url:mal popup

Viruses and worms
1

Hello,

For the past week or two the pop up saying ‘avast malicious url has been blocked’ has been popping up numerous times. I’ve tried avast scan and Malwarebytes, but both came up clean.

I followed the steps described in the guide and will be posting the log files here shortly. Your help is much appreciated.

2

Here are the log files:

3

Hi could you screenshot the Avast warning please and post that

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
IE - HKU\S-1-5-21-2659173921-4167008476-1494006285-1000\..\URLSearchHook: {66bd2442-241b-44cd-8c7a-b51037053cdb} - No CLSID value found

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

4

Here is the screen shot:

5

I ran the script you provided, but still getting the pop-up’s. Any idea what else to try?

6

Here is the OTL log file after running your script and reboot:

7

Hmm that is Avast reporting itself… I would like you to do a fresh install of Avast and then see if the popups re-occur

Lets reinstall Avast

Download Uninstall Utility to your Desktop.
Download the correct version of Avast
Avast Free
Avast Pro
Avast Internet Security
Avast Premier
Disconnect from the net
Uninstall Avast via control panel

[]Run aswClear
[]It will offer to reboot to safe mode … Accept that

https://dl.dropbox.com/u/73555776/aswclear.JPG

[*]Once it has rebooted to safe mode
[*]In the Select Product to Uninstall dropdown choose the version of Avast that is on your system.
[*]Press Uninstall
[*]Once complete reboot your system to Normal Mode
[*]Reinstall Avast

8

Uninstalled and re-installed avast as instructed, but I’m still getting the pop-up… and more frequently. I also noticed a new infection – URL:MAL2

9

That is related to tightVNC could you temporarily uninstall it please and see if the alerts cease