Threat has been detected alert - toolbarservice.freecause.com

Viruses and worms
1

Hi there,

Sorry to start another thread so soon after the AOl one, but I’ve got a new thing popping the alert now…I guess that a new round of updates is kicking in! LOL

This times it’s toolbarservice.freecause.com:

Infection Details
URL: http://toolbarservice.freecause.com/2.6/…
Process: C:\Program Files\Mozilla Firefox\firefox…
Infection: URL:Mal

My understanding is that freecause is linked to the Nectar toolbar, which I have. I’ve had it ages though, and this is the first time it’s started popping the alert. I’ve been getting it constantly today. Everytime I visit a new page, the alert pops, I’m guessing that would tie in with the nectar tool bar trying to work on every page visited? (It checks to see if you can collect points on any website you visit).

That’s my guess. Although, that doesn’t mean it’s necessarily a good thing, right? Just wanted to check if this was a threat and should remove the nectar toolbar or if anyone knows that actually it’s not the nectar toolbar but something else.

Sorry for the second thread…but thanks for your time!

2

I have been having the same problem as of today. I am seeing this pop-up whenever I open a new window in Firefox. I do not have the Nectar toolbar that you mentioned though, so I would not say that Nectar is causing this.

3

See this topic on the same alert, http://forum.avast.com/index.php?topic=107620.0.

4

Hi,

Thanks for that. I’ve read through the thread, but I’m still a bit unsure if this is a false negative or something not so good LOL Did I mention I’ve not a techy bone in my body :wink:

5

You’re welcome.

It looks like there was something there, which may have been cleaned, but the block still exists until a review by avast is completed.

6

Hello,

Thanks for clearing that up!

Interestingly though, I’ve got annoyed with it, so decided to remove the toolbar. I did it through the control panel, but I’m still getting the popup each time I load a page, so it obviously didn’t completely uninstall it :frowning:

7

try this…run the first program in this guide, AdwCleaner a special tool for browser / toolbar crap

http://forum.avast.com/index.php?topic=53253.0

attach the log here

8

Thanks, attached!

9

did it help ?

10

Ok, now I’m really confused. I read the suggested thread and see that lots of folks with the Nectar toolbar are having the same problem I’m having. However I don’t have the Nectar toolbar and have never even heard of it until today. I also ran the Malware scan and it did not find anything. Really concerned now why I’m also getting these freecause pop-ups. :-\

11

Sort of worked…

I don’t get the alerts everytime I load a page now, however I still get one whenever I first open Firefox. New log attached if that’s useful.

12

in the same guide i gave you…scroll down to OTL
run that and attach the OTL log…then Essexboy will remove any leftovers…if any

13

Hi,

I ran the scan, (used the commands under the link on that page in the custom scan bit). It saved one log which is attached. I haven’t click run fix, or clean up or anything yet. Wasn’t sure if I was meant to do that or just post the log up…

14

you cant fix anything before Essexboy have created a fix script… wait and see

15

Thanks!

16

You do have the Nectar toolbar addon… Lets remove it
Let me know if this stops the alerts

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
FF - prefs.js..extensions.enabledAddons: {841468a1-d7f4-4bd3-84e6-bb0f13a06c64}:1.300.430
FF - prefs.js..extensions.enabledItems: {841468a1-d7f4-4bd3-84e6-bb0f13a06c64}:1.300.405
[2011/07/09 17:45:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Katherine\AppData\Roaming\Mozilla\Extensions\celtx@celtx.com
[2012/09/14 22:16:15 | 000,554,024 | ---- | M] () (No name found) -- C:\Users\Katherine\AppData\Roaming\Mozilla\Firefox\Profiles\67nrzbm2.default\extensions\{841468a1-d7f4-4bd3-84e6-bb0f13a06c64}.xpi
O4 - HKU\S-1-5-21-593423473-182427553-3595481273-1000..\Run: [Akamai NetSession Interface] C:\Users\Katherine\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

17

Hi there,

Thanks, that’s stopped the alert popups!

I’ve attached the log just in case though, one file failed to move, but I have no idea if that’s okay or not LOL But I’m guessing it’s cool because avast alerts aren’t going mad LOL

18

if essexboy does not come back online now… then check back tomorrow

19

The file not moved is OK as it belongs to Avast ;D

Any further problems ?

20

Nope, all is good now, thanks! I just figured that 50p worth of nectar points a month just wasn’t worth the hassle! Thanks for that, it always amazes me how these things seem to dig their claws in and don’t want to let go! Thanks for all your help!