tab opened and redirected to binaryprfessional.com

Viruses and worms
1

Hi

Hope you can help.

When using any browser, (chrome or IE) etc they are running slowly and lockup, crash.
I’m finding that sometimes it opens another tab and goes to wXw.binaryprofessional.com or to a few other sites.
Also, I’m finding that I get Safe Web popups with adverts to buy things.

Lastly, today I got a popup with a message saying that there is a new browser to download which appeared on my desktop.
I’ve attached a screenshot that contains the message.

I’ve tried a boot scan, MS mailware malious scan and Advanced System Care. But nothing has found a problem.

I hope someone might have an idea how I can get rid if this.

Thanks
Ravi

2
Advanced System Care.
some info about IObit, the software company that make Advanced system care

https://forums.malwarebytes.org/index.php?/topic/29681-iobit-steals-malwarebytes-intellectual-property/

http://archive.news.softpedia.com/news/Malwarebytes-Accuses-IObit-Plays-Dead-126389.shtml

3

download and run AdwCleaner http://www.bleepingcomputer.com/download/adwcleaner/
attach log

see instructions here https://forum.avast.com/index.php?topic=53253.0
run Malwarebytes and Farbar Recovery Scan Tool as instructed and attach logs

malware expert will be online tomorrow and assist you

4

Hi Pondus

Thanks for the help.

I wasn’t aware of the IOBit issue. I’ll be removing this! I guess I’d better do this after my PC clean?

I’ve just run AdwCleaner twice. The first time it detected some folders, and files which I cleaned. I repeated and it then didn’t appear to report anything else.

However, each time after the reboot Avast reported an infection that was blocked.
Please see the attachments of the adwCleaner logs and the Avast reported infection.

I also saw that Safe Web was still appearing when using the browser. So ,I guess the issue is still there.

I’ll attempt to run Malwarebytes now.

Regards
Ravi

5

Could you now scan with FRST and I will remove it manually

6

Hi

I ran MalwareByte twice. The first time as a User the second after reboot as admin.
Both times it found problems?

Please find attached the log files.

Also, attached is the FRST logs.

Thanks again.
Kind Regards
Ravi

7

Lets me know how the computer is behaving after this

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3849484204-756282454-4230851048-1017 -> {8E05F131-D25E-4ED2-9C47-EBB0FD999A92} URL = BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File CHR HKLM-x32\...\Chrome\Extension: [poimdfnhgefmnkeefbjibbiemlimdnof] - No Path 2015-01-08 17:51 - 2015-01-08 17:51 - 00000000 ____D () C:\ProgramData\Browser 2014-12-28 09:25 - 2014-12-28 09:26 - 00000000 ____D () C:\ProgramData\RlOGZsHi EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

8

Hi

Please find the FRST fix log and AdwCleaner log.

BTW After running the FRST with the fixlist file, on powerdown it generated a windows failure on a blue screen.
Reboot ok, with Windows reporting a previous crash.

Thanks
Ravi

9

Hi ravi5208,

Break that live link in your initial posting like with wXw.
Some additional information on this link as I found the following to be public available info
This site is vulnerable through outdated server software: Nginx Found: nginx/1.2.1
IDS alert for “ET INFO Exectuable Download from dotted-quad Host”.
Here they already know this website is suspicious: https://www.mywot.com/en/scorecard/binaryprofessional.com?utm_source=addon&utm_content=popup …and a PHISH and a scam!
Issues: http://richinwriters.com/binaryprofessionalcom-review-scam/
Whu they want to get a clean bill of health here? → http://www.scamadviser.com/is-binaryprofessional.com-safe.html
Peter Kleissner’s VirusTracker comes up with these scan data: www.binaryprofessional.com,Ghosted,
scam,Not in namespace, - 1 change on 2 unique name servers over 1 year

polonus

10

How is the system behaving now ?

11

Hi

Sorry, should have said. So far so good!

I can’t see any issues at the moment.

I’m going to uninstall IOBit and reinstall chrome.

Thank you very much for all the help.

Cheers
Ravi

12

Hi ravi5208,

Thanks for breaking that live link, :wink:

Stay safe and secure both offline and online,

polonus

13

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version

https://dl.dropboxusercontent.com/u/73555776/javara.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme :wink:

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave: