Avast WEBforum
Other => Viruses and worms => Topic started by: REDACTED on February 19, 2018, 09:25:44 PM
-
While browsing the web on Chrome, after clicking on a link thinking it was trusted, I was redirected to amanda[dot]runtnc[dot]net[/]something about ID=alphanumberic chain for a few seconds, then onto iyfnzgb[dot]com, which it then displayed a giant broken page icon (the version with a pixelated sad faced paper with a folded corner covering its eye, just in case).
After some searching trying to find info regarding this: discovered some links saying that sarah[dot]runtnc[dot]net is a virus (Instead of "Amanda", it was "Sarah"). On Reddit, found a thread regarding iyfnzgb may be a phishing site.
Virustotal showed that runtnc (without the Amanda) had no detections, but when putting the full URL with Amanda on it, it came up with some detections, but didn't say what. There was also a ZIP file downloaded according to them, I scanned for that on my PC, and came up nothing. As for iyfnzgb, simply said by the community that it was unsafe.
I have deleted my browser's cache and cookies. Full scan with Malwarebytes, and quick scan with Avast and Microsoft Security Essentials. Nothing of suspect was found on all three of them. My browser has uBlock Origin and Avast in its extensions, and it didn't look like I have unusual downloads or have added extensions.
And now, just wondering if I am safe thus far, and a possible heads up on that matter in case if there's anything wrong. Also sorry if this is the wrong place to put this.
-
This is a trojan browser hijacker that shows unwanted pop-ups.
You could wait for a qualified remover to guide you through the cleansing process,
polonus
-
Before I call on Sass Drake to come assist you. If you would like help, can you follow through with these instructions?
https://forum.avast.com/index.php?topic=194892.0
-
Looking back this is something I should have done before. Hopefully everything will come up fine.
-
Apologies. It looks like the version of FRST I had used before was an older version. Thought that it updated itself, but just in case, downloaded the new version and posting the results from that.
-
Oh yeah, before I forget. Thank you in advance.
-
This may be a strange question, but just in case. Windows just installed an update (a .NET Framework update). Should I submit a new FRST.txt and Addition.txt file, given there may be changes, or will the ones I provided in the above posts be okay?
-
Oh my god, I'm so sorry. I totally forgot about you :/
I'll PM Sass Drake to assist you.
No, don't worry about Fresh logs, the update wouldn't have affected anything in them.
-
Ah, I see. I thought it was just taking a while or got others to take care of first. No worries about it, take your time.
-
Your PC is clean.
Regards.
• The following will implement some post-cleanup procedures:
=> Please download DelFix (https://toolslib.net/downloads/finish/2-delfix/) by Xplode to your Desktop.
Run the tool and check the following boxes below;
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Remove disinfection tools
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Create registry backup
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)
The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
-
Nice. Delfix has been downloaded to the desktop and used. Though does it normally delete itself as well after completing its task? I just find that part odd.
Again, thank you for all your help.
-
Though does it normally delete itself as well after completing its task? I just find that part odd
Yes