HTML:RedirME-inf [Trj] Detection

[REDACTED]

Hello everyone,

After quite some search around here in the forum about this Trojan infection, I didn't fully found any situation quite like mine, or at least from my understanding or point of view of the problem.

This past week, when acessing the website "Feed2All" a pop-up from Avast appeared about 6/7 times a day for a whole week. Since than I've been unable to access the site. From what I've read, this happens for the fact of being block by Avast, correct? After this I checked the webiste on "VirusTotal" and everything seemed to look ok.

I've also downloaded Malwarebytes and ran it, and it only found "pup.optional.opencandy", which I believe might not be connected to this trojan problem, right?

So, after this I went to check my "Quarentine" on Avast, and a variety of ".exe" files are locked there, spotted on folders on my computer on which I've never seen or putted them there before, so my question is: are this files connected to the "Trojan" file?

Here they are:

Code: [Select]

http://i146.photobucket.com/albums/r274/kitsoyomo/PRINT.png
I must say I was pretty scared when finding reading about this Trojan, and finding out that this might be some kind of "malaware" from which someone has remote access to my computer, files, documents, etc.

I apologize in advance for my deep newbiness but this is just a scary situation since my computor is my work day tool!

Best regards,
Tiago

[Pondus]

Sucuri  >>  https://sitecheck.sucuri.net/results/myfeed2all.eu

  After this I checked the webiste on "VirusTotal" and everything seemed to look ok.   

Virustotal URL scan is a blacklist check, it does not scan for website malware

[REDACTED]

Thanks for the info! I was really clueless on this one.

So, does that mean that I might have been infected and some ".exe" files were installed and someone had acess to my documents and information?

[Pondus]

HTML:RedirME-inf [Trj] = Site containe redirect to a blacklisted ad network

https://virustotal.com/nb/url/fdadfd7bc1b89e7a93f9aa8afcc0c8539ac494f9a87ea74bcdc6f5be641d8d9c/analysis/1496015977/

[REDACTED]

Cool. So, this ".exe" files might not have nothing to do with this problem?

[Pondus]

Impossible to say as we can't see all the info given in avast quarantine

[REDACTED]

Hi,

I am getting this same Trojan popup, it pops up when I start to browse in Firefox, and only appears once per session. (I no longer visit feed2all, but it still pops up)

I ran MB with  rootkits enabled and Farbar and the text files are attached.

Since Avast is blocking it, I'm not sure this Trojan is causing any harm, but I would like to remove it. I have also run several other rootkit programs, but none of them find any malware. Should I uninstall Firefox?

Thank you.

[Pondus]

@lundjro Have you tried cleaning your browser(s) with AdwCleaner ?

AdwCleaner  >>  https://www.malwarebytes.com/adwcleaner/

OBS: When asking for help, always start your own topic. Helping multiple users in same topic create chaos

[REDACTED]

@lundjro Have you tried cleaning your browser(s) with AdwCleaner ?

AdwCleaner  >>  https://www.malwarebytes.com/adwcleaner/

OBS: When asking for help, always start your own topic. Helping multiple users in same topic create chaos

Sorry, next time I will start a new topic.

Thank you for the quick reply! adwcleaner found and removed the threat below.

[-] File deleted: C:\Users\AppData\Roaming\Mozilla\Firefox\Profiles\0htyjw4k.default\invalidprefs.js