my computer and it hasn’t popped up since then. Here’s the fixlog.

Edit: Here’s a screenshot of the alert.

9

Let me know when you are happy and I will tidy up

10

I ran the fixlist but I’m still getting the pop up for the malware.

11

OK that appears to be a corruption for Chrome

Re-install Chrome

  1. If you have bookmarks, let’s save them by exporting them - Export Bookmarks
  2. Then I need you to go Google Sync and sign into your account
  3. Scroll down until you see the “Stop and Clear” button and click on the button. At the prompt click on “Ok”
  4. Now we need to uninstall chrome via control panel.
    Note: When asked about user data or settings you must remove this also so please check the box.
  5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
  6. Import your bookmarks back into Chrome
  7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.
12

That did the trick, thanks for the help!

13

Any further problems ?