Malicious Website Blocked- Malwarebytes

[itzfifi123]

For the last few weeks I've been having popups from Malwarebytes regarding Avast. The IP address it corresponds to is 92.242.140.21. I also sometimes get pop ups for a Toshiba related program as well. I attached a picture of the Toshiba problem and the FRST and Addition scan.

Addition.txt

FRST.txt

[MrCharlie]

Welcome to the forum.

Are you on a Verizon/FIOS router???

Model number???

===================================================

Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.

Run FRST.exe/FRST64.exe and click Fix only once and wait

The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

MrC

fixlist.txt

[itzfifi123]

It is attached.

Fixlog.txt

[itzfifi123]

And yes I am a Verizon FIOs user. I've recently upgraded to it a week ago and I'm not sure where I can find the model number..

[MrCharlie]

Are you using a Verizon router???

[itzfifi123]

Yes I am

[MrCharlie]

Here's some pictures...can you find yours:

http://my.verizon.com/micro/fiosrouters/?router=allrouters

[itzfifi123]

None of those represented my router. I believe this is the one I have :http://www.verizon.com/home/MLP/router.html?pos=1

[MrCharlie]

OK...this is from Verizon and how to resolve the problem:

"This is expected bahavior. The Verizon Online DNS resolvers have NXDOMAIN redirection services that redirect any unknown host to a sponsored search page. You can opt out of this by changing your resolver from .12 to .14."

https://www.verizon.com/support/residential/internet/fiosinternet/troubleshooting/network/questionsone/99144.htm#<---opt out

===================================

Rather than change the current settings as they say to, we've been installing OpenDNS on the routers and it's been working fine.

So lets give that a try:

First..as in the image below, copy down the current DNS Server: settings (primary and secondary)

Example in image:

71.252.0.12

71.242.0.12

======================================

Now here's instructions on how to install OpenDNS on your router:

https://support.opendns.com/entries/62437360-FIOS-Quantum-Gateway-G1100

These instructions have better images:

http://www.howtogeek.com/howto/38869/how-to-setup-your-verizon-fios-router-with-opendns-or-google-dns/

You're going to use these settings for OpenDNS:

208.67.222.222

208.67.220.220

To confirm it's installed correctly...visit the site below:

http://www.opendns.com/welcome/

Good Luck.....Let me know, MrC

[itzfifi123]

Hi, I went on the website and it said "Your Internet is safer, faster, and smarter because you’re using OpenDNS. Thank you!" Does that mean I did it correctly? I also forgot to copy the original DNS server... 

[MrCharlie]

That's correct......How's the blocks now?????

MrC

[itzfifi123]

I so far haven't seen them.. thanks! What was causing those pop ups?

[MrCharlie]

They're caused by the way Verizon deals with a hostname that does not resolve.
"The Verizon Online DNS resolvers have NXDOMAIN redirection services that redirect any unknown host to a sponsored search page."

Many people are having the same problem.

=================================

If there's no other problems;

A little clean up to do....

---------------------------------

Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[itzfifi123]

Thanks! Should I ever revert back to the old DNS settings? 

[MrCharlie]

No, stay with OpenDNS...it's much better and safer!!!

 

https://support.opendns.com/entries/25924219-FAQ-Understanding-OpenDNS-and-the-Domain-Name-System-DNS-

 

MrC

[itzfifi123]

What is the difference between that and my old settings? What is OpenDNS anyway? Thanks!

[itzfifi123]

Ahh I just read the link, never mind! Thank you so much! None of those popups corresponded with a virus right?

[MrCharlie]

Ahh I just read the link, never mind! Thank you so much! None of those popups corresponded with a virus right?

Yes that correct......your computer is clean.

The problem is due to the way Verizon deals with any unknown host:

"This is expected behavior. The Verizon Online DNS resolvers have NXDOMAIN redirection services that redirect any unknown host to a sponsored search page. You can opt out of this by changing your resolver from .12 to .14."

MrC

[itzfifi123]

Does changing the DNS affect the wifi of my other devices such as my phone and the speed?

[MrCharlie]

No, it should not.

[Naathim]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!