Malware URL linked to Winamp.exe

system · 2015-06-07T02:52:33.000Z

Hello,

Since yesterday every so often ( maybe 5 or 6 hours) I get a pop-up from avast saying that it blocked an infection the details are as follows
URL: hxtp://sites.securepaynet.net/redirect_0.html
Infection: URL: Mal
Process: C:\Program Files (x86)\Winamp\winamp.exe

I ran malawarebytes and avast and nothing came up after the first instance yesterday, but it came up again today. I reran malaware bytes and still nothing. I uploaded the file in question to virustotal and it said it looked safe. My question is, is this a false positive or is my computer infected with something. I have attached the logs discussed in the pinned forum post. Thank you for your time and assistance.

TwinHeadedEagle · 2015-06-07T06:33:26.000Z

Hello,

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
bitsadmin /reset /allusers;b
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-06-07T14:18:11.000Z

The results of the ZOEK scan are attached.

As an addendum: Shortly after submitting this I opened winamp and the same message popped up.

TwinHeadedEagle · 2015-06-07T14:41:59.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Make sure that Addition option is checked.
[*]Press Scan button and wait.
[*]The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

system · 2015-06-07T18:02:54.000Z

The logs you requested are attached

TwinHeadedEagle · 2015-06-07T18:07:33.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

system · 2015-06-07T18:27:42.000Z

I ran FRST as request and have attached the log that it produced.

TwinHeadedEagle · 2015-06-07T18:28:15.000Z

Good. How is the situation now?

system · 2015-06-07T18:36:37.000Z

It seems to be ok, nothing is popping up randomly and everything seems a bit faster. Did you find anything in those scans that I should be worried about ( I.E: Do I need to change all of my passwords or anything like that? Thank you for all of your help.

TwinHeadedEagle · 2015-06-07T18:38:36.000Z

You had browser hijacker, I am not sure if this infection is that severe to steal passwords, but you won’t make a mistake if you change your passwords.

system · 2015-06-07T19:28:43.000Z

Was it just searchscopes that you found or where there others?

TwinHeadedEagle · 2015-06-07T20:06:08.000Z

Chrome was hijacked.

system · 2015-06-07T20:58:18.000Z

So I just had another pop-up appear and here is the info:

Avast infection blocked
URL: hxtp://66.199.231.59/c29e7461
Infection: URL:Mal
Process: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

I have reran AswMBR, Malawarebytes, and FRST and have attached the logs.

TwinHeadedEagle · 2015-06-07T21:00:44.000Z

https://sites.google.com/site/cannedfixes/adwcleaner/adwcleaner_new.png
Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your Desktop.

[*]Right-click on
https://sites.google.com/site/cannedfixes/adwcleaner/adwcleaner_new.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[*]Wait until the database is updated.
[*]Accept the Terms of use and click Scan.
[*]When finished, please click Clean.
[*]Upon completion, click Report. A log (AdwCleaner[S*].txt) will open.

Please include the contents of that file in your reply.

Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

system · 2015-06-07T21:10:07.000Z

I tried downloading and running ADW and it crashes right as it starts its generic search.

Edit: I tried to run ADW with all virus and firewall programs disabled and the same result occured.

TwinHeadedEagle · 2015-06-08T06:42:20.000Z

Did you download latest version from this link?

http://www.bleepingcomputer.com/download/adwcleaner/

system · 2015-06-08T15:35:06.000Z

Yes, I tried that multiple times.

TwinHeadedEagle · 2015-06-08T15:35:54.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Make sure that Addition option is checked.
[*]Press Scan button and wait.
[*]The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

system · 2015-06-08T17:50:32.000Z

the logs you requested are attached.

Announcements