A browser redirect occurs frequently, and unable to stop it

[EndlessE]

Greetings,

On a pretty frequent basis, when my laptop connects to the house wifi it would instead show the network it connected to would be named the same but with an extra "2" at the end of the name despite it not showing up on the list of available networks. The browser would immediately pop up with a URL to a "go dot microsoft" site. Only disconnecting the wifi and reconnecting to when it doesn't show the added "2" at the end of the network name does it stop redirecting. I already have premium malwarebytes, but it doesn't
detect anything. I've grown to the point where I realize it'll continue unless I get help in resolving what I don't know how to do. Just an FYI it happened a little while ago, while making this post so definitely still present.

FRST logs attached.

[EndlessE]

Sorry but had noscript enabled, so the attachments didn't go through on my screen.

FRST logs attached.

FRST.txt Addition.txt

[EndlessE]

Here is the malwarebytes threat scan log. See attachment.

 

Any help in resolving/preventing the redirect from occurring again would be greatly appreciated.

MBlog.txt

[kevinf80]

Hello EndlessE and welcome to Malwarebytes,

Continue please:

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from. NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. NOTE-1: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The following directories are emptied:   Windows Temp Users Temp folders Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Flash Player cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. The system will be rebooted after the fix has run. Next, Open Malwarebytes, select > "settings" > "protection tab" Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Go back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes quarantine any found entries... To get the log from Malwarebytes do the following:   Click on the Detection History tab > from main interface. Then click on "History" that will open to a historical list Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download "Microsoft's Safety Scanner" and save direct to the desktop Ensure to get the correct version for your system.... https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download Right click on the Tool, select Run as Administrator the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\msert.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time.... Let me see those logs in your reply... Thank you, Kevin..

fixlist.txt

[EndlessE]

Greetings,

              Ok all done for fixlog.txt see attachment.

For malwarebytes scan log.  See the following.

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 9/26/20
Scan Time: 5:17 AM
Log File: 1ee878f0-ff6c-11ea-a3ca-6cc217780fc1.json

-Software Information-
Version: 4.2.1.89
Components Version: 1.0.1045
Update Package Version: 1.0.30394
License: Premium

-System Information-
OS: Windows 8.1
CPU: x64
File System: NTFS
User: ARIGATO\Arigato

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 242558
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 7 min, 32 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

 

For AdwCleaner log. See the following.

# -------------------------------
# Malwarebytes AdwCleaner 8.0.7.0
# -------------------------------
# Build:    07-22-2020
# Database: 2020-07-20.1 (Local)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    09-26-2020
# Duration: 00:00:08
# OS:       Windows 8.1
# Cleaned:  28
# Failed:   0

***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

Deleted       Preinstalled.CyberLinkMediaEspresso   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}
Deleted       Preinstalled.CyberLinkMediaEspresso   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{E3739848-5329-48E3-8D28-5BBD6E8BE384}
Deleted       Preinstalled.CyberLinkShellExtension   Registry   HKLM\Software\Classes\CLSID\{3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2}
Deleted       Preinstalled.HPCleanFLC   File   C:\Users\Arigato\Desktop\Connected Photo.lnk
Deleted       Preinstalled.HPCoolSense   Folder   C:\Program Files (x86)\HEWLETT-PACKARD\HP COOLSENSE
Deleted       Preinstalled.HPCoolSense   Folder   C:\Users\Arigato\AppData\Local\HEWLETT-PACKARD\HP COOLSENSE
Deleted       Preinstalled.HPCoolSense   Folder   C:\Windows\System32\Tasks\HEWLETT-PACKARD\HP COOLSENSE
Deleted       Preinstalled.HPCoolSense   Registry   HKLM\Software\Classes\CLSID\{224695A4-BD5E-4C38-B354-A4C828E61BF7}
Deleted       Preinstalled.HPCoolSense   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{E2C8D0C2-1C97-4C05-939A-5B13A0FE655C}
Deleted       Preinstalled.HPHealthCheck   Folder   C:\Program Files (x86)\HEWLETT-PACKARD\HP HEALTH CHECK
Deleted       Preinstalled.HPHealthCheck   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{6F340107-F9AA-47C6-B54C-C3A19F11553F}
Deleted       Preinstalled.HPSupportAssistant   Folder   C:\Program Files (x86)\HEWLETT-PACKARD\HP CUSTOMER FEEDBACK
Deleted       Preinstalled.HPSupportAssistant   Folder   C:\Program Files (x86)\HEWLETT-PACKARD\HP SUPPORT FRAMEWORK
Deleted       Preinstalled.HPSupportAssistant   Folder   C:\ProgramData\HEWLETT-PACKARD\HP SUPPORT FRAMEWORK
Deleted       Preinstalled.HPSupportAssistant   Folder   C:\Users\Arigato\AppData\Local\HEWLETT-PACKARD\HP SUPPORT FRAMEWORK
Deleted       Preinstalled.HPSupportAssistant   Folder   C:\Users\Arigato\AppData\Roaming\HEWLETT-PACKARD\HP SUPPORT FRAMEWORK
Deleted       Preinstalled.HPSupportAssistant   Folder   C:\Windows\System32\config\systemprofile\AppData\Local\HEWLETT-PACKARD\HP SUPPORT FRAMEWORK
Deleted       Preinstalled.HPSupportAssistant   Registry   HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE}
Deleted       Preinstalled.HPSupportAssistant   Registry   HKLM\Software\Classes\CLSID\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE}
Deleted       Preinstalled.HPSupportAssistant   Registry   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE}
Deleted       Preinstalled.HPSupportAssistant   Registry   HKLM\Software\Wow6432Node\\Classes\CLSID\{C0ABBA07-B636-47B8-B9E1-BB96D7CD4831}
Deleted       Preinstalled.HPSupportAssistant   Registry   HKLM\Software\Wow6432Node\\Classes\CLSID\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE}
Deleted       Preinstalled.HPSupportAssistant   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE}
Deleted       Preinstalled.HPSupportAssistant   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{8C696B4B-6AB1-44BC-9416-96EAC474CABE}
Deleted       Preinstalled.LenovoPower2Go   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}
Deleted       Preinstalled.LenovoPower2Go   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}
Deleted       Preinstalled.LenovoPowerDVD   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}
Deleted       Preinstalled.LenovoPowerDVD   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}

*************************

[+] Delete Tracing Keys
[+] Reset Hosts File
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [5367 octets] - [02/09/2020 00:32:08]
AdwCleaner[S01].txt - [5428 octets] - [12/09/2020 10:16:37]
AdwCleaner[S02].txt - [5489 octets] - [19/09/2020 03:26:32]
AdwCleaner[S03].txt - [5550 octets] - [19/09/2020 04:33:02]
AdwCleaner[S04].txt - [5611 octets] - [19/09/2020 04:36:08]
AdwCleaner[C04].txt - [2222 octets] - [19/09/2020 04:38:13]
AdwCleaner[S05].txt - [5373 octets] - [19/09/2020 04:48:27]
AdwCleaner[S06].txt - [5434 octets] - [26/09/2020 05:33:26]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C06].txt ##########

 

MSERT log, see the following.

 

---------------------------------------------------------------------------------------

Microsoft Safety Scanner v1.0, (build 1.323.1895.0)
Started On Sat Sep 26 05:48:45 2020
->Scan ERROR: resource process://pid:364,ProcessStart:132455399497578034 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:528,ProcessStart:132455399569144197 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:600,ProcessStart:132455399572425317 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:640,ProcessStart:132455399577270867 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:6032,ProcessStart:132455402337051454 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:5332,ProcessStart:132455402770247673 (code 0x0000012B (299))
->Scan ERROR: resource process://pid:2108,ProcessStart:132455405576410254 (code 0x0000012B (299))
->Scan ERROR: resource file://C:\hiberfil.sys (code 0x00000021 (33))
->Scan ERROR: resource file://C:\hiberfil.sys (code 0x00000021 (33))
->Scan ERROR: resource file://C:\pagefile.sys (code 0x00000021 (33))
->Scan ERROR: resource file://C:\pagefile.sys (code 0x00000021 (33))
->Scan ERROR: resource file://C:\swapfile.sys (code 0x00000021 (33))
->Scan ERROR: resource file://C:\swapfile.sys (code 0x00000021 (33))

Results Summary:
----------------
No infection found.
 

I believe that's everything, you asked for.  

Thanks for the help!

Fixlog.txt

[kevinf80]

Hiya EndlessE,

How is your PC responding now, any remaining issues or concerns...

Thanks,

Kevin...

[EndlessE]

Greetings kevinf80,

 

             Seems to be working good.  Thanks for your help, and one question while I have you.  Is it ok to fully delete the preinstalled software that AdwareCleaner quarantined?  My laptop doesn't need any of them?

[kevinf80]

Hiya EndlessE,

Yes you can remove all quarantined software.. You`re main problem was a malicious service and driver, both were quarantined with FRST. Just need to clean up now...

Right click on FRST here: C:\Users\Arigato\Downloads\FRST64.exe and rename uninstall.exe when complete right click on uninstall.exe and select "Run as Administrator" If you do not see the .exe appended that is because file extensions are hidden, in that case just rename FRST64 to uninstall That action will remove FRST and all created files and folders... Next, Remove all System Restore Points: https://www.tenforums.com/tutorials/33593-delete-system-restore-points-windows-10-a.html#option2 Create clean fresh Restore Point: http://www.thewindowsclub.com/create-system-restore-point Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/ Download and use a Password Management application. https://www.windowscentral.com/best-password-manager-windows From there you should be good to go... Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[kevinf80]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you

 

 

[AdvancedSetup]

Topic has been reopened per request.

Thanks

 

[EndlessE]

Ok, where to begin. 

First thank you reopening this topic AdvancedSetup.  Ok story time, after the above happened (*Note: Had Windows 8.1 on this laptop.) decided to attach new extensions to the browser I was using: malwarebytes browser guard, https everywhere, ClearURL, CookieAutoDelete, ublock origins, noscript was already used.  The browser I was and still am using is brave browser.  Anywho continuing the story down the line the fam decided to get a new stronger wifi router and I did the setup using this laptop.

I connected all the devices to the new router wifi, and it seemed ok except this laptop's wifi adapter wifi connection seemed to randomly cut out.  Tried to find updated drivers for the adapter to see if they could help,  finding them were a expletive for me to do Qualcomm atheros.  Digressing a bit saw a random youtube vid (Mentioned being reckless to AdvancedSetup, and Maurice in PM topic.) that upgrading to Windows10 if still on 7, 8, 8.1 was still free and here's how etc.  Followed through with it since the driver package for the Qualcomm atheros was for window10.

Did the upgrade method, and updated the wifi adapter driver using the driver package I downloaded.  The wifi still cuts out, and thought maybe I could use the cheap wifi extender that was being used to extend the previous router wifi range.  Without connecting it to the current wifi setup, I tried connecting to only the extender since the new router has a new SSID and the extender cannot connect to it.

Once it said I connected to the extender, a new browser redirect kicked in for my browser trying to connect to a new site I won't mention.  It didn't occur to me that I still could of been newly infected and that was cutting the wifi out to the new router,  the win10 upgrade method could of been suspect and installed new malware, or the driver package.

Or the adapter is dying, which I hope cause that would be best case scenario.  Any help would be greatly appreciated.  Most recent scan results show nothing, and FRST logs attached, Most recent scan logs attached.

FRST.txt Addition.txt Shortcut.txt MBytes.txt

[kevinf80]

Hiya EndlessE,

Not seeing anything in your logs to suggest malware or infection. Do all other devices you mention connect to the router without any issues...

Thanks,

Kevin..

[EndlessE]

Greetings kevinf80,

                              Thank goodness, that's a load off my back. Guess I shouldn't worry about the win10 upgrade method I did.

 I wouldn't say without "any" issues.  My smart phone on one day was unable to view sites for about half the night on the wifi.  That happened only once though, and hasn't happened since. (Could of been an IP issue since Spectrum has had maintenance, on occasion.) I only overheard my sibling mentioned that the "internet" was a little weird one day and that's about it. On other occasions an app on a TV wouldn't work, but that could of been the app provider's side since other app provider apps would still work.  If I had to say,  stability is about 95% for the other devices and about 70% for this laptop. 

I could be watching a youtube vid, and open a new tab to launch a site then suddenly both the vid would would straight stop and the launched site would show a cannot connect message.  Only for the wifi connect symbol in the bottom right show the laptop isn't connected to the wifi network anymore.  Only for my sibling in a room further away from the router to be watching TV via a roku app having no issues.  

Had days where two smart enabled TV's would be running at the same time/same wifi have no issues. (Not to mention all the smart phones connected to it too.) Other times when there's no one around but me, only to have the wifi drop from the laptop while my smart phone with mobile data turned off still stay connect and able to browse the web.  

Already tried the turning it off and on/unplugging it, (For the router.) method.  Didn't seem to help any.  If there's no malware I guess the adapter could be incompatible, or dying.  Which is what I hoped, and that extender that caused the redirect to occur is going to an recycling area that accepts electronics; not using that thing anymore.

Thanks for looking at those logs to see if I was infected or not.

[EndlessE]

*Side note while typing the above,  without knowing I got logged out of this site without signing out...weird

[kevinf80]

When your Laptop internet drops out right click on the internet icon on the Taskbar, then select "Troubleshoot" what feedback do you get..?

[EndlessE]

Already did that before, both when it dropped and when connected.

When it drops, it says to enable re/auto connect for it.  When it's connected, it says to do the unplug method on the router and then that it cannot connect to the network then immediately connects to it. (Lol, probably cause the SSID is hidden.)

[kevinf80]

Can you try connecting the laptop direct to the router with ethernet cable, see what happens..

[EndlessE]

Currently replying to this post, with the cable.  Definitely works better, it's going to be annoying moving the laptop to the living room when I want to browse / site search things. 🥾

[kevinf80]

Not really, trying to prove if this is a hardware issue... If it works good of ethernet then maybe you`ll need new internet wireless card. Not expensive and easy to replace..

[EndlessE]

Alright, got it.  I'll look into it.

Thanks again for the help!

[kevinf80]

Let me know the outcome..

[kevinf80]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you