Jump to content

Malicious website blocked

Recommended Posts

Hello and post-32477-1261866970.gif


P2P/Piracy Warning:


If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.




Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.



Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.


When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.



In most cases, a restart will be required.



Wait for the prompt to restart the computer to appear, then click on Yes.



Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.




Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number




thisisujrt.gif Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.




Run scan with FRST one more time, ensure all boxes are checkmarked (ticked) under "Whitelist" and Addition.txt under "Optional Scan"


Post both produced logs...


Let me see those logs from above steps...



Link to post
Share on other sites

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.


Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.




Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:


64 Bit version:



Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:


1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:


notepad c:\windows\debug\mrt.log


Post those logs in your next reply, also give an update on any remaining issues or concerns..




Link to post
Share on other sites

I cannot run Firefox anymore :angry:

It is the only browser I use and now I get a message with my profile cannot be found and it won't open Firefox :(


Can't seem to copy log into IE, I attached the files.


So far no problems, but didn't have much problems before either, only once a day malicious website with svchost, or once in two days.


Only HUGE problem I have now after I did all your stuff that I cannot use Firefox anymore.





Link to post
Share on other sites

Use this link: https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data follow the instructions to find your "Profile"


Basically type or copy paste %APPDATA%\Mozilla\Firefox\Profiles into the search box after selecting "start" left corner of task bar. Tap enter or select ok


Expand the default folder, you should find all things related to your profile.


This link: https://support.mozilla.org/en-US/kb/restore-bookmarks-from-backup-or-move-them has instructions how to restore your bookmarks...



Link to post
Share on other sites

I already did all this but the whole profile and bookmarks are gone, there is no back-up.

If I knew it all would get deleted I would have made a back-up.


Anyway, thanks for your help for the malware removal.

Can I delete all the files and logs you send me to finish this off or there still needs to be things done?

Link to post
Share on other sites

I do not see or understand when Firefox profile was removed, if you look at the FRST log in reply #5 the profile is intact:

FF ProfilePath: C:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\6c14wt4g.default

Then after the fix is given and run via FRST the fix log does not show the profile as removed, the only entries removed from Firefox are Browser Hijacker "Babylon"

Content of fixlist:
FF DefaultSearchUrl: http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=18711
FF SearchEngineOrder.1: Search the web (Babylon)
FF Keyword.URL: hxxp://search.babylon.com/?babsrc=toolbar2&q=
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S3 RTHDMIAzAudService; system32\drivers\RtHDMIVX.sys [X]
Task: {384731C7-F327-47A1-A21D-634457EDB0C4} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
C:\Program Files (x86)\Lavasoft


Firefox DefaultSearchUrl deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox Keyword.URL deleted successfully.
catchme => Service deleted successfully.
dgderdrv => Service deleted successfully.
EagleX64 => Service deleted successfully.
IntcAzAudAddService => Service deleted successfully.
RTHDMIAzAudService => Service deleted successfully.
C:\Users\Administrator\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\optprosetup.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\Samsung_Magician_Setup_v44.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\sqlite3.dll => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\vlc-2.1.5-win32.exe => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{384731C7-F327-47A1-A21D-634457EDB0C4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{384731C7-F327-47A1-A21D-634457EDB0C4}" => Key deleted successfully.
C:\Windows\System32\Tasks\Ad-Aware Update (Weekly) => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Ad-Aware Update (Weekly)" => Key deleted successfully.
C:\Program Files (x86)\Lavasoft => Moved successfully.
EmptyTemp: => Removed 1000.3 MB temporary data.

The system needed a reboot.

==== End of Fixlog ====

The only scan we do after that is MRST, that log shows no infection found, so it has no removed entries...


Microsoft Windows Malicious Software Removal Tool v5.17, October 2014 (build 5.17.10700.0)
Started On Fri Oct 24 23:38:03 2014

Engine: 1.1.11005.0
Signatures: 1.185.2035.0

Results Summary:
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Fri Oct 24 23:39:40 2014

Return code: 0 (0x0)


I cannot explain why the profile folder should be gone, none of the tools we used have removed it?




Ok as requested to clean up and remove tools etc run the folowing:


Download "Delfix by Xplode" and save it to your desktop.


Or use the following if first link is down:


"Delfix link mirror"


Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator


Make Sure the following items are checked:


    Activate UAC
    Remove disinfection tools
    Create registry backup
    Purge System Restore
    Reset system settings


Now click on "Run" and wait patiently until the tool has completed.


The tool will create a log when it has completed. We don't need you to post this.


Part of the routine will be to create a registry back up with ERUNT,  the back up will be created here:




When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

Any remnant files/logs from tools we have used can be deleted…




Read the following link to fully understand PC security and best practices, you may find it useful....




Let me know if you want more assistance or now want to close out...


Thank you,



Link to post
Share on other sites

Thanks for the update, yes I realize profile contents are gone. i look back at our logs and see no reference to the removal, is very strange for sure.


The image you post opens from FRST folder to ad-aware, That whole folder (FRST and all contents) should have been removed when Defix was ran, did that not happen?

Link to post
Share on other sites

The problem with leaving restorepoints is the possibilty that they are infected or exploited, when we clean up a system it is always best policy to remove all old RP and create a fresh clean RP (restore point)

Obviously removing RP`s before the clean up is complete is bad business, a poisoned RP is better than none at all. Hence the reason we do this at the end...


Run this please:


Download OTM from either of the following links and save to your Desktop: (If your security alerts to OTM, either accept the alert or turn off security to allow OTM to run)






Double click OTM.exe to start the tool. Vista or Windows 7 users accepy UAC alert. Be aware all processes will be stopped during run, also Desktop will disappear, this will be put back on completion.... If your security alerts to OTM either, accept the alert or turn off security until OTM completes...

Copy the text from the code box belowbelow to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy). Ensure to start with and include the colon before Files :Files
Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red btnmoveit.png button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


If the machine reboots, the Results log can be found here:




Where mmddyyyy_hhmmss is the date of the tool run.


If the folder is removed successfully do this:


Double-click OTM.exe to run it again. Windows 7 or Vista accept UAC alert..
Click on the green CleanUp! button and it will populate a list of items to clean from your system that we used or may have used.
It should ask if you want to clean up, select Yes. You maybe asked to reboot, allow that to happen. It will also remove itself.


Let me know if FRST is now gone...



Link to post
Share on other sites

Open the Start Menu, type or copy paste cmd in the search box, right click on cmd.exe (at top), and click on Run as administrator.

At the command prompt type or copy/paste RD /S /Q "C:\_OTM" (make sure the spaces and inverted commas are correct, hit the enter key,

type or copy paste exit hit the enter key.

CMD should close and the _OTM folder should be gone...

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.