Browser Redirects Constantly

[Mydako]

My browsers currently redirects all the time. It seems to be connected to ads but I'm not sure. I see the url www.hitcpm.com frequently as part of the redirect. The only thing I think might have infected me was a Chrome addon, I think it was called UnSeeMe, I uninstalled it as the redirects started right after installing it. Any help would be appreciated.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/2/18
Scan Time: 5:05 PM
Log File: 1887622a-f009-11e7-9eea-54ab3a6b4f9e.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3609
License: Trial

-System Information-
OS: Windows 10 (Build 16299.125)
CPU: x64
File System: NTFS
User: LAPTOP-Q4D05MC6\Mykel

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 323730
Threats Detected: 0
(No malicious items detected)
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 4 min, 20 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

(end)

FRST.txt

Addition.txt

[kevinf80]

Hello Mydako and welcome to Malwarebytes,

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Open Malwarebytes Anti-Malware.

• On the Settings tab > Protection Scroll to and make sure the following are selected: Scroll to and make sure the following are selected:

  Scan for Rootkits
  Scan within Archives

• Scroll further to Potential Threat Protection make sure the following are set as follows:

  Potentially Unwanted Programs (PUP`s)         set as :- Always detect PUP`s (recommended)
  Potentially Unwanted Modifications (PUM`s)  set as :- Alwaysdetect PUM`s (recommended)

• Click on the Scan make sure Threat Scan is selected,
  

• A Threat Scan will begin.
  

• When the scan is complete if anything is found make sure that the first checkbox at the top is checked (that will automatically check all detected items), then click on the Quarantine Selected Tab
  

• If asked to restart your computer to complete the removal, please do so
  

• When complete click on Export Summary after deletion (bottom-left corner) and select Copy to Clipboard.
  

• Wait for the prompt to restart the computer to appear, then click on Yes.
  

• After the restart once you are back at your desktop, open MBAM once more to retrieve the log.
  

To get the log from Malwarebytes do the following:

• Click on the Reports tab > from main interface.
• Double click on the Scan log which shows the Date and time of the scan just performed.
• Click Export > From export you have two options: > From export you have two options:

    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
   

• Use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…
  

Next,

Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop Ensure to get the correct version for your system.... https://www.microsoft.com/en-gb/download/malicious-software-removal-tool-details.aspx Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time.... Let me see those logs in your reply, also tell me if there are any remaining issues or concerns... Thank you, Kevin...

fixlist.txt

[Mydako]

Hi Kevin, thanks for the help


Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/2/18
Scan Time: 7:20 PM
Log File: f1149006-f01b-11e7-af03-54ab3a6b4f9e.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3609
License: Trial

-System Information-
OS: Windows 10 (Build 16299.125)
CPU: x64
File System: NTFS
User: LAPTOP-Q4D05MC6\Mykel

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 323342
Threats Detected: 2
Threats Quarantined: 2
Time Elapsed: 16 min, 11 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 2
PUP.Optional.AuslogicsBoostSpeed, C:\USERS\MYKEL\DESKTOP\FILES\AUSLOGICS BOOSTSPEED 6.4.1.0 + CRACK - KRISH\BOOST-SPEED-SETUP.EXE, Quarantined, [1620], [357741],1.0.3609
PUP.Optional.AuslogicsBoostSpeed, C:\USERS\MYKEL\DESKTOP\FILES\AUSLOGICS BOOSTSPEED 8.2 + KEYGEN [4REALTORRENTZ]\BOOST-SPEED-SETUP.EXE, Quarantined, [1620], [357741],1.0.3609

Physical Sector: 0
(No malicious items detected)

(end)

 

----------------------------------------------------------------------------------

 

# AdwCleaner 7.0.6.0 - Logfile created on Wed Jan 03 00:51:52 2018
# Updated on 2017/21/12 by Malwarebytes
# Running on Windows 10 Home (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

 

*************************

C:/AdwCleaner/AdwCleaner[C0].txt - [4241 B] - [2017/10/13 20:8:31]
C:/AdwCleaner/AdwCleaner[C1].txt - [1578 B] - [2017/11/8 17:37:5]
C:/AdwCleaner/AdwCleaner[S0].txt - [4794 B] - [2017/10/13 20:7:11]
C:/AdwCleaner/AdwCleaner[S1].txt - [1467 B] - [2017/11/8 17:36:44]
C:/AdwCleaner/AdwCleaner[S2].txt - [1216 B] - [2018/1/3 0:51:35]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt ##########

 

------------------------------------------

 

Microsoft Windows Malicious Software Removal Tool v5.55, December 2017 (build 5.55.14421.1)
Started On Tue Jan 02 20:06:49 2018

Engine: 1.1.14405.2
Signatures: 1.257.1160.0
Run Mode: Interactive Graphical Mode

Results Summary:
----------------
No infection found.
Successfully Submitted MAPS Report
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Tue Jan 02 20:11:02 2018

Return code: 0 (0x0)

 

Fixlog.txt

[kevinf80]

Hello Mydako,

How is your system responding now, any odd or erratic behavior,...?  Is your Browser ok have the redirects ceased..

Thank you,

Kevin

[Mydako]

There has been no change, still redirecting.

[kevinf80]

Which browser...?

[Mydako]

Both Chrome and Firefox are affected by this.

[kevinf80]

Thanks for the update, lets make a clean install of both browsers...

If your Chrome Bookmarks are important do this first: Go to this link: http://www.wikihow.com/Export-Bookmarks-from-Chrome follow the instructions and Export your Bookmarks from Chrome, save to your Desktop or similar. Note the instructions can also be used to Import the bookmarks..... Continue for a clean install: Download Chrome installer and save to install later: https://www.google.com/intl/en_uk/chrome/browser/desktop/index.html https://www.google.com/intl/en_usa/chrome/browser/desktop/index.html Next, Open Chrome and sign into your account, open a new tab and type or copy paste chrome://settings/syncSetup hit enter... In the new window that opens "Sync everthing" will probably be selected, scroll down to and select "Managed sync data on Google Dashboard" A new window will open, scroll down to and select "Reset Sync" that will clear synced data from Google Server... Continue to next step to completely Uninstall Chrome.... Next. Uninstall Chrome: https://support.google.com/chrome/answer/95319?hl=en-GB follow those instructions, ensure the option to "Also delete your browsing data" is selected. <<--- Very important!! Navigate to C:\Users\Your user name\Appdata\Local from that folder delete the folder named Google (you will need to show hidden files/folders to see the folder Appdata) For XP that will be My Computer > C:\ Documents and Settings\Your User Name\Application Data\Roaming How to show hidden files and folders for windows: http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/ Next, Install Google Chrome : Next, Import your Bookmarks... (instructions in the first step) Next, Install uBlock Origin for Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en Does that help with Chrome...? Next, Make a "Clean" install of Firefox: Use the following link for instructions how to back up your bookmarks, same link can be used to import saved Bookmarks: https://support.mozilla.org/en-US/kb/export-firefox-bookmarks-to-backup-or-transfer Next, Remove all synced data from Firefox to stop possible re-infection or exploitation. https://support.mozilla.org/en-US/questions/1037353 Next, Go here: http://www.mozilla.org/en-US/ download save the latest version of Firefox.. We will install this later... Next, Lets totally remove Firefox and start over. Go here: https://support.mozilla.org/en-US/kb/uninstall-firefox-from-your-computer and follow those instructions... Ensure when the uninstall completes to navigate to and delete the firefox installation folder (if present): (32-bit Windows) C:\Program Files\Mozilla Firefox (64-bit Windows) C:\Program Files (x86)\Mozilla Firefox It is essential the installation folder is removed. Re-boot your system when that is completed.... Next, To remove all remaining data and profile information... Press "Windows key + R" to open the Run box In the Run box, type in or copy and paste %APPDATA% Click OK. A Windows Explorer window will appear. In this window, choose/open in succession Mozilla > Firefox > Profiles. Select Delete on each entry in reverse, eg Profiles > Delete. Firefox > Delete. Mozilla > Delete. Re-boot your system when complete! Next, Use the Mozilla Firefox installer to reinstall your Browser.... When Firefox is installed and open select these keys together :- Ctrl - Shift - A that will access Addons manger, this gives access to find addons/extensions, use, start, stop or disable those features etc.... uBlock-Origin can be installed from here: https://addons.mozilla.org/en-GB/firefox/addon/ublock-origin/ <<--- Recommended. Does that help with Firefox...? Thank you, Kevin..

[Mydako]

Thanks Kevin. I did as you said. Before I installed the ublock I tested my browsers and they were both still redirecting, though now to new sites deleton and rtmark.net . I'm not sure what else it could have been though, none of the malware/rootkit/antivirus scanners are showing anything.

Now that I have ublock though it seems to have stopped that, so I'm hoping that solves everything from now on, thanks.

[Mydako]

Unfortunately that didn't solve everything. I left to grab my lunch, came back to work, and first page I opened tried to redirect me to my.rtmark.net . Malwarebytes blocked the redirect, but it was still attempted.

[kevinf80]

Can you post the last three (3) of blocks from Malwarebytes:

Open Malwarebytes, select > Reports > then checkmark (tick) most recent "Website Block" entry > then select "View Report" > "Export" > Text File (*.txt) name and save that file to Desktop or somewhere of your choice, attach to your reply...

 

[Mydako]

Oddly enough as I was attaching this I got another block notice for the rtmark, even though I was just on this page.

Block1.txt

Block2.txt

Block3.txt

[kevinf80]

Those blocks were 2 for Chrome and 1 for Firefox.... run the following and post the produced log:

Please download Zemana AntiMalware and save it to your Desktop.   Install the program and once the installation is complete it will start automatically. Without changing any options, press Scan to begin. After the short scan is finished, if threats are detected press Next to remove them. Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually.   Open Zemana AntiMalware again. Click on icon and double click the latest report. Now click File > Save As and choose your Desktop before pressing Save. Attach saved report in your next message.

[Mydako]

Zemana didn't turn up anything :-/

zemana.txt

[kevinf80]

Does Malwarebytes only make blocks when you have a browser open, or does it happen when no browser is open. It seems odd that block logs i`ve seen are indicating more than one browser... We`ve made clean installs of Chrome and Firefox with no obvious improvement... Run the following:

Please download Gmer from Here by clicking on the "Download EXE" Button.   Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent. If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO. In the right panel, you will see several boxes that have been checked. Uncheck the following ... Sections IAT/EAT Show All ( should be unchecked by default )   Leave everything else as it is. Close all other running Programs as well as your Browsers. Click the Scan button & wait for it to finish. Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post. Save it where you can easily find it, such as your desktop. Please post the content of the ark.txt here. **Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries **If GMER crashes** Follow the instructions here and disable your security temporarily…

 

[Mydako]

Attached is my ark file.

The redirects only happen when the browsers are open. Again actually I got a blocked popup or something through Malwarebytes loading this page. The reason there were two browsers in the block log is because I often use Firefox and Chrome at the same time.

ark.txt

[kevinf80]

It would seem from what you describe that the two browsers Chrome and Firefox are at fault... Use the following instructions and reset browsers to deault settings..

Reset Browsers to Default Settings 

Please visit each of the following sites and to reset your browsers back to default to prevent unexpected issues.

If you are not using one of the browsers but it is installed, then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   button and then click it to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
   
  • 
     
• Type in (or copy/paste) the following and press Enter:      %localappdata%\Google\Chrome\User Data\Default\
   

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them. This is what it should look like:
   
   
    
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.

Restart your computer now and make sure there are no longer any redirects or other browser issues. 

[Mydako]

How was that different from the clean install done earlier?

Either way, I tried that, and when I opened Firefox, which was set to open to Options/Setting page, I still got the notice that malwarebytes had to block that same rtmark website, even though I wasn't even viewing a proper webppage with ads that could be hijacked but an internal page of firefox. Just opened Chrome, and had popups and and a blocked attempt from the two websites I mentioned earlier.

Someone I mentioned this problem to told me that when all the scans come up negative on the computer it could possibly be something has infected the router and redirecting through it. Could that be the case?

[kevinf80]

Thanks for the update, the reset to default was just a double check really. The router is a strong possibility...

Reset your router, instructions available at the following link: http://setuprouter.com/networking/how-to-reset-your-router/ Follow those instructions very carefully. Next, Download and unzip DNSJumper to your Desktop, the tool is portable no installation necessary. Tool can be downloaded here: http://www.sordum.org/downloads/?dns-jumper   Right click on Dnsjumper.exe and select "Run as Administrator" to start the tool, For XP just double click to run. From the left hand pane select "Flush DNS" From the main interface select the dropdown under "Choose a DNS Server" From the list select either "Google Public DNS" or "Open DNS" From the left hand pane select "Apply DNS" When done re-boot your system, does the issue happen...?

Edited January 7, 2018 by kevinf80

[Mydako]

I waited a day this time to be sure, but it looks like this has worked, between the uBlock and flushing the router it looks like my computer is back to normal. Thanks for your help!

[kevinf80]

Thanks for the update Mydako, good to hear your system is back to normal. Continue to clean up:

Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we may have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[kevinf80]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread.

Thanks