Malicious website blocked

[Bodylotion]

Hello,

 

I keep getting pop-up messages about malicious website being blocked for my malwarebytes program.

It says svchost.exe is being blocked and some ip adress.

 

I added the logs as attachements.

 

THank you for the support.

FRST.txt

Addition.txt

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

 

 

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

 

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

 

 

In most cases, a restart will be required.

 

 

Wait for the prompt to restart the computer to appear, then click on Yes.

 

 

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• 
  

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

Please download Junkware Removal Tool to your desktop.

• 
  

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Next,

 

Run scan with FRST one more time, ensure all boxes are checkmarked (ticked) under "Whitelist" and Addition.txt under "Optional Scan"

 

Post both produced logs...

 

Let me see those logs from above steps...

 

Kevin..

[Bodylotion]

Hello,

 

Can I put this on hold for a bit? Because I got this malicious website message when I had uTorrent on. I want to see if I get it when I don't run uTorrent.

[kevinf80]

Thanks for the update, post back when you`re ready....

 

Kevin...

[Bodylotion]

Hello Kevin,

 

I got the malicious website announcements again on malwarebytes after like 5 minutes when I closed uTorrent.

 

I did all you said and have added the files as attachments.

 

Thanks.

AdwCleanerS0.txt

JRT.txt

FRST.txt

Addition.txt

[kevinf80]

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

 

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

 

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

 

notepad c:\windows\debug\mrt.log

 

Post those logs in your next reply, also give an update on any remaining issues or concerns..

 

Kevin

Fixlist.txt

[Bodylotion]

I cannot run Firefox anymore

It is the only browser I use and now I get a message with my profile cannot be found and it won't open Firefox

 

Can't seem to copy log into IE, I attached the files.

 

So far no problems, but didn't have much problems before either, only once a day malicious website with svchost, or once in two days.

 

Only HUGE problem I have now after I did all your stuff that I cannot use Firefox anymore.

 

 

Fixlog.txt

mrt.log

[kevinf80]

Only items removed from Firefox were browser hijacker Babylon entries, that should not effect the way Firefox runs.. Also the version you have is V. 28, that is outdated, latest version is 33 or maybe 34, not sure. Can you re-install Mozilla Firefox, see if that makes any difference...

[Bodylotion]

I put updates off because I absolutely hate the new Firefox version, I like v 28.

I will system restore and make a backup of Firefox profile and then do your guide again again.

[Bodylotion]

Well, looks like I cannot get my bookmarks back with a systemrestore... so I canceled it and went back to 25-10-2014.

Guess this will be some hours work to get all my bookmarks back the way they was.

[kevinf80]

Use this link: https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data follow the instructions to find your "Profile"

 

Basically type or copy paste %APPDATA%\Mozilla\Firefox\Profiles into the search box after selecting "start" left corner of task bar. Tap enter or select ok

 

Expand the default folder, you should find all things related to your profile.

 

This link: https://support.mozilla.org/en-US/kb/restore-bookmarks-from-backup-or-move-them has instructions how to restore your bookmarks...

 

Kevin

[Bodylotion]

I already did all this but the whole profile and bookmarks are gone, there is no back-up.

If I knew it all would get deleted I would have made a back-up.

 

Anyway, thanks for your help for the malware removal.

Can I delete all the files and logs you send me to finish this off or there still needs to be things done?

[kevinf80]

I do not see or understand when Firefox profile was removed, if you look at the FRST log in reply #5 the profile is intact:

FireFox:
========
FF ProfilePath: C:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\6c14wt4g.default

Then after the fix is given and run via FRST the fix log does not show the profile as removed, the only entries removed from Firefox are Browser Hijacker "Babylon"

Content of fixlist:
*****************
Start
FF DefaultSearchUrl: http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=18711
FF SearchEngineOrder.1: Search the web (Babylon)
FF Keyword.URL: hxxp://search.babylon.com/?babsrc=toolbar2&q=
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S3 RTHDMIAzAudService; system32\drivers\RtHDMIVX.sys [X]
C:\Users\Administrator\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Administrator\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Administrator\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Administrator\AppData\Local\Temp\optprosetup.exe
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe
C:\Users\Administrator\AppData\Local\Temp\Samsung_Magician_Setup_v44.exe
C:\Users\Administrator\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Administrator\AppData\Local\Temp\sqlite3.dll
C:\Users\Administrator\AppData\Local\Temp\vlc-2.1.5-win32.exe
Task: {384731C7-F327-47A1-A21D-634457EDB0C4} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
C:\Program Files (x86)\Lavasoft
EmptyTemp:
End


*****************

Firefox DefaultSearchUrl deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox Keyword.URL deleted successfully.
catchme => Service deleted successfully.
dgderdrv => Service deleted successfully.
EagleX64 => Service deleted successfully.
IntcAzAudAddService => Service deleted successfully.
RTHDMIAzAudService => Service deleted successfully.
C:\Users\Administrator\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\optprosetup.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\Samsung_Magician_Setup_v44.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\sqlite3.dll => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\vlc-2.1.5-win32.exe => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{384731C7-F327-47A1-A21D-634457EDB0C4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{384731C7-F327-47A1-A21D-634457EDB0C4}" => Key deleted successfully.
C:\Windows\System32\Tasks\Ad-Aware Update (Weekly) => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Ad-Aware Update (Weekly)" => Key deleted successfully.
C:\Program Files (x86)\Lavasoft => Moved successfully.
EmptyTemp: => Removed 1000.3 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====

The only scan we do after that is MRST, that log shows no infection found, so it has no removed entries...

 

Microsoft Windows Malicious Software Removal Tool v5.17, October 2014 (build 5.17.10700.0)
Started On Fri Oct 24 23:38:03 2014

Engine: 1.1.11005.0
Signatures: 1.185.2035.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Fri Oct 24 23:39:40 2014


Return code: 0 (0x0)

 

I cannot explain why the profile folder should be gone, none of the tools we used have removed it?

 

Next,

 

Ok as requested to clean up and remove tools etc run the folowing:

 

Download "Delfix by Xplode" and save it to your desktop.

 

Or use the following if first link is down:

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

• 
  

    Activate UAC
    Remove disinfection tools
    Create registry backup
    Purge System Restore
    Reset system settings

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Part of the routine will be to create a registry back up with ERUNT,  the back up will be created here:

 

C:\Windows\ERUNT

 

When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

Any remnant files/logs from tools we have used can be deleted…

 

Next,

 

Read the following link to fully understand PC security and best practices, you may find it useful....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

Let me know if you want more assistance or now want to close out...

 

Thank you,

 

Kevin...

[Bodylotion]

The Profile Path is there, the folder is almost completely empty though.. so all files like bookmarks, firefox settings, addons etc is gone.

 

Thanks for the help, you can close this.

[Bodylotion]

http://imgur.com/BpFUgpx

 

Cannot delete this though?

 

I am the only user and am Admin on my PC. There is only guest account and this administrator account, nothing else. How can I not delete this? It says I need admin and SYSTEM authorization.

[kevinf80]

Thanks for the update, yes I realize profile contents are gone. i look back at our logs and see no reference to the removal, is very strange for sure.

 

The image you post opens from FRST folder to ad-aware, That whole folder (FRST and all contents) should have been removed when Defix was ran, did that not happen?

[Bodylotion]

I only chose Remove disinfection tools and registry backup because I absolutely hate UAC, I don't want my restore points to be gone and I don't want my windows settings reset when the threat is removed now.

[Bodylotion]

Also, it removed all other stuff, but not the FRST folder.

[kevinf80]

The problem with leaving restorepoints is the possibilty that they are infected or exploited, when we clean up a system it is always best policy to remove all old RP and create a fresh clean RP (restore point)

Obviously removing RP`s before the clean up is complete is bad business, a poisoned RP is better than none at all. Hence the reason we do this at the end...

 

Run this please:

 

Download OTM from either of the following links and save to your Desktop: (If your security alerts to OTM, either accept the alert or turn off security to allow OTM to run)

 

http://oldtimer.geekstogo.com/OTM.exe.

http://www.itxassociates.com/OT-Tools/OTM.com

http://www.itxassociates.com/OT-Tools/OTM.exe 

 

Double click OTM.exe to start the tool. Vista or Windows 7 users accepy UAC alert. Be aware all processes will be stopped during run, also Desktop will disappear, this will be put back on completion.... If your security alerts to OTM either, accept the alert or turn off security until OTM completes...

• 
  

Copy the text from the code box belowbelow to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy). Ensure to start with and include the colon before Files :Files
 

:FilesC:\FRST

 
Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

 

If the machine reboots, the Results log can be found here:

 

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

 

Where mmddyyyy_hhmmss is the date of the tool run.

 

If the folder is removed successfully do this:

 

• 
  

Double-click OTM.exe to run it again. Windows 7 or Vista accept UAC alert..
Click on the green CleanUp! button and it will populate a list of items to clean from your system that we used or may have used.
It should ask if you want to clean up, select Yes. You maybe asked to reboot, allow that to happen. It will also remove itself.

 

Let me know if FRST is now gone...

 

Kevin

[Bodylotion]

The files are not gone, they're now in C:\_OTM\MovedFiles\10252014_131506\C_\FRST\Quarantine\C\Program Files (x86)\Lavasoft\Ad-Aware after I did all you described. I rebooted twice and OTM.exe is gone now from desktop.

[kevinf80]

Open the Start Menu, type or copy paste cmd in the search box, right click on cmd.exe (at top), and click on Run as administrator.

At the command prompt type or copy/paste RD /S /Q "C:\_OTM" (make sure the spaces and inverted commas are correct, hit the enter key,

type or copy paste exit hit the enter key.

CMD should close and the _OTM folder should be gone...

[Bodylotion]

I get Access denied.

It doesn't work.

[kevinf80]

Did you open cmd with Administrator status?

[Bodylotion]

Yes...

[kevinf80]

That is very strange, I have just created a folder in C:\ drive then run cmd with administartor status exactly as I post to you and the command deletes the created folder....

 

Boot your system into Safemode, navigate to and open C:\ drive, right click on _OTM folder and select Delete...