URL: MAL pop up

Viruses and worms
1

The pop up says “MALICIOUS URL BLOCKED” and the network shield has blocked the site. When clicking for details, it states:

URL: hxxp://afe.specificclick.net/?l
Process: C:\Program Files (x86)\Google\Chrome\App…
Infection: URL:Mal

This started on either 2/4 or 2/5 and it happens using Chrome as well as Firefox. Running Chrome in incognito mode still produces the warning. The site is hxxp://meetme.com. Neither Avast or MBAM scans are showing any infection on my computer. I have included all the logs that are a prerequisite for taking a look at why this issue is occurring either with my system, browser, and/or the site itself.

I would appreciate any help in getting this issue resolved.

2

malware removers are notified…it may take hours before one arrive so be patient

3

Patience won’t be a problem. Thank you for notifying them Pondus.

4

Hi I am going to delete all of your browser shortcuts so they will need to be replaced. Once done let me know if the alerts still occur

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
[2013/02/08 16:29:42 | 000,002,279 | ---- | M] () -- C:\Users\JR\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/02/08 15:14:10 | 000,002,255 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/02/08 15:07:34 | 000,001,147 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/02/08 14:53:31 | 000,001,254 | ---- | M] () -- C:\Users\JR\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/02/08 15:14:10 | 000,002,279 | ---- | C] () -- C:\Users\JR\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/02/08 15:14:10 | 000,002,255 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

5

Essex, I see no pop up warnings on that site now and I did everything on the site that I normally do when I’m on there. The desktop shortcut icons for Chrome and Firefox did not reappear after reboot. Is that an issue or just something that happens sometimes from time to time? The requested log is attached. It also is occurring on a different computer of mine, but wanted to clear the issue up on this one (primary one used) before attaching logs on the other one.

6

Never mind on the browser shortcuts. Totally went brain dead on reading what was gonna take place. :-[

7

Update…the Avast pop up alert is back. Only this time it’s the site, my e-mail, and even reared it’s head on here. Details:

URL: hxxp://cs.specificclick.net/sync/?bdid
Process: C:\Program Files (x86)\Google\Chrome\App…
Infection: URL:Mal

Which log do you want now?

8

Is it just in chrome now ? I deleted the shortcuts as that is where the redirect hides

You can now recreate them

9

As of this reply it just appears to be happening in Chrome.

10

OK could you run Chrome in Incognito mode and then let me know if they cease

Incognito mode http://support.google.com/chrome/bin/answer.py?hl=en&answer=95464

11

Happening in Incognito mode too.

12

Do you have a chrome shortcut on the desktop or the quicklaunch bar ? If so delete them and try again

13

No shortcut icon or quicklaunch bar.

14

OK unfortunately that means you will have to totally uninstall Chrome and then re-install it

Details are here http://support.google.com/chrome/bin/answer.py?hl=en&answer=111899

15

Uninstall/re-install done. So far, so good. Do I just give it a day or two and see if it happens again? As per it happening on my other computer, do I wait and make sure it’s resolved on this one or go ahead and send you the logs for the other?

16

Well, it didn’t take a day much less an hour. The re-install didn’t work and the pop ups are back. Yes, it’s still Chrome as of this post.

17

No we can proceed with the second system whilst we are waiting to determine if the first is OK

18

The pop ups that occurred about an hour after I uninstalled/re-installed yesterday have not reared their heads today on my 1st computer via Chrome as of yet. Attached are the logs for the 2nd system.

19

Could you delete the desktop, launch bar shortcuts for all browsers please and see if that stops it

20

Deleted them on 2nd computer then checked the site using both Chrome and FF. No pop ups occurred. I may have used the desktop shortcut last night with Chrome on the primary computer when I received the pop ups after the uninstall/re-install, but not sure. Today I have not and the shortcuts have been deleted on the primary as well.