Browser redirect / hijack

[sacnagar]

I am on Windows 10 and all my browsers (Chrome, IE, Edge) are now affected by this strange problem. All clicks on any area of a tab with an open website opens a new tab with the link: 

http://onclickrev.com/afu.php?zoneid=1220488

. Thereafter the tab will behave normally for a while. It seems to affect most but not all websites - for instance, this site, gmail, wikipedia etc. do not get impacted. On the other hand businessinsider, sciencemag.org are some of the impacted sites. For the time being I added a host file entry to point this website to the localhost to minimize risk of loading malicious sites. 

I have run most of the commonly suggested anti-malware tools including malwarebytes, adwcleaner, hitman pro, zemana, NPE, Avast, bit defender, kaspersky, microsoft malicious software removal tool - they do not find anything. A clean reinstall of Chrome did not help. 

Please help.  Some logs from scan tools attached. 

 

 

 

Addition.txt

FRST.txt

Shortcut.txt

hijackthis.log

Edited August 25, 2017 by AdvancedSetup
Removed hyperlink

[AdvancedSetup]

Hello @sacnagar and

You have very old Java on the computer that is compromised. Please uninstall All versions of Java on your computer.

You also have more than one antivirus program installed that will conflict with each other. Please choose one and fully uninstall the other one.

Avast Free Antivirus
Bitdefender Antivirus Free

 

After you've removed one of these antivirus products and the Java, please run the following temp cleaner and restart the computer again.

Please Run TFC by OldTimer to clear temporary files:

• Download TFC from here and save it to your desktop.
• http://oldtimer.geekstogo.com/TFC.exe
• Close any open programs and Internet browsers.
• Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
• Please be patient as clearing out temp files may take a while.
• Once it completes you may be prompted to restart your computer, please do so.
• Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

 

You have old drivers from ESET antivirus trying to load on your computer that is generating errors. Please follow these directions to remove all traces of the old ESET antivirus.

Uninstall ESET manually using the ESET uninstaller tool
Visit the website for ESET and follow their directions to fully remove all traces of their software.

After you remove ESET then run the following.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Then it should restart the computer. After the reboot, let's reset all your browsers again.

 

 

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
  • 
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer now and make sure there are no longer any redirects or other browser issues and let me know.

Thanks

 

 

[sacnagar]

Thanks for the detailed instructions and for taking the time to help me out. 

I followed all the steps described as best as I could (except the ESET uninstall, which did not work for me). Unfortunately the problem still persists. 

Attached is the FRST fixlog. 

Please let me know what are the next steps.

Fixlog.txt

[sacnagar]

One more thing: for the last few days a number of sites purportedly offering to fix the problem, appear on google search results when I search for "onclickrev". Some of them are flagged by malwarebytes. Screenshot attached. 

 

[AdvancedSetup]

If the reset did not fix and all browsers are redirecting it may be that your router is compromised.

Please review the following website and read it before continuing and then do a Hard Reset back to Factory Defaults for your router.
This information is only for resetting the router DO NOT erase, install, or update the firmware, just reset your router to factory defaults.

Reset And Reboot

Hard reset or 30/30/30

 

Edited August 25, 2017 by AdvancedSetup

[sacnagar]

I do not have access to this router, but I tried a different connection - a mobile hotspot and the problem manifested. 

Thanks.

[AdvancedSetup]

On every browser you have it goes to this site link?

 

[sacnagar]

Yes, Chrome, IE, Edge all are impacted. I did not have Firefox, just installed and it has the same problem right from the start. 

Thanks. 

[AdvancedSetup]

We'll run a couple more scanners to see but rarely are all browsers affected.

 

Please download and run the following tool to remove any found threats

Kaspersky Virus Removal Tool

Let me know if it finds anything or not please.

Ron

 

[sacnagar]

Ran Kaspersky Virus Removal Tool first with default options and then by selecting the disk drive. No threats were detected.

Thanks.

[AdvancedSetup]

I was not expecting it to find anything. I also don't think you're being redirected at this point are you? Most of that site stuff from Google searches comes a couple of different ways.

One is from Google if you're using a signed in account, it tracks and knows what you're searching and will automatically pre-feed you links "guessing" that's what you want. Another way is cookies. The cookies get read and Google again knows you've been looking for this stuff, so adds possible links you might want. All of this is normal and done on purpose. Example if you searched multiple times for Leather Handbags for a couple of days. From then on until some other search or use changes it, they will start pre-feeding your pages with links to sites about Leather Handbags.

Take Internet Explorer. Reset it per the link advice above. Then go in and double-check physically at the file level and delete the cookies. Make sure Internet Explorer is closed when deleting the cookies.

• C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies
• C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies\Low

Then restart Internet Explorer and then go to a few major sites such as Google.com and Yahoo.com - they should go there and not redirect to some other web page.
Do a search for Leather Handbags on Google and it should show you searches about Leather Handbags and not about ONCLICKREV

Let me know how that goes please.

Thanks again

Ron

 

[sacnagar]

The problem still persists - resetting IE did not fix the issue.  I deleted the Inetcache folder as much as the system would let me. 

Attached are two screenshots that illustrate the issue. Here is what happens - I open a website. For the first time, clicking anywhere on the page opens the popup. Then the website works as expected, clicks taking to expected locations. After a while toggles back to that initial state, where clicking anywhere will open the popup. It keeps toggling back and forth. Strangely, not all websites are impacted, the vast majority are. 

Please note that I have added a host file entry to redirect onclickrev.com to localhost to prevent malicious sites from loading. 

 

[AdvancedSetup]

Okay, let me have you run the following for me again to make sure they're not finding anything.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• Make sure you tell Malwarebytes to remove anything it finds.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[sacnagar]

I ran the tools again, nothing detected. The log files are attached. 

Addition 829.txt

AdwCleaner 829.txt

FRST 829.txt

MB Report 829.txt

[AdvancedSetup]

Sorry for the delay @sacnagar - I lost track of your post. Are you still having an issue?

Ron