www redirections

Viruses and worms
1

Hi,
When I am surffing the internet by chrome/ie my browser sometimes redirects me to:
hxxp://c.mclarenz.net/click
hxxp://notfound.lflink.com

Enclosed me logs.

Sorry for my poor english.

2

Could you attach the main OTL log please

3

another logs

4

Combofix and Hitmanpro were a bit of an overkill

Please download to your desktop Short cut cleaner
Then run.

https://dl.dropbox.com/u/73555776/sc%20cleaner.JPG

When the Shortcut Cleaner has finished scanning your hard drive it will create a log file on your desktop called sc-cleaner.txt and then display it.
Please post that log

5

you got it

6

essexboy will be back later today…he is usually here late UK time :wink:

7

Are you still getting redirects and are they confined to Chrome and IE

8

Sorry for late answer. I have a lot of other work.
For now there isn’t any redirections. What was it ?

I am not sure but something strange is when I search by google (only in Chrome, IE works good) word target service or targetservice. Please look at attached printscreen. Only on that computer google gives me marked result.

hxxp://targetservice.pl is my own site and I think it contains worm/virus, etc. code. I think this site is begining of my problems. Could you tell me is there any way to check files of my site?

9

Zulu scaler reports several suspicious JS files http://zulu.zscaler.com/submission/show/05123b6375a6bd164a30b4f18cad49c2-1362075783

10

essexboy I am totaly green in this. I have access to all files of this site, how can I check these files ?

11

I have asked iDonovan to have a look as he knows more than I

12

Ok, thanks. :slight_smile:

13

Hi klogier,

Your site leads to a fpert.qpoe.com?

With the Firefox browser and a Google referrer, I got:
HTTP/1.1 302 Moved Temporarily
Date: Thu, 28 Feb 2013 19:29:17 GMT
Server: Apache
Location: hXtp://fpert.qpoe.com/
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 20
Connection: close
Content-Type: text/html

See: http://urlquery.net/report.php?id=1187697
And: http://labs.sucuri.net/?details=fpert.qpoe.com

If you would, please upgrade your version of WordPress from 3.4.1 to 3.5.1.

Thanks,
~!Donovan

14

Thanks !Donovan,
Unfortunately, I have no knowledge to do this. Site was made by a hired company, they bought domain for me to, when the problems started they say, we can’t do anything and left me with a problem. I bought new adress by myself and want to transfer this site to it, but I don’t know is it safe. I have all site files downloaded from old adress. Sorry I am totaly green on this. :-[

15

Can you access your WordPress dashboard? Default location is yoursite.com/wp-admin/.

The “Updates” link will be located in the sidebar.

16

Uff I found that, what now?

17

Do you know your hosting provider? Can you access your site’s cpanel?

If so, open the file manager and check “show hidden files”. Then look for a .htaccess file in the root directory and post its content.

18

BEGIN WordPress

RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L]

END WordPress

19

What sites are you being redirected on?

~!Donovan

20

c.mclarenz.net/click
notfound.lflink.com

but not always, also sometimes avast gives me a warning and blocks access.