Web browsers infected

Viruses and worms
1

My browsers (Google chrome and Mozilla Firefox) seem to be infected.

Random pornographic images show up when I visit sites like youtube.com.(Print screen attached)

But this is not so if I surf in incognito mode.(see pics)

Also once instead of porn one of the pics showed “songs.pk”, “pornvilla.net” banner.

I have never visited these sites. The weird part is, when i tried my roommates laptop the same thing happened.(we share the same internet connection over wifi)

please help me out! i have to make an urgent online payment but not feeling safe to do it.

2

Please attach your logs. (AdwCleaner, MBAM, OTL and aswMBR…!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0

3

Here is the adw report

4

MBAM LOG

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.02.20.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
admin :: ADMIN-HP [administrator]

20-02-2013 18:40:53
mbam-log-2013-02-20 (18-40-53).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 229173
Time elapsed: 6 minute(s), 44 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\admin\AppData\Local\Temp\7zO2F2E.tmp\civ5DX9 custom trainer improved.exe (HackTool.GamesCheat.Gen) → Quarantined and deleted successfully.

(end)

5

Here are the otl reports

6

aswMBR report attached.

Please help!

7

Could you confirm that this is only in Chrome

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
O3 - HKU\S-1-5-21-1827441168-2922822399-3576354668-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

8

No its not chrome-centric…firefox is just behaving funny… Will run the fix and upload the log soon…