Avast keeps on blocking a bad url from webgetclick.com and I have no idea how to get rid of it.
Anyone who can help me?
Avast keeps on blocking a bad url from webgetclick.com and I have no idea how to get rid of it.
Anyone who can help me?
Hi I need to dive right in with the big hammer on this one
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.
Notes:
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
The scanning took me quite some time and I didn’t expect an answer this quick (thanks for that!)
I will run Combofix tomorrow and post the log here
No problem I usually arrive at about 7:30 GMT
I started running ComboFix, did not mouse click it, but turned back to this forum to check on the next steps.
After this the ComboFix screen did not appear anymore.
Searching for ComboFix.txt on my computer does not give any results.
How should I proceed?
btw I have not encountered the original problem frequently since starting up today.
That is only 2 or 3 times instead of once every 2 or 3 minutes.
Could you try combofix from safe mode please and let me know the outcome
Here the report from combofix out of the safe mode
OK next question, do the redirects appear in Firefox, IE or both ?
Hello… I am also having this same problem… I can tell you it involves Internet Explorer as it is currently the only browser on the computer… Is this a new virus or worm? My Avast is popping up even when I don’t have the browser open, I am guessing it is because I am still connected to the internet… Any help you can give me would be soooo appreciated
They appear in IE essexboy. I didn’t use Firefox for quite a while
Hmm this is something new - so we may have to do some digging around
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL IE - HKU\S-1-5-21-2419282362-3302599347-3895743432-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 O3 - HKU\S-1-5-21-2419282362-3302599347-3895743432-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\S-1-5-21-2419282362-3302599347-3895743432-1000\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.:Files
ipconfig /flushdns /c:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
THEN
Download the latest version of TDSSKiller from here and save it to your Desktop.
[*]Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_1.jpg
[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_2.jpg
[*]Click the Start Scan button.
http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_3.jpg
[*]If a suspicious object is detected, the default action will be Skip, click on Continue.
http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_4.jpg
[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_5.jpg
[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of “TDSSKiller.[Version][Date][Time]_log.txt”. Please copy and paste its contents on your next reply.
Here the 2 reports (the extra.txt did not change).
Avast intervened when running Kaspersky. Is this ok?
Edit: OTL.txt will follow in seperate post due to max total size
OTL.txt
While I look at the OTL log
Please re-run TDSSKiller and when this part is shown select delete
\Device\Harddisk0\DR0 ( TDSS File System )
Done that
Could you confirm that the alerts have now ceased
Until now, yes…
Does this mean we’re almost there?
Yep ;D
I will need to get back to my windows 7 system to give the cleanup instructions - so watch this space
Ok, superb!!!
I will certainly watch this space for the cleanup instructions