And yet another "Java Software Critical Update" virus problem

[TwinHeadedEagle]

You didn't answered when this started to happen, what you did to cause this?

 

[Leo Niehorster]

Hi,
In my initial post, I stated:
Infection date and initial symptoms:
"Some time ago. As I thought it was a "normal" pop-up, I didn't register it as a problem. Seems to be getting worse."
And I am pretty sure I never clicked on this particular download. Must have snuck in somehow else.

Cheers
Leo

 

[TwinHeadedEagle]

Try to switch your computer to Open DNS

http://www.howtogeek.com/164981/how-to-switch-to-opendns-or-google-dns-to-speed-up-web-browsing/

 

[Leo Niehorster]

Good morning,

OK. Switched to Open DNS. Still being redirected to the "Java Software Critical update" download page.

Cheers
Leo

 

[TwinHeadedEagle]

Ok, but try now this command in CMD:

ipconfig /flushdns

ipconfig /renew

And try Browser reset after this.

 

[Leo Niehorster]

Ok, did those three things.
But, still no change. (See attached).

 

[TwinHeadedEagle]

Download fresh FRST from here, and attach scan reports

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

 

[Leo Niehorster]

Hi,
OK. Ran FRST. Log attached.

Cheers
Leo

 

[TwinHeadedEagle]

Thing is that I don't see any sign of malware in reports.

Can you try now to run ComboFix using instructions on first page.

 

[Leo Niehorster]

Hello,
Well, ComboFox crashed again, along with my computer, at/after Stage 27.
I waited 60 minutes before turning it off. Obviously, no report.
(Still the same mess in the Windows Explorer directory tree.)

Regards
Leo

 

[TwinHeadedEagle]

Ok, let's start ComboFix this way. Make sure it is located on your Desktop.

Press Windows key + R and copy the following in the Run windows:

"%userprofile%\Desktop\ComboFix.exe" /KillAll /StepDel /NoMBR

Press OK and ComboFix will start scanning.

 

[Leo Niehorster]

Hi,

Good. CF ran without hitches.
And the Explorer tree is OK again.
See attached log report.

Leo

 

[TwinHeadedEagle]

Situation probably the same after ComboFix?

 

[Leo Niehorster]

Hi,
Yes, the problem persists. It has been joined by a variant. See attached.

Leo

 

[TwinHeadedEagle]

Please download MiniToolBox to Desktop and run it.

Check first 8 boxes.

• Click Go and copy/paste the log (Result.txt) into your next post.
• Note: When using "Reset FF Proxy Settings" option Firefox should be closed.

 

[Leo Niehorster]

Good evening,

Here is the log for MiniToolBox.

Best regards
Leo

 

[TwinHeadedEagle]

Can you tell me if this happens when entering only specific sites or on all sites.

 

[Leo Niehorster]

Good morning,

The Java and Video Player redirect happen only at some sites.
So far, these are:
http://www.icefilms.info
http://180upload.com
http://hugefiles.net
http://billionuploads.com
http://movreel.com

Cheers
Leo

 

[TwinHeadedEagle]

That leads us to fact that these sites are probably infected. Your PC is clean. I can recommend you to install Adblock for Chrome.

 

[Leo Niehorster]

Hello again,

OK. Thank you very much for your patience and assistance.
Best regards
Leo