Threat has been detected, keeps popping up whilst browsing on firefox

Viruses and worms
1

Hi all,

Could you please help me out with this?

The following popup message keeps occurring:
http://103.1.138.139/www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

With the process svchost.exe being involved.

Many thanks.

2

Nothing visible

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

3

Hi Essexboy,

Many thanks for the quick reply. I accidentally closed the ComboFix log after it opened. Not sure if I should run it again given your warnings above.

Regards.

4

where are you from? I also got that kind of errors by any chance are you from singapore?

5

yes, i happen to be from singapore.

6

The log will be at C:\combofix.txt

7

Hi All,

I am from Singapore too, the addresses belongs to http://xxxx.unknown.m1.com.sg/xx.windowsupdate.microsoft… something like that.

Not sure what is happening, spent last night reformatted my machine, reinstalled Avast and the same exact warning came up.

End up I uninstall Avast and installed Symantec Endpoint Protection, performed a full scan and nothing had been found.

I conclude it is a bug and nothing to worry about at this point of time. Just uninstall Avast and install other AV software and you will be free from this warning.

Thanks for reading.

8

Whitepied,

stop giving such really bad advise.
Removing av (security) software is not solving anything.

It is a:
Park/Disabled Domain
Parked domains may indicate that the domain is suspended or has not been used

9

Hi essexboy, have attached the log.

10

Are any other devices that use your router experiencing the same problem ? As I had one yesterday which was determined to be a router infection

11

Hi Essexboy,

I tried using it on my company laptop with no issues. The company laptop does not have avast installed.

Previously on my own laptop (with avast), I was not able to download malwarebytes without disabling avast. However on my company laptop, I can download malwarebytes with no issues.

Thanks.

12

I believe this to be a false positive and will report to avast

13

Thanks for your help Essexboy.