URL:Mal Problem :( Pls help!

system · 2015-04-30T02:52:18.000Z

Hello! Sorry to bother you, just wanted to ask about fixing a malware problem… My Avast antivirus has been popping up everytime and this shows up:

Object: http://
Infection: URL:Mal
Process:C:\Windows\explorer.exe

My malwarebytes also notifies me about this:

Domain:
IP: 93.189.36.168
Port:54654 (changes from time to time)
Type:outbound
Process: C:\ProgramFiles(x8…xplorer\iexplore.exe

Avast also keeps on showing up a window that blocks different websites It’s been showing up like crazy… I really need help… What can I do to fix this??

Thank you for your time!

TwinHeadedEagle · 2015-04-30T04:09:40.000Z

Hello,

https://forum.avast.com/index.php?topic=53253.0

system · 2015-04-30T04:31:14.000Z

Opps… did not see the previous post. Edited mine.

system · 2015-04-30T05:05:25.000Z

I’ve already followed the steps given in the link and attached the logs to my original post. What am I supposed to do next?

system · 2015-04-30T05:18:30.000Z

Await TwinHeadedEagle’s response.

TwinHeadedEagle · 2015-04-30T07:27:16.000Z

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-04-30T10:22:22.000Z

Zoek.exe v5.0.0.0 Updated 05-March-2015
Tool run by Cessy on Thu 04/30/2015 at 17:29:40.86.
Microsoft Windows 8.1 Single Language 6.3.9600 x64
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\Acer v5\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

4/30/2015 5:32:25 PM Zoek.exe System Restore Point Created Succesfully.

==== Empty Folders Check ======================

C:\PROGRA~2\by Decepticon deleted successfully
C:\PROGRA~3\ALM deleted successfully
C:\PROGRA~3\DAEMON Tools Lite deleted successfully
C:\Users\Acer v5\AppData\Roaming\Publish Providers deleted successfully
C:\Users\Acer v5\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-685234282-3914429680-1326349464-1001\Software\Microsoft\Internet Explorer\SearchScopes{2419C614-9889-4300-9CF1-959251FD4648} deleted successfully
HKEY_USERS\S-1-5-21-685234282-3914429680-1326349464-1001\Software\Microsoft\Internet Explorer\SearchScopes{AA9A4890-4262-4441-8977-E2FFCBFB706C} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Batch Command(s) Run By Tool======================

==== Deleting Files \ Folders ======================

C:\PROGRA~2\by Decepticon not found
C:\PROGRA~2\GreenTree Applications deleted
C:\Users\Public\Pokki deleted
C:\PROGRA~3\YTD Video Downloader deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Acer v5\AppData\Local\Google\Chrome\User Data\Default\Extensions\WebNavigation.crx deleted
C:\Users\Default\AppData\Local\Pokki deleted
C:\Users\UpdatusUser\AppData\Local\Pokki deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD Video Downloader deleted
C:\Users\Acer v5\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk deleted
C:\windows\SysNative\Tasks\avast! Emergency Update deleted
C:\windows\SysNative\Tasks\avastBCLRestartS-1-5-21-685234282-3914429680-1326349464-1001 deleted
C:\windows\SysNative{86F549EB-A66B-4D6C-958D-CDDD66410751}.bat deleted
C:\windows\SysNative{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat deleted
C:\windows\SysNative{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Users\Public\Desktop\YTD Video Downloader.lnk deleted
“C:\Windows\Installer\1dcc1.msi” deleted
“C:\Windows\Installer\2a912.msi” deleted
“C:\Users\Acer v5\AppData\Local\Pokki\analytics.db” not deleted
“C:\Users\Acer v5\AppData\Local\Pokki\engine_update.db” not deleted
“C:\Users\Acer v5\AppData\Local\Pokki\Engine\HostAppServiceUpdater.exe” deleted
“C:\PROGRA~2\Windows Multimedia Platform” deleted
“C:\Users\Acer v5\AppData\Local\Pokki” not deleted
“C:\Users\Acer v5\AppData\Local\Pokki\Engine” not deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
“wrc@avast.com”=“C:\Program Files\AVAST Software\Avast\WebRep\FF” [04/14/2015 01:38 PM]

==== Chromium Look ======================

Google Chrome Version: 42.0.2311.90 (Could not determine latest Stable Version)

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
eofcbnmajmjmplflapaojjnihcjkigck - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx[03/30/2015 12:05 PM]
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[03/30/2015 12:05 PM]
lkemddiljapcmhicklfpcbpfffahfbja - C:\Users\Acer v5\AppData\Local\Google\Chrome\User Data\Default\extensions\WebNavigation.crx

Save to 4shared - Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Extensions\adnkagodbfngmdajbbocegjnllfmdaie
Share page - Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Extensions\bkhijcklkbgkoobjhjmbcmphbdfidkkn
Citrio Affiliate - Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Extensions\bkjdagbbhdibfiadcejioabmnehcchhj
DownloadThemAll - Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Extensions\cmgnknielaidclddbbjlhnhogdmhjnni
Citrio Extensions - Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Extensions\dcagnhpbnggmbihndfkkhfjojgbaaedo
MediaPlayer - Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Extensions\hjinflocgjpjihbgdlipilmjlbkjkmak
Proxy - Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Extensions\hpofinfdicogoakggciidggcikhgklcj
Video Downloader - Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Extensions\jplekbkiffioflngbcckmjgofkjlojno
Avast Online Security - Acer v5\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
Chrome Hotword Shared Module - Acer v5\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg

==== Chromium Fix ======================

C:\Users\Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Extensions\jplekbkiffioflngbcckmjgofkjlojno deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Start Page”=“http://www.linkzb.com”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
“Start Page”=“http://www.linkzb.com”
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
“Start Page”=“http://www.linkzb.com”
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
“DefaultScope”=“{88C67523-8C35-4D0F-9D3F-5CE279857E77}”

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Start Page”=“http://www.linkzb.com”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
“Start Page”=“http://go.microsoft.com/fwlink/?LinkId=69157”
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
“Start Page”=“http://go.microsoft.com/fwlink/?LinkId=69157”
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
“DefaultScope”=“{012E1000-F331-11DB-8314-0800200C9A66}”

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url=“http://www.google.com/search?q={searchTerms}”
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url=“http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC”
{88C67523-8C35-4D0F-9D3F-5CE279857E77} Unknown Url=“Not_Found”

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-685234282-3914429680-1326349464-1001\Software\Microsoft\Internet Explorer\SearchScopes{88C67523-8C35-4D0F-9D3F-5CE279857E77} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\203E62EEA6789D84098513925E9B9999 deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\02F6486B12843E11F869800002C0A966 deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\lkemddiljapcmhicklfpcbpfffahfbja deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall{EE26E302-876A-48D9-9058-3129E5B99999} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall{B6846F20-4821-11E3-8F96-0800200C9A66} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\203E62EEA6789D84098513925E9B9999 deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\02F6486B12843E11F869800002C0A966 deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Acer v5\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Acer v5\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Acer v5\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Acer v5\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Acer v5\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Cache emptied successfully
C:\Users\Acer v5\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=9512 folders=225 536287457 bytes)

==== Empty Temp Folders ======================

C:\Users\Acer v5\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\UpdatusUser\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\ACERV5~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

“C:\Users\Acer v5\AppData\Local\Pokki\analytics.db” not found
“C:\Users\Acer v5\AppData\Local\Pokki\engine_update.db” not found
“C:\Users\Acer v5\AppData\Local\Pokki” not found

==== EOF on Thu 04/30/2015 at 18:17:15.43 ======================

TwinHeadedEagle · 2015-04-30T12:48:05.000Z

How is your PC behaving now?

system · 2015-04-30T14:27:13.000Z

Still the same :(((

TwinHeadedEagle · 2015-05-01T08:19:26.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Make sure that Addition option is checked.
[*]Press Scan button and wait.
[*]The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

Announcements