Threat Has Been Detected Message every 2 minutes even when not online.

Viruses and worms
1

I’m going insane here.

There is a “Harmfull Webpage” that keeps causing my Avast to pop up tell me that its been detected but thats it.
Theres nothing I can seem to do to make it go away or stop. It pops up even when I am not on the internet.

I’ve attached a photo of the alert. Its almost always the same url listed also.
How do I make this go away/fix this?

2

Hi,

Please download DDS and save it to your Desktop from here:
http://www.bleepingcomputer.com/download/dds/dl/104/

Double click to run the tool, click the Start button.

  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt

Save both reports to your desktop. DDS.txt and Attach.txt attach back to topic.

3

I think I did it right. I apologize if not. I am not familiar with this sort of process.

4

and here is the other one.

5

Hi,

Yes, you did it right. As first step you need to uninstall bad PUP software. We usual call them as adware or toolbar but they are actually just a bad PUP (Potentially Unwanted Programs).

Start > Control Panel > Programs and Features:
You need to remove/uninstall the following:

  • Codec
  • Codec-V

Then …

Please download zoek.zip or zoek.rar by smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive…

[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

createsrpoint; 
emptyfolderscheck;
Codec;u
Codec-V;u
emptyclsid;
{02478D38-C3F9-4efb-9B51-7695ECA05670};c
{0F1E7C29-A870-2894-EA0A-AD2664469EFF};c
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D};c
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324};c
StandardSearch; 
installer-list;
uninstall-list;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

6

The Zoek.exe will not open. I’m getting nothing…

7

never mind it finally worked after 20 some times headdesk

8

Here are the results.

9

What comes next?

10

Hi,

The Zoek.exe will not open. I'm getting nothing...
As instructions say, when you run zoek (by duble-clicking) whati while zoek doesn't start by itself.

=> Re-run zoek as you did before…

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

emptyclsid;
{2fa28606-de77-4029-af96-b231e3b8f827};c
resetIEproxy;
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows];r
"AppInit_DLLs"=-;r
c:\\progra~2\\vaudix\\sprote~1.dll;f
shortcutfix;
C:\Windows\tasks\CodecUpdaterTask{3F6836BF-ED4E-4F35-B634-EF147E435FAA}.job;f
"C:\Windows\SysNative\tasks\VaudiXUpdaterTask{3EF343AA-5B1F-4745-A9A0-061DE9A31BBC};f
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2577913014-2069844850-950587733-1001UA.job;f
C:\Windows\SysNative\tasks\CodecUpdaterTask{3F6836BF-ED4E-4F35-B634-EF147E435FAA};f
C:\Windows\tasks\VaudiXUpdaterTask{3EF343AA-5B1F-4745-A9A0-061DE9A31BBC}.job;f
emptyfolderscheck;delete 
C:\ProgramData\Premium\VaudiX;fs
C:\ProgramData\Premium\Codec\Codec.exe;f
C:\Users\MaryxJane69\AppData\Local\Codec-V;fs
C:\ProgramData\Vaudix\ahfkbbmncbapjcdihlalcpkkcbgebmci.crx;f
chrdefaults;
ahfkbbmncbapjcdihlalcpkkcbgebmci;chr
jpnbdefcbnoefmmcpelplabbkfmfhlho;chr
ipconfig /flushdns >> %temp%\log.txt;b
autoclean;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

11

Yes, I got it to work after a long while. I posted the results.
Is that it? It seems to be happening a lot less now.

12

Little I can say without logs …