redirect.cheapred.info

[Eurisko]

I have a system that is infected with something that 7 virus/malware scanners cannot detect.  The initial symptoms were being redirected to random porn sites, where some would try to install extensions.  Those have changed now to occasionally displaying the page's meta keywords in an alert box, but more often, trying to divert to redirect.cheapred.info:64717

I can't find any information about this domain other than it's registered in Moscow and points to an IP in Chicago.  MalwareBytes blocks the redirection but I don't know why.  I'm guessing maybe the port.  During the initial redirects to the porn sites it was using the domain prpops.com and downloading some javascript to inject an iframe to do the diverting.

This malware has managed to spread like wildfire in my office on fully patched machines.  Has anyone else experienced symptoms like this?  Without being able to identify it I'm left with the only solution of wiping everything in the office.  But then I don't know if it will get in the same way.

Edited June 5, 2017 by Eurisko

[Eurisko]

Sorry, I should have read the pinned posts.  Here are the Addition and the FRST files generated by FarBar

Addition.txt

FRST.txt

[Eurisko]

Has anyone else experienced symptoms like these?

[AdvancedSetup]

We're sorry. It looks like your topic was somehow overlooked. Due to the length of time we'll go ahead and close this topic now but if you still actually need help please send a private message to one of the Moderators and we'll assist you.Thank you and sorry we missed your topic.