Results 1 to 16 of 16

Thread: Spyware/malware help

  1. #1
    DILLIGAF GoNz0's Avatar
    Join Date
    Jun 2006
    Location
    Derby
    Posts
    10,864
    Thanks
    632
    Thanked
    1,190 times in 943 posts
    • GoNz0's system
      • Motherboard:
      • Asus Rampage V Extreme
      • CPU:
      • i7 something X99 based
      • Memory:
      • 16gb GSkill
      • Storage:
      • 4 SSD's + WD Red
      • Graphics card(s):
      • GTX980 Strix WC
      • PSU:
      • Enermax Galaxy 1250 (9 years and counting)
      • Case:
      • Corsair 900D
      • Operating System:
      • win10 64bit
      • Monitor(s):
      • Dell 24"
      • Internet:
      • 220mb Cable

    Spyware/malware help

    I have an interesting gremlin I can't nail down. I have noticed when following some links that weirdness happens. If I go to eurocarparts.com for instance I will see the URL change 1st to
    http://thetraffic.info/?id=1450447602
    then to
    http://reprice.us/c/uCRH
    and finally with an attached affiliate link it will go to.
    http://www.eurocarparts.com/?awc=399...n=Sub+Networks

    Considering this is from chrome's homepage I am at a loss, the only thing that tipped me off was the links breaking and instead of taking me to the Asus forums it would drop me on the main support page.

    I have kaspersky internet security installed
    Malwarebytes found nothing,
    adwcleaner found nothing
    smitfraudfix = nada
    tdsskiller = nope
    adaware - zero


    so you can see it isn't for trying to remove this barstool!

    any ideas?

    Capitalization is the difference between helping your Uncle Jack
    off a horse and helping your uncle jack off a horse.

  2. #2
    Senior Member
    Join Date
    Aug 2013
    Location
    North Wales
    Posts
    1,724
    Thanks
    159
    Thanked
    248 times in 183 posts
    • virtuo's system
      • Motherboard:
      • Asus GRYPHON Z87
      • CPU:
      • i7 4790K @4.8Ghz Corsair H100i GTX
      • Memory:
      • 32Gb G.Skill TridentX 2400 @ CAS9
      • Storage:
      • Samsung 840 EVO 120Gb + Many, many HDs
      • Graphics card(s):
      • EVGA 980Ti FTW
      • PSU:
      • EVGA Supernova G2 750W
      • Case:
      • be quiet! Dark Base Pro 900 (Orange)
      • Operating System:
      • Win10, Fedora
      • Monitor(s):
      • 2x Dell U2515H 1440p DELL U3415W Ultrawide for Work
      • Internet:
      • PlusNet Unlimited 80Mb

    Re: Spyware/malware help

    Does it do the same on any other computers on your network, or even a different browser?

  3. #3
    Editable... jimbouk's Avatar
    Join Date
    Aug 2005
    Location
    Bristol
    Posts
    2,546
    Thanks
    188
    Thanked
    187 times in 148 posts
    • jimbouk's system
      • Motherboard:
      • ASUS M5 A97 R2.0
      • CPU:
      • AMD FX-6300
      • Memory:
      • 8GB DDR3
      • Storage:
      • 128GB SSD + 500GB HDD
      • Graphics card(s):
      • AMD Radeon HD 7870
      • PSU:
      • Corsair HX 520W
      • Case:
      • Some large ATX case
      • Operating System:
      • Windows 7
      • Monitor(s):
      • Dell U2713HM
      • Internet:
      • Orange...

    Re: Spyware/malware help

    Sounds like url hijacking alright!

    http://thetraffic.info is a blank page, no whois info as it's registered by a proxy company. Have a look at your installed programs, something's probably been installed 'legitimately' on the sly as an adware bundle.

  4. #4
    boop, got your nose stevie lee's Avatar
    Join Date
    Sep 2007
    Location
    southport
    Posts
    2,568
    Thanks
    400
    Thanked
    389 times in 296 posts
    • stevie lee's system
      • Motherboard:
      • Gigabyte GA-870A-USB3
      • CPU:
      • Phenom II X6 1090T 6core 3.2ghz
      • Memory:
      • 8GB Corsair DDR3 1600 MHZ
      • Storage:
      • Hitachi 500, 640GB + 1TB. WDblue 2TB, Crucial M500 240GB
      • Graphics card(s):
      • Nvidia Palit 750 Ti
      • PSU:
      • Enermax Naxn 350 W
      • Case:
      • Xigmatech Midgard
      • Operating System:
      • Win 10 Home
      • Monitor(s):
      • 22" Samsung SM2233BW
      • Internet:
      • 20mb plusnet unlimited!

    Re: Spyware/malware help

    had something similar a while ago.
    there were some registry entries causing redirects to a spoof google home page. no amount of reinstalls of chrome or malware/virus scanning found them. noticed the website redirect showing on the 'status bar' at the bottom. did a registry search for that address and up popped some registry entries. removed them and all was well.

    I ended up doing a full reinstall of windows 7 anyway, just because win 10 was about to be released and I didn't fully trust i'd removed all the registry stuff. and it was 5 years since previous reinstall.

    you may get away with a registry serach and remove. I would reinstall windows just to be sure though.

  5. #5
    DILLIGAF GoNz0's Avatar
    Join Date
    Jun 2006
    Location
    Derby
    Posts
    10,864
    Thanks
    632
    Thanked
    1,190 times in 943 posts
    • GoNz0's system
      • Motherboard:
      • Asus Rampage V Extreme
      • CPU:
      • i7 something X99 based
      • Memory:
      • 16gb GSkill
      • Storage:
      • 4 SSD's + WD Red
      • Graphics card(s):
      • GTX980 Strix WC
      • PSU:
      • Enermax Galaxy 1250 (9 years and counting)
      • Case:
      • Corsair 900D
      • Operating System:
      • win10 64bit
      • Monitor(s):
      • Dell 24"
      • Internet:
      • 220mb Cable

    Re: Spyware/malware help

    Laptops being exchanged in about a month so I will track the little bugger down if I can. I think one of my old chrome extensions to blame, I thought it was FDV Speed Dial at 1st but it happened again after I disabled it.
    so far (but this can happen at random not every click) with everything disabled in chrome it is behaving.
    Now to play the add things back a day at a time game!

    Capitalization is the difference between helping your Uncle Jack
    off a horse and helping your uncle jack off a horse.

  6. #6
    Senior Member watercooled's Avatar
    Join Date
    Jan 2009
    Posts
    10,858
    Thanks
    1,501
    Thanked
    935 times in 805 posts

    Re: Spyware/malware help

    I was asked to sort a friend's laptop doing something similar although IIRC the redirects were to some scareware site. Reinstalling Chrome didn't help as whatever it was was just re-injecting itself upon install. However it was quite some time ago and I'm not sure what exactly I did to get rid of it.

    It looks like the reprice link is the villainous one and I found a couple of references to it e.g. https://malwaretips.com/blogs/ads-by-reprice-removal/

    If you find out what it is I'd definitely be making some noise to Kaspersky/Malwarebytes/etc about it!

  7. #7
    DILLIGAF GoNz0's Avatar
    Join Date
    Jun 2006
    Location
    Derby
    Posts
    10,864
    Thanks
    632
    Thanked
    1,190 times in 943 posts
    • GoNz0's system
      • Motherboard:
      • Asus Rampage V Extreme
      • CPU:
      • i7 something X99 based
      • Memory:
      • 16gb GSkill
      • Storage:
      • 4 SSD's + WD Red
      • Graphics card(s):
      • GTX980 Strix WC
      • PSU:
      • Enermax Galaxy 1250 (9 years and counting)
      • Case:
      • Corsair 900D
      • Operating System:
      • win10 64bit
      • Monitor(s):
      • Dell 24"
      • Internet:
      • 220mb Cable

    Re: Spyware/malware help

    yep, not had it return yet so it is looking like a 3rd party plugin I had as i have been adding back the safe bets, google plugins, quidco.


    "read and change all your data on the websites you visit" is in so many plugins details tab!

    Capitalization is the difference between helping your Uncle Jack
    off a horse and helping your uncle jack off a horse.

  8. #8
    DILLIGAF GoNz0's Avatar
    Join Date
    Jun 2006
    Location
    Derby
    Posts
    10,864
    Thanks
    632
    Thanked
    1,190 times in 943 posts
    • GoNz0's system
      • Motherboard:
      • Asus Rampage V Extreme
      • CPU:
      • i7 something X99 based
      • Memory:
      • 16gb GSkill
      • Storage:
      • 4 SSD's + WD Red
      • Graphics card(s):
      • GTX980 Strix WC
      • PSU:
      • Enermax Galaxy 1250 (9 years and counting)
      • Case:
      • Corsair 900D
      • Operating System:
      • win10 64bit
      • Monitor(s):
      • Dell 24"
      • Internet:
      • 220mb Cable

    Re: Spyware/malware help

    well I deleted a couple of unneeded extensions while disabling stuff, foolish as I can't remember what one was called and I think that may have been it as everything's enabled again. My router logs do not show those URLS again but I guess I need a bit longer to be sure it is gone.

    Capitalization is the difference between helping your Uncle Jack
    off a horse and helping your uncle jack off a horse.

  9. #9
    DILLIGAF GoNz0's Avatar
    Join Date
    Jun 2006
    Location
    Derby
    Posts
    10,864
    Thanks
    632
    Thanked
    1,190 times in 943 posts
    • GoNz0's system
      • Motherboard:
      • Asus Rampage V Extreme
      • CPU:
      • i7 something X99 based
      • Memory:
      • 16gb GSkill
      • Storage:
      • 4 SSD's + WD Red
      • Graphics card(s):
      • GTX980 Strix WC
      • PSU:
      • Enermax Galaxy 1250 (9 years and counting)
      • Case:
      • Corsair 900D
      • Operating System:
      • win10 64bit
      • Monitor(s):
      • Dell 24"
      • Internet:
      • 220mb Cable

    Re: Spyware/malware help

    meh, just happened again, back to square 1!

    Capitalization is the difference between helping your Uncle Jack
    off a horse and helping your uncle jack off a horse.

  10. #10
    DILLIGAF GoNz0's Avatar
    Join Date
    Jun 2006
    Location
    Derby
    Posts
    10,864
    Thanks
    632
    Thanked
    1,190 times in 943 posts
    • GoNz0's system
      • Motherboard:
      • Asus Rampage V Extreme
      • CPU:
      • i7 something X99 based
      • Memory:
      • 16gb GSkill
      • Storage:
      • 4 SSD's + WD Red
      • Graphics card(s):
      • GTX980 Strix WC
      • PSU:
      • Enermax Galaxy 1250 (9 years and counting)
      • Case:
      • Corsair 900D
      • Operating System:
      • win10 64bit
      • Monitor(s):
      • Dell 24"
      • Internet:
      • 220mb Cable

    Re: Spyware/malware help

    It is looking like this may be the problem https://chrome.google.com/webstore/d...er-info-dialog

    Reported this to chrome & kaspersky as it redirected a few minutes after enabling, seems crafty as it won't do it straight away.
    Last edited by GoNz0; 19-12-2015 at 10:10 AM.

    Capitalization is the difference between helping your Uncle Jack
    off a horse and helping your uncle jack off a horse.

  11. #11
    Registered+
    Join Date
    Feb 2010
    Location
    Cheshire
    Posts
    22
    Thanks
    0
    Thanked
    7 times in 5 posts

    Re: Spyware/malware help

    Seems very crafty, especially as it has decent reviews. If it is the culpript, may be worth changing your Hotmail/live/Outlook.com password - just as a precaution.

  12. Received thanks from:

    GoNz0 (19-12-2015)

  13. #12
    DILLIGAF GoNz0's Avatar
    Join Date
    Jun 2006
    Location
    Derby
    Posts
    10,864
    Thanks
    632
    Thanked
    1,190 times in 943 posts
    • GoNz0's system
      • Motherboard:
      • Asus Rampage V Extreme
      • CPU:
      • i7 something X99 based
      • Memory:
      • 16gb GSkill
      • Storage:
      • 4 SSD's + WD Red
      • Graphics card(s):
      • GTX980 Strix WC
      • PSU:
      • Enermax Galaxy 1250 (9 years and counting)
      • Case:
      • Corsair 900D
      • Operating System:
      • win10 64bit
      • Monitor(s):
      • Dell 24"
      • Internet:
      • 220mb Cable

    Re: Spyware/malware help

    Quote Originally Posted by davb View Post
    Seems very crafty, especially as it has decent reviews. If it is the culpript, may be worth changing your Hotmail/live/Outlook.com password - just as a precaution.
    You were correct, thankfully I use 2 factor authentication so they didn't get in

    Security challenge 12/12/2015 22:41 United States
    IP address 137.117.8.203 Device/platform Unknown Browser/application Unknown
    Last edited by GoNz0; 19-12-2015 at 07:45 PM.

    Capitalization is the difference between helping your Uncle Jack
    off a horse and helping your uncle jack off a horse.

  14. #13
    DILLIGAF GoNz0's Avatar
    Join Date
    Jun 2006
    Location
    Derby
    Posts
    10,864
    Thanks
    632
    Thanked
    1,190 times in 943 posts
    • GoNz0's system
      • Motherboard:
      • Asus Rampage V Extreme
      • CPU:
      • i7 something X99 based
      • Memory:
      • 16gb GSkill
      • Storage:
      • 4 SSD's + WD Red
      • Graphics card(s):
      • GTX980 Strix WC
      • PSU:
      • Enermax Galaxy 1250 (9 years and counting)
      • Case:
      • Corsair 900D
      • Operating System:
      • win10 64bit
      • Monitor(s):
      • Dell 24"
      • Internet:
      • 220mb Cable

    Re: Spyware/malware help

    Confirmed by Kaspersky labs.

    Dear customer,

    Please accept my apologies for not getting back to you earlier.

    The extension provided has been indeed detected as a potential risk program. We have added new detection for it as "Not-a-Virus:AdWare.JS.ChromeExt.a".

    No malicious software has been found on the websites provided. The malicious code may have been removed from our mail Anti-Virus server. If you have a local copy of the suspicious file, please send it to me in a password-protected archive, with password 'infected' (without quotes).

    1. http://thetraffic.info/?id=1450447602
    2. http://reprice.us/c/uCRH

    Thank you very much for your feedback.

    Capitalization is the difference between helping your Uncle Jack
    off a horse and helping your uncle jack off a horse.

  15. Received thanks from:

    peterb (18-01-2016)

  16. #14
    Senior Member Bonebreaker777's Avatar
    Join Date
    Dec 2012
    Location
    Herts, UK
    Posts
    2,002
    Thanks
    44
    Thanked
    190 times in 177 posts
    • Bonebreaker777's system
      • Motherboard:
      • MSI H97I AC
      • CPU:
      • Xeon 1225 v3 + Freezer 11 L
      • Memory:
      • 2 x 4GB 1600Mhz 1T-8-8-8-20 1.35V Crucial BallistiX Tactical VLP
      • Storage:
      • 128GB CRUCIAL MX100///XPEnology server + 3 x WD Purple 3TB
      • Graphics card(s):
      • Intel HD 4600
      • PSU:
      • be quiet! L8 300W PSU BN220
      • Case:
      • Cooler Master Elite 120
      • Operating System:
      • Windows 10 Pro 64bit
      • Monitor(s):
      • Samsung SyncMaster 226BW
      • Internet:
      • Virgin 100Mb

    Re: Spyware/malware help

    Junkware removal Tool and Malware Bytes had no significant result in safe mode?

  17. #15
    DILLIGAF GoNz0's Avatar
    Join Date
    Jun 2006
    Location
    Derby
    Posts
    10,864
    Thanks
    632
    Thanked
    1,190 times in 943 posts
    • GoNz0's system
      • Motherboard:
      • Asus Rampage V Extreme
      • CPU:
      • i7 something X99 based
      • Memory:
      • 16gb GSkill
      • Storage:
      • 4 SSD's + WD Red
      • Graphics card(s):
      • GTX980 Strix WC
      • PSU:
      • Enermax Galaxy 1250 (9 years and counting)
      • Case:
      • Corsair 900D
      • Operating System:
      • win10 64bit
      • Monitor(s):
      • Dell 24"
      • Internet:
      • 220mb Cable

    Re: Spyware/malware help

    Quote Originally Posted by Bonebreaker777 View Post
    Junkware removal Tool and Malware Bytes had no significant result in safe mode?
    Why would it, I was the 1st to log this and have it confirmed as a new threat, I had already removed it by the time it was added to the database.

    Capitalization is the difference between helping your Uncle Jack
    off a horse and helping your uncle jack off a horse.

  18. #16
    Admin team peterb's Avatar
    Join Date
    Aug 2005
    Location
    Southampton
    Posts
    19,339
    Thanks
    2,878
    Thanked
    3,387 times in 2,681 posts
    • peterb's system
      • Motherboard:
      • Nascom 2
      • CPU:
      • Z80B
      • Memory:
      • 48K 8 bit memory on separate card
      • Storage:
      • Audio cassette tape - home built 5.25" floppy drive
      • Graphics card(s):
      • text output (composite video)
      • PSU:
      • Home built
      • Case:
      • Home built
      • Operating System:
      • Nas-sys
      • Monitor(s):
      • 12" monocrome composite video input
      • Internet:
      • No networking capability on this machine

    Re: Spyware/malware help

    Good call, and excellent result to hammer a nail into spamware.
    (\__/)
    (='.'=)
    (")_(")

    Been helped or just 'Like' a post? Use the Thanks button!
    My broadband speed - 750 Meganibbles/minute

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •