Pop-ups about "JS:Redirector-BXI [Trj]"on opening a new page in Firefox / Chrome

essexboy · 2015-09-21T15:11:45.000Z

Let me know if this stops it

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION HKU\S-1-5-21-2946733716-4213665846-2416547646-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-09-21T15:41:11.000Z

See Fixlog.txt attached.
Just a FYI , The issue is still not fixed and the popups still come up .

essexboy · 2015-09-21T16:07:16.000Z

OK next step

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S0].txt as well.

system · 2015-09-21T16:26:55.000Z

As attached. Thanks .

EDIT : Could this be a router issue. Dont want to steer you guys on the wrong track but all tools like SuperAntiSpyware etc have been run before and are not showing any infections

essexboy · 2015-09-21T16:34:36.000Z

Unfortunately with Firefox and Chrome they are easy to corrupt… To check the router hypothesis do you get the same alert in Internet explorer ?

Also are Chrome and firefox synched ?

system · 2015-09-22T03:37:33.000Z

I don’t use Explorer - I only tried it just now for the sake of experimenting and it seems to be fine.
I have uninstalled Chrome.
I am not keen to uninstall Mozilla because I fear it wont solve the problem .

essexboy · 2015-09-22T13:50:06.000Z

Run Firefox in safe mode and see if the alert still occurs https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode

system · 2015-09-22T15:15:27.000Z

Have done the recommended configuration - however the alert still comes.

essexboy · 2015-09-22T15:17:30.000Z

Have you emptied all the caches in firefox ? As this appear to be a possible corruption of the main FF programme

system · 2015-09-22T15:29:39.000Z

I had tried the refresh firefox earlier. Based on your advice, I cleared the WEB Cache…The application cache showed 0 MB …
I restarted firefox…However issue still exists

Should I just uninstall Firefox…and reset my router ??

essexboy · 2015-09-22T16:31:40.000Z

If it was the router then IE would also be affected

A fresh install of Firefox would be best … Don’t forget to save your bookmarks

system · 2015-09-23T12:16:32.000Z

Latest update - I uninstalled Mozilla and tried using Microsoft Lynx all day. Worked well without popups for few hours now I see redirects to tradeadexchange again. This happens on every click .
I have not installed Chrome or Mozilla again yet. Was trying to keep the system as clean as possible.
I ran MalwareAnti Bytes but it just detected some adware cookies . I guess it cannot detect the actual virus…
Any thoughts ??

I am again suspecting the router but I have no experience troubleshooting/securing routers . I am confused why Avast and other such tools cannot detect the virus if any on my computer and hence suspecting the router

essexboy · 2015-09-23T13:39:34.000Z

You can reset the router easily enough… On the back of the router will be a small hole marked reset… Using a biro push in the small switch, you should hear a click. The router is now reset.

There is nothing showing on your system

What is MS lynx ? as it is something I have not come across before

system · 2015-09-23T15:05:25.000Z

Sorry…I was referring to Microsoft Edge…I think it got installed by default when I upgraded Windows…

essexboy · 2015-09-23T16:28:30.000Z

Ah OK edge, a nightmare of a browser

Did the router reset work ?

Re-install Firefox and see if the redicts/alerts are still there

system · 2015-09-27T15:18:11.000Z

I reset the router …Took me some time to understand how to do it because on resetting , the SSID and other properties went to default and had to set up the network all over again . I am using an old TPLINK Router.
Not sure if the problem has gone away . I will try for a day and will update you tomorrow.
Is there any script etc you would like me to run. Any advice on how to protect the router maybe

Regards
N

essexboy · 2015-09-27T15:39:09.000Z

The main protection is to give the router a strong password as it was probably set to default

system · 2015-09-28T12:02:24.000Z

Hello
I reset the router - also changed the password as recommended earlier . I dont remember if the password was the default one on the old setup. However the problem still exists .

I ran
a) SuperAntiSpyware
b) Zoek
c) FRST64
d) AdwCleaner ( dont remember the order I ran it though )

Then I installed Chrome coz I am not too familiar with Edge.

See FRST.log attached . I get the redirects on Chrome also …Guessing the problem exists on my computer and not the router . Also running out of ideas .

EDIT : See Zoek Results attached. One possible issue I see is that it still detects Firefo plugins where by I have uninstalled Firefox . Could this be a potential issue .

essexboy · 2015-09-28T14:00:08.000Z

Firefox remains in the registry even after it is uninstalled

I cannot see where this is originating and it occurs every time you open Chrome

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-2946733716-4213665846-2416547646-1001\...\MountPoints2: F - "F:\AutoRun.exe" HKU\S-1-5-21-2946733716-4213665846-2416547646-1001\...\MountPoints2: {08bbecdf-0964-11e5-8266-d07e3593bb96} - "F:\setup_vmb_lite.exe" /checkApplicationPresence HKU\S-1-5-21-2946733716-4213665846-2416547646-1001\...\MountPoints2: {290a5e41-04dd-11e5-8265-d07e3593bb96} - "F:\AutoRun.exe" HKU\S-1-5-21-2946733716-4213665846-2416547646-1001\...\MountPoints2: {cff3687f-1541-11e5-826a-d07e3593bb96} - "F:\AutoRun.exe" AppInit_DLLs: C:\PROGRA~2\LENOVO~1\LENOVO~1\bin\SPVC64~1.DLL => No File AppInit_DLLs: C:\PROGRA~2\Amazon\AMAZON~1\AMAZON~2.DLL => C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE64.dll [119616 2014-09-27] (Amazon Inc.) 2015-09-28 17:16 - 2015-08-03 10:37 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat Reg: reg delete "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" /f Reg: reg delete "HKEY_USERS\S-1-5-21-3016000360-1041427054-1883944200-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" /f Reg: reg add "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" /f Reg: reg add "HKEY_USERS\S-1-5-21-3016000360-1041427054-1883944200-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" /f Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-09-28T15:16:44.000Z

Thanks for all the help. Plz see log file. Issue remains unfortunately …
Its a tradeadexchange redirect …Just noticed that I may have not mentioned the popup that is opening …

Announcements