Web shield reporting a malware - how do I remove it, please?

system · 2015-05-02T08:12:29.000Z

Hello - Avast keeps popping up this message:

URL: http:// blackfight.info/4242/SoftwareForce_142669433509247.dll [space added to prevent hyperlink]
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

I have tried a couple of malware removal tools, but can’t get rid of whatever this is.
Can someone help me, please?

I think you’ll want logs, but I don’t know where to find them.
Thank you.

Asyn · 2015-05-02T08:15:28.000Z

Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253.0

TwinHeadedEagle · 2015-05-02T08:33:46.000Z

Monitoring…

system · 2015-05-02T09:20:05.000Z

Thank you for the guidance - I ran Malbam and it seems to have cleared everything up.

I appreciate your help.

polonus · 2015-05-02T11:19:51.000Z

This is adware and more than likely the Webshield prevented you from ever contacting it:
https://www.virustotal.com/nl/file/d03111e9a2945e370bd91cc17f09c73c0a91f15e72a792e1c35d69ea193da0d1/analysis/

polonus

system · 2015-05-02T12:00:46.000Z

Thank you.
Do you mean that svchost is not infected - rather the popup was just warning about something the browser wanted to show me? Do I need to do anything further? Is there any way to stop the computer from attempting to access this adware?

polonus · 2015-05-02T12:18:49.000Z

When in doubt you can ask for a qualified malware removal specialist (who is monitoring this thread now) to look at the log txts you can attach in a following posting in this thread, see how here: https://forum.avast.com/index.php?topic=53253.0
When eventually cleansed or already clean your best form of protection is to install a decent adblocker extension like uBlock for instance. Also add this extra list for greyware there: http://malwareurls.joxeankoret.com/grayarea.txt (list version updated every day). Know that Google Chrome is in some way compromised at the moment, so look for another second browser to use.

polonus

system · 2015-05-04T22:13:21.000Z

Hello again.
Here are the log files. I hope this is everything.
Thank you for your help.

system · 2015-05-04T22:13:55.000Z

Also this one.

TwinHeadedEagle · 2015-05-05T06:20:23.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

system · 2015-05-05T06:49:18.000Z

I ran the software - it requested a restart, but didn’t request that I do anything after the machine came back up.

I’m attaching the logfile.

Does it look like this is resolved now?

Thank you for your continuing help.

TwinHeadedEagle · 2015-05-05T06:50:17.000Z

How is your PC behaving now?

system · 2015-05-06T18:10:12.000Z

Seems to be better - thank you very much.

Announcements