Need help to remove JS:Redirector-KT[Trj] from system

I just ran a full system scan. avast! detected a JS:Redirector-KT[Trj] in folder

C:\Users\Brigitte\AppData\Local\Google\Chrome\User Data\Default\Cache\f_003b2

I moved the virus to the Chest as recommended, but everything I read on this virus has me very worried. Should I try to remove the virus and how?

Thank you for your help.

From the location it was something found in your browser cache, first action should be to clear your browser cache.

When was this detected, e.g. on an on-demand scan ?

I just cleared the browser cache. It was an on-demand scan, run 3 hours ago. How can I make sure the virus is gone? From what I read, it can infiltrate files and registries undetected. I’m a little paranoid…

It is most likely gone, generally these redirection detections are found when actually browsing and the web shield blocks it.

The problem with reading support forums, is you can’t pin an instance down to being ‘exactly’ the same as yours. Most of those don’t originate from the browser cache but from other locations and are being driven but other malware.

A JS:Redirector-KT is a piece of javascript that redirects to another site (usually a malicious one) within a page (usually an html web page. Though there are legit purposes to redirect traffic to another page many aren’t.

Sitting in the browser cache the file would be dormant/inert until run at which time avast on-access scanners would have scanned it and alerted, had you not done the on-demand scan you would have been none the wiser about this dormant file.

So some of those topics you have been reading have been such alerts from the real-time shields, which are different.

You can run another scan using - MalwareBytes Anti-Malware (MBAM), On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later. Install, Update, Run and post the contents of the log file after the scan.

Hello,
I do have the same problem/virus/trojan JS:Redirector-KT[Trj]
and how can I remove/clean my files: 1x in index.php and 1x in home.php?
Using/choosing the repair function of Avast is of no need - error message
from Avast saying: “impossible to remove”??

Thanks in advance for your help!

@Zadig256
when asking for help, start a new topic…dont ask inside someone else’s topic

see here how to, first post by DavidR…click the pic
http://forum.avast.com/index.php?topic=53253.msg576064#msg576064

Hello Pondus!
Ok, thanks and done! :wink:

Below are the contents of the log file after running MalwareBytes Anti-Malware (MBAM). It’s all clean! Thank you so much for your help and all the information you provided which really helped take away the worry.

Malwarebytes’ Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8041

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

10/29/2011 1:06:35 PM
mbam-log-2011-10-29 (13-06-35).txt

Scan type: Full scan (C:|)
Objects scanned: 349216
Time elapsed: 1 hour(s), 3 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

OK, it looks like it was isolated to the browser cache or the real-time on-access scanner should have alerted.

You can keep MBAM, it is a good back-up scanner to compliment avast. A point of note the Quick scan is generally enough for routine scanning as it is looking at more commonly infected areas/registry/files, etc.

Thanks again.

No problem, glad I could help.

Welcome to the forums.