URL:MAL Process: Explorer.exe

system · 2015-06-27T13:57:32.000Z

Good day,
(Sorry a few post, only realised I needed my own topic on third article I read. Seems like a few people with this issue.)

Web Shield has blocked a harmful webpage or file (numerous times as soon as an internet connection becomes available)
Have scanned the PC with latest definitions, but nothing found. (only installed Avast after I noticed a lot of history in IE, windows defender obviously failed to protect on this… sadly not my PC, mother-in-law’s PC)

I have removed her account form admin groups, is now only a user. I have run FRST (as admin, with admin credentials).
here are the results:

TwinHeadedEagle · 2015-06-27T13:59:28.000Z

Monitoring…

TwinHeadedEagle · 2015-06-27T15:01:39.000Z

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-06-27T17:10:05.000Z

Hi TwinHeadedEagle,

Here is the results of Zoek (see attached)

TwinHeadedEagle · 2015-06-27T18:31:31.000Z

Good. How is the situation now?

system · 2015-06-27T18:50:39.000Z

Hi,
sadly didn’t help, I also see the explorer crashes occasionally after a reboot (while browsing computer).
I looked at some other peoples result files and it seems like zoek didn’t complete (no eof).
I am running it again.

Sadly on previous run, I wasn’t aware that windows was busy installing updates at the same time… added a considerable amount of time to the reboot and is most probably the reason zoek didn’t complete.

currently, if I enable the network connection the web shield continues to report the detection.
just to confirm: I’m currently running everything with the network connection off/not connected.
will this cause a problem (I see the zoek script is doing a ipconfig /flushdns… will that be a problem if no connection is established?)

system has just rebooted after second run, same result shows… no eof specified.

is there anything more I can provide in order to help with your assistance?

thanks in advance again.

TwinHeadedEagle · 2015-06-27T19:43:49.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Make sure that Addition option is checked.
[*]Press Scan button and wait.
[*]The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

system · 2015-06-27T19:59:19.000Z

Hi,
Here are the results.
I know in the guide it says not to do anything else while you help me, but I just wanted to follow up guide as well.
So I have installed mbam, mbae, mcshhecky.ield, unchecky.

I have attached two scan logs from mbam.

let me know if you need anything else.

TwinHeadedEagle · 2015-06-28T08:09:40.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

system · 2015-06-28T10:52:55.000Z

Hi TwinHeadedEagle,

Here is the fix log.
Computer is running a bit better but the threat detection on Web Shield is still popping up frequently.

Is there anything more you can suggest?

TwinHeadedEagle · 2015-06-28T11:56:50.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Make sure that Addition option is checked.
[*]Press Scan button and wait.
[*]The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

system · 2015-06-28T13:22:04.000Z

Here you go.

TwinHeadedEagle · 2015-06-28T14:03:04.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

system · 2015-06-28T15:33:17.000Z

Hi,
Here is the fixlog.

I also ran adwcleaner and reset IE to defaults.
After reboot I re-enabled the adblocker and avast plugin in IE.

So far no alerts (so is a lot better already).
I will do a full sweep of scans now and see if any return anything new and see what happens after a reboot.
will give feedback soonest.

thanks for all your help so far, its really appreciated.

system · 2015-06-28T15:33:53.000Z

oops forgot to attach the log, here it is.

TwinHeadedEagle · 2015-06-28T16:19:09.000Z

PC should be clean after this fix, how is it behaving now?

system · 2015-06-28T17:07:05.000Z

Hi,

Thank you very much for this fix. looks like that solved it.
Have not a popup message, and everything is looking good.

Thanks again.

What do you recommend I should put on this PC to keep it clean? baring in mind the user is not very computer savvy so would like to keep it out of view as much as possible.

Kind Regards.

TwinHeadedEagle · 2015-06-29T07:38:15.000Z

Glad I could help. We will delete all used tools and I’ll give you some tips to harden your security and learn how to protect yourself

Recommended reading:

http://forum.programosy.pl/images/smilies/icon_exclaim.gif
MUST READ - security tips:

[]Computer Security - a short guide to staying safer online.
[]Simple and easy ways to keep your computer safe and secure on the Internet

http://forum.programosy.pl/images/smilies/icon_exclaim.gif
MUST READ - general maintenance:

[*]What to do if your Computer is running slowly?

The Importance of Software Updating:

In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.

Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

[]How to configure and use Automatic Updates in Windows
[]How to update Java
[*]How to update Adobe Reader

Recommended additional software:

http://forum.programosy.pl/images/smilies/icon_arrow.gif
CCleaner - to clean unneeded temporary files.

http://forum.programosy.pl/images/smilies/icon_arrow.gif
Malwarebytes’ Anti-Malware - to scan your system from time to time in search for malware.

http://forum.programosy.pl/images/smilies/icon_arrow.gif
Malwarebytes’ Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

http://forum.programosy.pl/images/smilies/icon_arrow.gif
McShield - to prevent infections spread by removable media.

http://forum.programosy.pl/images/smilies/icon_arrow.gif
Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.

http://forum.programosy.pl/images/smilies/icon_arrow.gif
Adblock - to surf the web without annoying ads!

Post-cleanup procedures:

Download DelFix by Xplode and save it to your desktop.

[*]Run the tool by right click on the
http://www.imgdumper.nl/uploads6/51a5ce45267c1/51a5ce45263de-delfix.png
icon and Run as administrator option.
[*]Make sure that these ones are checked:

[]Remove disinfection tools
[]Purge system restore
[*]Reset system settings

[*]Push Run and wait until the tool completes his work.
All tools we used should be gone. Tool will create an report for you (C:[B]DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Stay safe,
TwinHeadedEagle

system · 2015-07-03T06:08:52.000Z

Thank you once again,

sorry for delayed response was way for the week.
I will run these clean-ups and sort the recommendations over the weekend.

and then also upgrade to the Avast internet security package (just a bit more safety after all).

your assistance on this matter was truly helpful and very much appreciated.

kind regards

Announcements