Possible redirect malware

[Grimwol]

For the past few days, the Firefox browser on my PC has been opening up to the Microsoft or Google homepage, despite it being set to Firefox home. Changing the homepage to something else doesn't seem to work, although new tabs aren't affected. This prompted me to look in my NoScript extension, where I briefly noticed something along the lines of "cdn.immereeako". I looked it up and found a very detailed article about some "iTranslator" malware. It mentions the same browser redirect that I've experienced, as well as a folder in my (C:\ProgramData) that was created on the 22nd of this month. Unfortunately, McAfee, Spybot Search & Destroy and Malwarebytes have been unable to get rid of the issue, so I'm pretty stumped on getting rid of this thing.

Addition.txt

FRST.txt

Malwarebytes threat scan.txt

[AdvancedSetup]

Hello @Grimwol and

Please run the fix below. It will also create a zip file on your desktop with today's date.  Please attach that file on your next reply too.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Thanks

Ron

 

[Grimwol]

Thanks for the reply.

I should mention that "cdn.immereeako" only appeared very briefly on the Google homepage, if that's even the problem. Since then, Firefox keeps opening up to Microsoft.

Here are the files after running the fix.

27.11.2018_14.28.02.zip

Fixlog.txt

[AdvancedSetup]

Please run the following for me.

 

Then after that has completed, run the following.

 

 

Please download the following scanner from Kaspersky and save it to your computer: TDSSkiller

Then watch the following video on how to use the tool and make sure to temporarily disable your security applications before running TDSSkiller.

PC Winvids - How to run Kaspersky TDSSKiller

If any infection is found please make sure to choose SKIP and post back the log in case of a False Positive detection.

Once the tool has completed scanning make sure to re-enable your other security applications.

Thank you

Ron

 

 

[Grimwol]

The Anti-Rootkit software didn't turn up anything, however TDSSKiller did detect a threat.

Here's the log.

TDSSKiller.3.1.0.20_27.11.2018_17.20.32_log.txt

[AdvancedSetup]

Please go ahead and have TDSSKiller remove that entry.

Then after the reboot run the following to reset your router.

 

Please review the following website and read it before continuing and then do a Hard Reset back to Factory Defaults for your router.
This information is only for resetting the router DO NOT erase, install, or update the firmware, just reset your router to factory defaults.

Reset And Reboot

Hard reset or 30/30/30

 

 

[Grimwol]

After deleting the threat, rebooting my PC and resetting the router, Firefox now displays the proper homepage. Hopefully that got rid of everything.

Thanks for all the help.

[AdvancedSetup]

Great, glad to hear.

I'll go ahead and close up your topic then. Take care and have a great week.

Don't forget your data backups

Backup Software

 

Cheers

Ron

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks