Solved Can't Get ride of Malware Redirects

[Broni]

How are things now?

 

[JoeFarrelly]

So far so good, no redirects yet, but I have thought that before and it came back, so I will do some more websurfing and let you know. So far I have only used Firefox. I will see how things work, then if all goes well, I'll try using IE. If I get redirects soon after using IE, that might tell us something. I will be in touch.

 

[Broni]

BTW what is your drive G and this file?

G:\VZW_Software_upgrade_assistant.exe

 

[JoeFarrelly]

I think that is for my Verizon Wireless smart phone. The G; drive might be the drive/memory chip inside the phone when I connect the phone to my PC with a USB cord to charge it.

 

[JoeFarrelly]

No redirects so far, but I am constantly getting a warning message popping up that says:

The page at http://lax1.ib.adnxs.com says not self = top

and then I have to click ok to get rid of it.
What is that about? Is it a failed redirect to an ad page? How do I get rid of that popup?

 

[JoeFarrelly]

Also, I am getting a warning popup that shockwave did not complete, then I am asked if I want to wait (during which Firefox freezes) or to "continue the script). Again, is this some of the cleanup we need to do?

 

[Broni]

You don't want ib.adnxs.com.
Which browser is affected? What about other browsers?

The above should be removable by AdwCleaner and JRT and MBAM so you may want to re-run those tools.

 

[JoeFarrelly]

I have only used Firefox so far. I ran AdwCleaner and JRT and MBAM but they didn't find anything, I can post the logs if you like.

 

[Broni]

Reset Firefox: https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems

If the above didn't help...

Uninstall Firefox completely using this manual: http://kb.mozillazine.org/Uninstalling_Firefox
NOTE. Use MozBackup: http://mozbackup.jasnapaka.com/ to backup your bookmarks and passwords. Do NOT backup anything else.
Install fresh copy.

 

[JoeFarrelly]

I reset Firefox and so far so good. No redirects yet. I also tried using IE for the first time and didn't get any redirects but I did get a couple instances of the pop up message about not self = top It goes away when I click it but it's annoying and I don't know what that is. I will do some more websurfing to test it out.

 

[Broni]

If it happened in IE...

Reset Internet Explorer.
Download MIcrosoft FixIt file from here: http://go.microsoft.com/?linkid=9646978
You can use ANY browser to download "FixIt" file.
Double click on downloaded MicrosoftFixit50195.msi file to run the fix.
Make sure you follow ALL steps listed there.

 

[JoeFarrelly]

That link downloaded a version that won't open on my version of Windows, but I followed previous instructions and reset IE and so far things are working well with both browsers.

 

[Broni]

Cool

Your computer is clean

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download

DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

• Activate UAC (optional; some users prefer to keep it off)
• Remove disinfection tools
• Create registry backup
• Purge System Restore
• Reset system settings

Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642

12. Please, let me know, how your computer is doing.

 

[JoeFarrelly]

I am thrilled to report that the computer does indeed seem clean. I have not had any redirects at all, so I am finally beginning to think the problem really is resolved. Now I have to make sure it doesn't come back. I sincerely want to thank you again for all the time and expertise you gave. I could not have done it without your help. Please send a copy of this message to your supervisor so he/she knows how hard and how competently you worked to resolve this. Or, you can provide me with your supervisor's email address and I will send a message directly. Thanks again.

 

[Broni]

Way to go!!
Good luck and stay safe

TechSpot Administrator Julio Franco: https://www.techspot.com/community/members/julio-franco.1/