Occasional forced to open random ad website

Viruses and worms
1

Hi,

I have recently got something on my computer that forces me to link to an ad website when I use the internet. That happens with Chrome and Firefox. Avast boot up scan and malwarebytes scans do not catch it. Any help is much appreciate it.

2
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
2018-04-11 16:34 - 2018-04-11 16:34 - 000178688 ____N (Microsoft Corporation) C:\Users\Lai i5\AuisaVAHaiDb.exe
2018-04-11 16:34 - 2018-04-11 16:34 - 000059904 ____N (Microsoft Corporation) C:\Users\Lai i5\KaYEUJOUf.exe
2018-05-26 11:28 - 2018-07-31 16:48 - 000000080 _____ () C:\Users\Lai i5\AppData\Roaming\krenvprf.kep
2016-03-11 12:17 - 2016-03-11 12:21 - 000014848 _____ () C:\Users\Lai i5\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-09 22:40 - 2015-02-09 22:40 - 000000088 _____ () C:\Users\Lai i5\AppData\Local\ee5911ed1b95e90a5fa8f89e720141c0
2018-08-14 07:57 - 2018-08-14 07:57 - 000000002 _____ () C:\Users\Lai i5\AppData\Local\imw.ini
2014-08-02 17:27 - 2014-08-02 17:27 - 000007597 _____ () C:\Users\Lai i5\AppData\Local\Resmon.ResmonCfg
2017-01-11 20:25 - 2017-01-11 20:25 - 000032768 _____ () C:\Users\Lai i5\AppData\Local\Web Data
2017-01-11 20:25 - 2017-01-11 20:25 - 000000512 _____ () C:\Users\Lai i5\AppData\Local\Web Data-journal
2015-12-13 17:30 - 2015-12-13 17:30 - 000000000 _____ () C:\Users\Lai i5\AppData\Local\{AE8FF514-4B81-449D-A224-82235CBB7E9F}
HKU\S-1-5-21-2629497061-2309145617-1697654609-1000\...\ChromeHTML: ->  <==== ATTENTION
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
3

I went through the instructions and attached is the fixlog.txt. Thank you for looking at this.

4

OK. Tell me please what is Chrome&Firefox status now?

5

I still get the random redirect. I think it happens once every 30 mins or so. I didn’t keep track of how often.

Sites that I get directed to:
hxxp://lanegoz.ru/cl/?guid=qywgbug864bc8cggdj0c2ikmuwfccdrt&prid=3&pid=4_1324_0
hxxps://www.traffic-media.co/mg15439.html

6

Please post new FRST.txt and Addition.txt logs.

7

New FRST.txt and Addition.txt attached.

8

Does it happen if you have only one tab with for example YouTube?

9

Just tried it. I had youtube on and all tab closed. Still got the redirect.

10

Did you install Tampermonkey?

11

I don’t think I did should i?

12

If you didn’t install it remove Tampermonkey and Scriptmonkey from Chrome.

13

I will do so when I get home today.

14

Removing the Tampermonkey and Scriptmonkey extensions solved the problem. Thank you for all your help.