url/mal problem

Viruses and worms
1

avast keeps popping up saying it has blocked htp://includeit.info/include.js?id need help to get rid of it thanks

2

Could you follow the steps here http://forum.avast.com/index.php?topic=53253.0

And attach the resultant logs in this thread

3

ok here’s the logs you wanted

4

On completion let me know if the alerts cease

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2786678 IE - HKU\S-1-5-21-4208693473-1939342812-3069948533-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredibar.com/mb119?a=6R8nRqSKrj&i=26 IE - HKU\S-1-5-21-4208693473-1939342812-3069948533-1001\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found IE - HKU\S-1-5-21-4208693473-1939342812-3069948533-1001\..\SearchScopes,DefaultScope = {2788227C-96E0-4C94-93F6-6D927AFCCBE6} IE - HKU\S-1-5-21-4208693473-1939342812-3069948533-1001\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2786678 IE - HKU\S-1-5-21-4208693473-1939342812-3069948533-1001\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb119/?search={searchTerms}&loc=IB_DS&a=6R8nRqSKrj&i=26 FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "MyStart Search" FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=" [2012/03/06 02:25:48 | 000,000,000 | ---D | M] (Complitly - Speed up your search with your personal search suggestions tool) -- C:\Users\CrankyGamers\AppData\Roaming\Mozilla\Firefox\Profiles\sapggnec.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516} [2012/05/31 04:51:12 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Users\CrankyGamers\AppData\Roaming\Mozilla\Firefox\Profiles\sapggnec.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} [2011/10/22 14:43:42 | 000,000,863 | -H-- | M] () -- C:\Users\CrankyGamers\AppData\Roaming\Mozilla\Firefox\Profiles\sapggnec.default\searchplugins\conduit.xml [2012/03/25 05:31:02 | 000,002,203 | ---- | M] () -- C:\Users\CrankyGamers\AppData\Roaming\Mozilla\Firefox\Profiles\sapggnec.default\searchplugins\MyStart Search.xml O2:64bit: - BHO: (Complitly) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\CrankyGamers\AppData\Roaming\Complitly\64\Complitly64.dll (SimplyGen) O2 - BHO: (Complitly) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\CrankyGamers\AppData\Roaming\Complitly\Complitly.dll (SimplyGen)

:Files
C:\Users\CrankyGamers\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

5

think it has worked not had any popups here’s the log and thanks for you help

6

Yep it was one of the toolbars either Complity or mystart

If all is well tomorrow let me know and I will tidy up