[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help!

frustrationgalore
New Helpee

Posts: 18

[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 26, 2015 16:02:34 GMT -8

Post by frustrationgalore on Jul 26, 2015 16:02:34 GMT -8

Hi. I just came over here from the Norton forum after making a post. I was linked to a list of free sites they said many users there have used to help them get rid of malware and this one was at the top of the list. This is what I posted there:

I was browsing a site I regularly use for research last night on Firefox when I clicked on a link to move to the next page of the site (a page I've been on many times before) and suddenly I was redirected to an adult site. I was horrified and immediately X-ed out, but when I tried to bring up any page on my normal site again, it constantly redirects to the adult site. I checked my normal website on a different computer and it works fine, so I knew that I must have some kind of redirect virus. Norton nor Microsoft Windows Malicious Software Removal Tool can detect the malware/virus even after running full system scans, but I want to rid my computer of whatever it is immediately.

What other safe ways are there detect and remove a virus like this?

Please keep in mind I am not a tech savvy individual. I've successfully removed malware/viruses from computers a couple times in the past that have snuck by my Norton, but always with the use of a helpful YouTube video with step by step instructions. (Usually because when I've tried to check help boards, all the tech lingo sends my brain reeling.) This time I haven't been able to find such a video and I've come to help boards because I'm pretty desperate. So far there is only the one site that seems to have the redirect attached to it, but I'm afraid of what else this malware or virus could be doing on my computer that I'm unaware of.

Last Edit: Oct 2, 2015 23:34:38 GMT -8 by dbrisen

dbrisen Malware Removalists Posts: 3,688	[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 26, 2015 20:16:47 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Jul 26, 2015 20:16:47 GMT -8 Please follow the steps in this thread ( I think I am infected. What do I do? ). Once you have provided the logs required, I will assist you as best we can. Thank you.
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

frustrationgalore New Helpee Posts: 18	[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 26, 2015 21:32:09 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by frustrationgalore on Jul 26, 2015 21:32:09 GMT -8 Norton says both Farbar downloads are threats and removed them. How do I make exceptions for these files?

dbrisen Malware Removalists Posts: 3,688	[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 27, 2015 17:11:45 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Jul 27, 2015 17:11:45 GMT -8 You will have to disable Auto-Protect for 30 minutes to download and run FRST.
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

frustrationgalore
New Helpee

Posts: 18

[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 27, 2015 17:48:48 GMT -8

Post by frustrationgalore on Jul 27, 2015 17:48:48 GMT -8

Okay, I got the scans and tried to copy and paste the first log in the message reply, but it triggered some kind of site warning and said I was blocked from making the post.

Edit - I've never heard of wikisends or pastebin before. How do I use them to get files here? (I tried to add the FRST attachment, but it was too big.)

Edit 2 - I think I figured out wikisends, but every time I try to upload either file it says an error has occurred and to start again.

Edit 3 - I signed up for pastebin, but won't uploading these files be a violation of their rules? It says no uploading personal data and that you could be flagged. If the content was flagged here for trying to copy and paste as suggested, wouldn't the same content be flagged there?

Last Edit: Jul 27, 2015 18:22:12 GMT -8 by frustrationgalore

dbrisen Malware Removalists Posts: 3,688	[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 27, 2015 18:35:52 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Jul 27, 2015 18:35:52 GMT -8 pastebin.com would be fine. The error on this forum is due to the security measures ProBoard takes on their (and all users) behalf. You should be fine using pastebin.
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

frustrationgalore New Helpee Posts: 18	[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 27, 2015 19:19:30 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by frustrationgalore on Jul 27, 2015 19:19:30 GMT -8 I tried repeatedly and finally got them to work on wikisends. FRST.txt Addition.txt
	Last Edit: Jul 27, 2015 19:19:54 GMT -8 by frustrationgalore

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 27, 2015 20:30:39 GMT -8

Post by dbrisen on Jul 27, 2015 20:30:39 GMT -8

And you did good and I will try very hard to not let you down. Always come back and ask questions if you don't understand my directions.

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

Coupon Printer for Windows

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
FF Keyword.URL: hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=73FAFC4A-4A96-4353-BB7C-A3DC914138C0&n=780c4a0a&ind=2014071306&p2=^ZX^xdm125^S10073^us&si=TFRR500087911_39382074&searchfor=
FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll [2014-01-22] (Pando Networks)
C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\browser\plugins\npMozCouponPrinter.dll [2014-12-03] (Coupons, Inc.)
C:\Program Files\mozilla firefox\browser\plugins\npMozCouponPrinter.dll
FF SearchPlugin: C:\Users\Mom\AppData\Roaming\Mozilla\Firefox\Profiles\4obpa6x0.default\searchplugins\safesearch.xml [2015-06-26]
C:\Users\Mom\AppData\Roaming\Mozilla\Firefox\Profiles\4obpa6x0.default\searchplugins\safesearch.xml
FF Extension: RadioRage - C:\Users\Mom\AppData\Roaming\Mozilla\Firefox\Profiles\4obpa6x0.default\Extensions\4jffxtbr@www.radiorage.com [2015-06-01]
C:\Users\Mom\AppData\Roaming\Mozilla\Firefox\Profiles\4obpa6x0.default\Extensions\4jffxtbr@www.radiorage.com
CHR Extension: (Google Search) - C:\Users\Mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-25]
C:\Users\Mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
R2 CouponPrinterService; C:\Program Files\Coupons\CouponPrinterService.exe [154096 2014-12-03] (Coupons.com Inc.)
C:\Program Files\Coupons\CouponPrinterService.exe
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
C:\Windows\SystemRoot\system32\drivers\blbdrive.sys
C:\Windows\system32\DRIVERS\ipinip.sys
C:\Windows\system32\DRIVERS\nwlnkflt.sys
C:\Windows\system32\DRIVERS\nwlnkfwd.sys
2015-07-24 19:46 - 2015-07-24 19:46 - 00000000 _____ C:\Windows\system32\REN9CD5.tmp
2015-07-24 19:46 - 2015-07-24 19:46 - 00000000 _____ C:\Windows\system32\REN9CC5.tmp
2015-07-24 19:46 - 2015-07-24 19:46 - 00000000 _____ C:\Windows\system32\REN9CC4.tmp
2014-08-16 10:58 - 2014-12-08 20:40 - 0000580 _____ () C:\Users\Mom\AppData\Roaming\wklnhst.dat
2014-03-25 19:02 - 2014-05-19 00:21 - 0016896 _____ () C:\Users\Mom\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2007-08-31 01:12 - 2007-08-31 01:12 - 0000344 _____ () C:\ProgramData\hpzinstall.log
C:\Users\Mom\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\Mom\AppData\Local\Temp\ose00000.exe
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Also, how is your system running now?

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

frustrationgalore
New Helpee

Posts: 18

[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 27, 2015 21:01:08 GMT -8

Post by frustrationgalore on Jul 27, 2015 21:01:08 GMT -8

Fixlog.txt

I'm able to successfully go to my website again without any redirects! Thank you so much! And double thank you for being patient with me despite all my bumps in getting you the information.

Is there anything else you need at this point? (If not, is it all right to delete any of those desktop files now?)

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help! Jul 27, 2015 22:19:33 GMT -8

Post by dbrisen on Jul 27, 2015 22:19:33 GMT -8

When we are finished, I will direct you on cleaning the tools and logs off your system (a good worker always cleans up after themselves). You have done good so far and I'm glad the redirects are gone. I would like to have a deeper look now that the active malware is broken.

FIRST >>>>

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

[/b][/font] Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
You will see the following console:

Click the Scan button and wait for the scan to finish.

After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.

Click the Clean button.

Everything checked will be deleted.

When the program has finished cleaning a report appears.

Once done it will ask to reboot, allow this

On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[S0].txt
[/ul]

Optional:
NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

SECOND >>>>

Malwarebytes' Anti-Malware
Please download the latest version of Malwarebytes' Anti-Malware from Here. The version you have installed needs to be updated.

Double Click on the mbam-setup.exe file to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

When the main screen opens, if the database is out of date, you can click on the Fix Now banner or the Update Now link

Once the program has loaded and updated, select "Scan Now >>" to start the scan.

The scan may take some time to finish, so please be patient.

If any malware is found, you will be presented with a screen like the one below.

If any malware is found, make sure that everything is checked, and click Remove Selected.
When the scan is complete, click View detailed log >> to view the results.
The report screen will open.
At the bottom click on Export and select as txt file, save the file to your desktop and click OK. When the export is complete, select OPEN.
The log file will be opened in your default text file viewer (usually Notepad); select the whole text (Ctrl + A) and copy (Ctrl + c) it to paste here in a reply.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

[ti]SOLVED[/ti]Redirect Virus/Malware on Firefox? Help!

Post by frustrationgalore on Jul 26, 2015 16:02:34 GMT -8

Post by dbrisen on Jul 26, 2015 20:16:47 GMT -8

Post by frustrationgalore on Jul 26, 2015 21:32:09 GMT -8

Post by dbrisen on Jul 27, 2015 17:11:45 GMT -8

Post by frustrationgalore on Jul 27, 2015 17:48:48 GMT -8

Post by dbrisen on Jul 27, 2015 18:35:52 GMT -8

Post by frustrationgalore on Jul 27, 2015 19:19:30 GMT -8

Post by dbrisen on Jul 27, 2015 20:30:39 GMT -8

Post by frustrationgalore on Jul 27, 2015 21:01:08 GMT -8

Post by dbrisen on Jul 27, 2015 22:19:33 GMT -8