Author Topic: Weird redirects after clicking link  (Read 6103 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Weird redirects after clicking link
« on: February 19, 2018, 09:25:44 PM »
While browsing the web on Chrome, after clicking on a link thinking it was trusted, I was redirected to amanda[dot]runtnc[dot]net[/]something about ID=alphanumberic chain for a few seconds, then onto iyfnzgb[dot]com, which it then displayed a giant broken page icon (the version with a pixelated sad faced paper with a folded corner covering its eye, just in case).

After some searching trying to find info regarding this: discovered some links saying that sarah[dot]runtnc[dot]net is a virus (Instead of "Amanda", it was "Sarah").  On Reddit, found a thread regarding iyfnzgb may be a phishing site.

Virustotal showed that runtnc (without the Amanda) had no detections, but when putting the full URL with Amanda on it, it came up with some detections, but didn't say what. There was also a ZIP file downloaded according to them, I scanned for that on my PC, and came up nothing. As for iyfnzgb, simply said by the community that it was unsafe.

I have deleted my browser's cache and cookies. Full scan with Malwarebytes, and quick scan with Avast and Microsoft Security Essentials. Nothing of suspect was found on all three of them. My browser has uBlock Origin and Avast in its extensions, and it didn't look like I have unusual downloads or have added extensions.

And now, just wondering if I am safe thus far, and a possible heads up on that matter in case if there's anything wrong. Also sorry if this is the wrong place to put this.
« Last Edit: February 19, 2018, 09:37:44 PM by omegafinal »

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: Weird redirects after clicking link
« Reply #1 on: February 20, 2018, 11:37:34 AM »
This is a trojan browser hijacker that shows unwanted pop-ups.
You could wait for a qualified remover to guide you through the cleansing process,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Weird redirects after clicking link
« Reply #2 on: February 20, 2018, 04:00:37 PM »
Before I call on Sass Drake to come assist you. If you would like help, can you follow through with these instructions?

https://forum.avast.com/index.php?topic=194892.0
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

REDACTED

  • Guest
Re: Weird redirects after clicking link
« Reply #3 on: February 21, 2018, 02:38:27 AM »
Looking back this is something I should have done before. Hopefully everything will come up fine.

« Last Edit: February 22, 2018, 08:16:55 PM by omegafinal »

REDACTED

  • Guest
Re: Weird redirects after clicking link
« Reply #4 on: February 21, 2018, 02:52:12 AM »
Apologies. It looks like the version of FRST I had used before was an older version. Thought that it updated itself, but just in case, downloaded the new version and posting the results from that.

REDACTED

  • Guest
Re: Weird redirects after clicking link
« Reply #5 on: February 22, 2018, 02:04:20 AM »
Oh yeah, before I forget. Thank you in advance.

REDACTED

  • Guest
Re: Weird redirects after clicking link
« Reply #6 on: February 22, 2018, 08:16:24 PM »
This may be a strange question, but just in case. Windows just installed an update (a .NET Framework update). Should I submit a new FRST.txt and Addition.txt file, given there may be changes, or will the ones I provided in the above posts be okay?

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Weird redirects after clicking link
« Reply #7 on: February 23, 2018, 12:18:13 AM »
Oh my god, I'm so sorry. I totally forgot about you :/

I'll PM Sass Drake to assist you.

No, don't worry about Fresh logs, the update wouldn't have affected anything in them.
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

REDACTED

  • Guest
Re: Weird redirects after clicking link
« Reply #8 on: February 23, 2018, 07:33:15 PM »
Ah, I see. I thought it was just taking a while or got others to take care of first. No worries about it, take your time.

Offline Sass Drake

  • MyCity AMF R2
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 820
Re: Weird redirects after clicking link
« Reply #9 on: February 23, 2018, 09:32:45 PM »
Your PC is clean.
Regards.


The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.
Run the tool and check the following boxes below;
Remove disinfection tools
Create registry backup
Purge System Restore

Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

REDACTED

  • Guest
Re: Weird redirects after clicking link
« Reply #10 on: February 23, 2018, 10:29:22 PM »
Nice. Delfix has been downloaded to the desktop and used. Though does it normally delete itself as well after completing its task? I just find that part odd.

Again, thank you for all your help.
« Last Edit: February 23, 2018, 10:39:10 PM by omegafinal »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37506
  • Not a avast user
Re: Weird redirects after clicking link
« Reply #11 on: February 24, 2018, 02:05:18 AM »
Quote
  Though does it normally delete itself as well after completing its task? I just find that part odd 
Yes