Egarrim Posted January 1, 2016 ID:1010229 Share Posted January 1, 2016 Hi, I have been asked to have a look at a computer that has been infected with the reimage browser hijack. I have run all my usual programs that would normally rid the computer of these type of infections, but unfortunately it is stubborn and remains. I have run RKill, adwcleaner (nothing) JRT (nothing) Malwarebytes (nothing) hitman pro (nothing) and lastly emisoft emergency repair kit. Nothing shows up in these logs and yet as soon as I use google chrome to access the internet I get redirects and a new tab inviting me to download and buy the reimage program also adverts of a very explicit nature. Apparently the computer was infected just before xmas and the girls father reset it back to factory settings with the option to retain files and documents, so any programs have been lost that may have given a clue as to how this infection got onto the laptop in the first instance. PS I have checked the extensions in chrome and there is no sign of anything untoward in there either. Hope you can help and I wish you all well for the new year.The farbar logs are attachedAddition.txtFRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 1, 2016 ID:1010231 Share Posted January 1, 2016 Hello, Is this your computer or you're fixing it for someone? Link to post Share on other sites More sharing options...
Egarrim Posted January 1, 2016 Author ID:1010234 Share Posted January 1, 2016 Hi, I am fixing it for someone. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 1, 2016 ID:1010236 Share Posted January 1, 2016 This is not the first time you opened the topic fixing computer for "someone". If you're making a revenue doing this then we cannot help you. This malware removal forum is mostly run by volunteers that spend their time free of charge. Link to post Share on other sites More sharing options...
Egarrim Posted January 1, 2016 Author ID:1010238 Share Posted January 1, 2016 Thats right its not the first time. I could be dishonset and create a new account every time but i dont and i also donate and subscribe to the malwarebytes premium version on three of my own computers and advise customers to do the same. I am asking for help and hope you will help me, I often give help free of charge should a customer call with an issue that I can talk them through or if a customer calls in with a problem I can fix in a few minutes. I could just wipe the laptop and reinstall windows but I like to figure things out and learn so I may help others, but on this occasion it has me stumped, will you help me please. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 1, 2016 ID:1010240 Share Posted January 1, 2016 Okay, that's fine. This PC doesn't have active infection, but there are some infection leftovers that we will remove in the next step: Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop: Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Press the Fix button just once and wait.If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.When finished FRST will generate a log on the Desktop, called Fixlog.txt.Please attach it to your reply.fixlist.txt Link to post Share on other sites More sharing options...
Egarrim Posted January 1, 2016 Author ID:1010244 Share Posted January 1, 2016 Hi, and first of all thank you for helping. The log is attached.Can I ask if flushing the DNS would have fixed this issue, I saw reference to it in the fix log. Fixlog.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 1, 2016 ID:1010251 Share Posted January 1, 2016 Yes, there were leftovers of DNS Changer malware. Link to post Share on other sites More sharing options...
Egarrim Posted January 1, 2016 Author ID:1010253 Share Posted January 1, 2016 Thank you, is all OK now? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 1, 2016 ID:1010256 Share Posted January 1, 2016 Yes. Link to post Share on other sites More sharing options...
Egarrim Posted January 1, 2016 Author ID:1010261 Share Posted January 1, 2016 Hi again, i have just started the laptop and used chrome and it has redirected again to reimage. I did notice while redirecting that in the bottom corner of the browser it stated waiting for "Middlerush" .exe .. or something very simular Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 12, 2016 Root Admin ID:1012105 Share Posted January 12, 2016 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts