Internet banking - odd window pops up

closed

yes it was.

Have you done the avast boot time scan yet, and if so did it find anything.

you can install ccleaner.

has the problem ceased?

Disable these

R3 - URLSearchHook: (no name) - CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: (no name) - EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)


upload these to www.virustotal.com

c:\windows\system32\msiedle.dll

C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

How much ram have you got, is the pc slow generally?

JabT_2

Thanks for replying.
Uploaded that file, result 0/41. Saved the report just in case anyway.
Haven't done the boot scan, will do that next........... I might be quite a while....
And that alert is still driving me nuts

Just seen the additions, will do those first.

JabT_2

The Google toolbar file result was 0/42.
RAM = 1GB
PC isn't the quickest using the internet but I don't have a great download speed anyway being so far from the exchange. Otherwise it seems ok.
How do I disable those 4 things, I haven't a clue?

debitcardmayhem

|Go in to Hijackthis(scan) and click on each those 4 items and select Fix Checked
ie these
R3 - URLSearchHook: (no name) - CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: (no name) - EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

JabT_2

Thank you for answering. I googled it after posting that, should have done that before!
Ccleaner is next on my hit list.....
That's done.
Boot scan next, have a feeling it's going to take hours so going to leave it running and toddle off to sleep.

JabT_2

Me again with an update.
The boot scan was clear, the online eset.com scan was also clear. But that malicious url alert is still popping up constantly. I've taken backups of photos etc and will probably try to restore back to a couple of weeks ago.

closed

Before you do, try disabling this with http://live.sysinternals.com/autoruns.exe, and reboot.

c:\windows\system32\msiedle.dll

When are you getting this popup, all the time?

you can disable the webshield in avast to stop the annoyance, but need to get to the router of the problem asap and reenable it.

JabT_2

Had a thought and went for a play. It mainly seems to pop up wherever there is a login, like this site. Thinking about it I have to log into everywhere now, even if I check the remember me type boxes it doesn't.

closed

Could you upload c:\windows\system32\msiedle.dll to http://www.sendspace.com and post or pm me the sendspace link, to check that file?

It's a dynamic link library, not data, so nothing personal in there.

JabT_2

Woohoo I think you've cracked it! I've logged in and out of here a couple of time and a couple of other sites and no annoying red box.

Not sure which link you want so have all 3!
http://www.sendspace.com/file/uqqx3q
http://www.sendspace.com/file/uqqx3q
<a href='http://www.sendspace.com/file/uqqx3q'>http://www.sendspace.com/file/uqqx3q</a&gt;