system
February 13, 2015, 12:46pm
1
hello i’ve been getting random pop up from avast web shield every 1min.
url: http://103.1.138.141/ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/ …
infection: url:MAL
process: C:\Windows\System32\svchost.exe
i have run a full scan and ran malware bytes on the system and everything seems to be ok
also when i tried to install malwarebytes, it gave me the pop up as well
URL: http://103.1.138.141/data-cdn.mbamupdates.com/v2/mbam/consumer/data/mbam-setup-2.0.4.1028.exe
infection: url:mal
process : c:\windows\system32\svchost.exe
please help i will be on this forum waiting for replies ty
–
Before I posted on this thread, i went ahad and used malware bytes to try to fix it my own and it caught 3 viruses ( the one i included in the attached is the latest one with no viruses )
-
-
-
-
-
-
Pondus
February 13, 2015, 12:58pm
2
for help, we need you to attach some logs
Logs to assist in cleaning malware https://forum.avast.com/index.php?topic=53253.0
system
February 13, 2015, 1:21pm
3
I have included the files
Pondus
February 13, 2015, 1:38pm
4
the normal thing is to add logs in next reply, and not previous post … as we look for a new reply with logs
you dont have to redo it … now you wait for a malware expert, it may take some hours before they are online
The address is for mobile1 in Singapore https://www.whoisthisip.com/ipwhois/103.1.138.141
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
2015-02-07 00:42 - 2015-02-07 00:42 - 00000000 __SHD () C:\Users\Owner\AppData\Local\EmieUserList
2015-02-07 00:42 - 2015-02-07 00:42 - 00000000 __SHD () C:\Users\Owner\AppData\Local\EmieSiteList
2015-02-07 00:42 - 2015-02-07 00:42 - 00000000 __SHD () C:\Users\Owner\AppData\Local\EmieBrowserModeList
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt , in the same location as FRST.exe
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Run FRST and press Fix
Are you still getting the alerts ?
Download and Install Combofix
Download ComboFix from one of the following locations:Link 1 Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
IMPORTANT - Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
Notes:
Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
system
February 13, 2015, 5:22pm
10
Attached combofix.txt
So far nothing has popped up yet but when I still try to download malware bytes it leads me to that IP website again
OK that sounds like a DNS problem
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
c:\users\Owner\AppData\Local\EmieUserList
c:\users\Owner\AppData\Local\EmieSiteList
c:\users\Owner\AppData\Local\EmieBrowserModeList
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt , in the same location as FRST.exe
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Run FRST and press Fix
system
February 13, 2015, 7:55pm
12
Here is the attached after trying to download malware bytes it still leads me to this websitehttp://103.1.138.141/data-cdn.mbamupdates.com/v2/mbam/consumer/data/mbam-setup-2.0.4.1028.exe
and then avast blocks it at usual saying it’s URL:MAL
Are you using other computers on this router ? Do they have the same problem
system
February 13, 2015, 8:05pm
14
Wait I tried to use my IPHONE to go to that website and it redirected me to that 103.x.x.x IP address (phone is using router’s wifi)
OK it sounds like a router infection… Do you know how to reset the router ?
system
February 13, 2015, 8:33pm
16
I will try to reset it tomorrow and update you asap
system
February 14, 2015, 5:45am
17
@essexboy
First of all, thanks for the help rendered. I too have the same problem. Using M1 operator as my internet provider. I have use your “ComboFix” and the pop-up greatly reduced but once awhile it did pop up. Not too frequent to make me frustrated. Too bad i can’t attached the log file that being generated by Combofix as it didn’t generate any in my case. Maybe due to my Comodo firewall setting to let user decide whether a certain software allow to access the web or explorer. i haven’t reset my router (Asus router) though bacause i lazy to set back up again and i have many setting on it. Anyway, where can i download your FRST64 program?
Once again thanks for the help rendered.
Arzme
@ hoji7620 plaeses start a new topic and follow this guide and attach the needed logs. From there essexboy or someone else of our many malware expert here on the forum will help you out.
https://forum.avast.com/index.php?topic=53253.0
system
February 14, 2015, 9:46am
19
i have reset the router and i still get the popup messages for svchost.exe and blocked from downloading malwarebytes from the vendor website
Out of curiosity how did you reset the router, did you press the very small reset button on the router or just turn it on and off
