Jump to content

Malicious Website Blocked keeps popping up.

cyberguyjeff
 Share

Recommended Posts

cyberguyjeff

cyberguyjeff

Posted
Posted

Today when I open Firefox and browse to any website I get the ballow message: "malicious website blocked". I currenty use Malwarebytes Premium and MS Security Essentials with the proper exclusions for both and never had any compatibilty issues. I ran full scans on both and no infections found. I also independently ran Housecall, ESET and MS Safety Scanner, all negative results. I've attached the 2 txt logs generated by Farbar for review. Also I looked at the addition.txt file and noticed that uTorrent was a listed program (I did have it installed on the PC about 2 yrs ago but had since removed it). I then went into add/remove programs and tried to uninstall it (again) but got an "error occurred" do you want to remove it from the list and I clicked no. I'm wondering if that is just some leftover registry data.

 

Please advise

Thanks in advance

FRST.txt

Addition.txt

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Hello,

    

 

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

 

     

    

Before we start please read and note the following:

  • We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
  • Note that we may live in totally different time zones, what may cause some delays between answers.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
  • Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
:excl: I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

:excl: There are no silly questions. Never be afraid to ask if in doubt!

 

 

 

  warning.gif Rules and policies

 

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

 

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 

 

Please re-run 51a46ae42d560-malwarebytes_anti_malware. Malwarebytes' Anti-Malware.

  • Click the History tab.
  • Click Application Logs and click on the newest Protection Log.
  • At the bottom click Export and choose Text file.
Save the file to your desktop and attach it in your next reply.
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

FRST.gif Scan with Farbar Recovery Scan Tool

 

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.

    (XP users click run after receipt of Windows Security Warning - Open File).

  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please upload them into your next reply.
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

remove%20outdated.jpg Uninstall some programs

We need to uninstall some unwanted/unneeded programs.

  • Press the WindowsKey.png + R on your keyboard at the same time. Type appwiz.cpl and click OK.
  • Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time
The list of programs to uninstall:
  • BrowserProtect 1.12
After completing uninstalls, please manually reboot your machine!

Note: If you get the message like: An error occurred while trying to uninstall, just press Yes.

Note: If you are unable to uninstall all programs, please inform me, but continue with other steps.

FRST.gif Fix with Farbar Recovery Scan Tool

icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif

icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.

    (XP users click run after receipt of Windows Security Warning - Open File).

  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.
Please upload it to your reply.

fixlist.txt

Link to post
Share on other sites
cyberguyjeff

cyberguyjeff

Posted
  • Author
Posted

I performed the steps outlined plus one additional one. I noticed after removing 'BrowserProtect 1.12' that I had a BrowserProtect 1.1.3.1 extension/addon in Firefox which I also removed. I then performed the Farbar fix and rebooted.

Unfortunely the balloon message is still popping up.

 

FixLog attached.

Fixlog.txt

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

51a46ae42d560-malwarebytes_anti_malware. Scan with Malwarebytes' Anti-Malware

Please re-run 51a46ae42d560-malwarebytes_anti_malware. Malwarebytes' Anti-Malware.

  • First of all, select update.
  • Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
  • In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware
  • Click the Scan tab, choose Threat Scan is checked and click Scan Now.
  • If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  • Upon completion of the scan (or after the reboot), click the History tab.
  • Click Application Logs and double-click the newest Scan Log.
  • At the bottom click Export and choose Text file.
Save the file to your desktop and upload your next reply.

FRST.gif Scan with Farbar Recovery Scan Tool

 

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.

    (XP users click run after receipt of Windows Security Warning - Open File).

  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please upload them into your next reply.
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Please go to: VirusTotal

  • Click the Choose File button.
  • Please copy/paste the following text into the 'File name:' box:

    C:\Program Files (x86)\dcmsvc\dcmsvc.exe
  • Click Open then click the Scan it! button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File already analyzed: click Reanalyse
  • Once scanned, copy and paste the URL from your browser address bar in your next reply.
Link to post
Share on other sites
cyberguyjeff

cyberguyjeff

Posted
  • Author
Posted

dcmsvc.exe had 2 hits using VirusTotal

https://www.virustotal.com/en/file/a1e4a46e3a4b904fac363c285ebf8d5d9838f12a83078daf6d599e67434e816f/analysis/1442145751/

 

I also tried another online scanner Jotti who got an additional hit

https://virusscan.jotti.org/en-US/filescanjob/o5f43ccmie

 

VirSCAN.org got an additional hit

http://r.virscan.org/report/d4db7fe737b29ff3eccf0c2568527fc9

 

I'm pretty sure this exe was D/L a couple of yrs ago as part of the Warner Bros Digital Copy Manager.

Link to post
Share on other sites
cyberguyjeff

cyberguyjeff

Posted
  • Author
Posted

To answer your question, when accessing the internet. Everytime I open Firefox and browse to any website I get the warning message. If I open another tab, same warning occurs.

 

I think I figured it out though. I never use IE but tried it and there was NO warning message. I then opened up the Firefox profile manager and created a new profile and now when I browse I'm free of any warning message. So I'm thinking that the infection is in my default Firefox profile. I'm currently customizing my new profile, installing the addon extensions I desire while checking for the warning. So far so good. I will delete that suspect profile once I get back to where I was before this issue arose. I do notice that my icon db (for my desktop shortcuts) got wiped on one the fix scans we ran so I'll need to rebuilt that. I will report back to you once everything is flying right.

Link to post
Share on other sites
cyberguyjeff

cyberguyjeff

Posted
  • Author
Posted

Well I'm still infected but the behavior has changed somewhat.

 

After deleting the infected Firefox profile I no longer get the warning when I browse but when I re-start the PC, after the desktop populates the message appears. Also I noticed if I RIGHT click the MAB icon on the taskbar, one of the choices in the context menu is to add (xxx-xxx-xxx) web exclusion. The (xxx-xxx-xxx) numbers change each time I reboot; see bottom right corner of attached screenshot. I just ran fresh MAB & Farbar scans that I've attached.

ProtectScan.txt

FRST.txt

Addition.txt

Screenshot.docx

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept