What is this? Shows up almoust every site I go

Please help me with this. Avast warns me almoust every site I go.

Hi JanneH,

Likely Avast! is blocking malware on your system.

Is it only in Google Chrome this shows?

Please visit http://forum.avast.com/index.php?topic=53253.0, run Malwarebytes, OTL, and aswMBR only, and attach all logs produced in your next reply.

A malware specialist will be along shortly to assist you. Please do not make any further changes to your system unless told to do so.

yes only crome shows this message.

I suggest you run the three programs listed above and attach the logs so that we can get going and fix your problem.

Thank you for attaching the screenshot.

first log file

JanneH,

essexboy has been notified.

Thanks to the wonders of Google Translate, log is understandable.

OTL, and aswMBR.exe need to be run, but as diagnostic tools only, same as with Malwarebytes. Essexboy will come along soon, and craft a fix or two just for your system based on the logs you attach here.

MBAM log

OTL and Extras. If you have problem with language in earlier logfile, feel free to ask my help :slight_smile:

and the last log file aswMBR

On completion of this can you let me know if the alerts cease

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from “Start with Windows”
Reboot and then run OTL

http://i1224.photobucket.com/albums/ee362/Essexboy3/mbamstop.jpg

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL IE - HKLM\..\SearchScopes\{C1CF7F2B-BAD6-47FD-B3C5-648322173D57}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=e68ce693-0fc4-11e1-a8d0-001a9f92c52a&q={searchTerms} IE - HKLM\..\SearchScopes,DefaultScope = {56256A51-B582-467e-B8D4-7786EDA79AE0} IE - HKU\S-1-5-21-2011540971-2591290903-1419152939-1003\..\SearchScopes\{C1CF7F2B-BAD6-47FD-B3C5-648322173D57}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=e68ce693-0fc4-11e1-a8d0-001a9f92c52a&q={searchTerms} O2 - BHO: (no name) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found. O4 - HKU\S-1-5-21-2011540971-2591290903-1419152939-1003..\Run: [] File not found [2011.11.15 23:03:50 | 000,000,000 | ---D | M] -- C:\Users\Tekniikkaopisto\AppData\Roaming\VshareComplete

:Files
ipconfig /flushdns /c
C:\Users\Tekniikkaopisto\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj
C:\Users\Tekniikkaopisto\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda
C:\Users\Tekniikkaopisto\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

OTL logfile. I haven`t seen that alert after that scan and reboot.

OK could you run for a day and if there is no further problem I will remove my tools ;D

Ok thats sounds good for me. What was the problem and what tools? :smiley:

Do you think I should use somekind anti-malware program (Malwarebytes or Spywareblaster) ?

No I feel it is a problem with certain versions of VshareComplete toolbar

So I dont need to change anything and Avast and Windows Firewall can do all I need?
Maybe I should remove that Vshare?

Yes that may be an idea… I have just disabled it for the moment

MBAM is a usefull tool for an occasional scan

I removed Vshare complete plugin now and I will use that MBAM if thats good. Is there anything I should do after you remove your tools? :slight_smile:

Nope if you report back tomorrow with no problems I will remove the tools and give some security advice ;D

No problems at all, works fine right now.