Linkbucks - browser hijacked [Solved]

I need you to make a batch file.

Open a new Notepad session

• Click the Start button, click Run
• In the run box type notepad
• Click OK
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

@Echo on
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "flush.bat"
Click Save


You should now have a file on your desktop with an icon like this [external image: post-78707-1263753228.jpg]

Double click on flush.bat & allow it to run. A small black screen may briefly flash on and off, that normal.

Ok, I created the batch file and ran it. Everything looked ok, it ran some commands and the system restarted. I wanted to ask something else. Yesterday I disabled javascript in google chrome, because I couldn't almost reach any website, including this forum, it stopped the ads and linkbucks screens. Should I re enable javascript? Thanks again!

Which javascript are you referring to?

This is the option I disabled (I ticked do not allow)

 

📎how-to-enable-javascript-in-chrome-10-4.jpg

Go ahead and re-enable it.

ESET Online Scanner using Internet Explorer:

Note 1: These instructions are for Internet Explorer only! If you're using another browser, please stop here and let me know!
Note 2: You will need to disable your currently installed Anti-Virus, how to do so can be found here.

• Click this link to open ESET OnlineScan.
• Place a checkmark next to "Yes, I accept the Terms of Use", then click the [external image: greenstart.png] button.
• When prompted allow the Add-On/Active X to install.
• In the new window that opens, tic the radio button next to Enable detection of potentially unwanted applications.
• Then click "Advanced settings", and make sure there is a checkmark next to only the following items (uncheck everything else):
  • Remove found threats
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Then click the [external image: shieldstart.png] button and ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, click List Found Threats (only if anything is found).
• Then click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Click [external image: back.png], then click [external image: finish.png] to exit ESET Online Scanner.

Don't forget to re-enable your antivirus when finished!

===================================================

Download and install


Please download Malwarebytes Anti-Malware and save it to your desktop.

• Double-click mbam-setup-2.1.4.1018.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to the following:
  • Launch Malwarebytes Anti-Malware
  • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
• Click Finish.
• At the end of the installation, a database update will be performed.
• Click on Scan Now.
• A Threat Scan will begin.
• When the scan is complete, if there have been detections, click Remove Selected to allow MBAM to clean what was detected.
• In most cases, a restart will be required and a prompt will be shown.
• Wait for the prompt to restart the computer to appear, then click on Yes.
• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click Export.
• Click Text file (*.txt)
• In the Save File dialog box which appears, click on Desktop.
• In the File name: box type a name for your scan log.
• A message box named File Saved should appear stating "Your file has been successfully exported".
• Click Ok
• Attach that saved log to your next reply.

===================================================

On your next reply please post :
ESET log
MBAM log


Please STOP and let me know if you have any problems in performing with the steps above or any questions you may have.

Thanks for the answer. I have IE installed, b but use mainly chrome. I can still do the process with Internet Explorer if that's better

I followed your instructions in Chrome, it's going exactly the same way, except that it downloaded eset online scanner, instead of doing it inside of the browser. I'll post the logs as soon as I have them

Ok, here I'm posting the results. First ESET log:


C:\Program Files\formZ 8\formZ 8.5 Pro 64\formz 8.5 pro 64_patch.exe a variant of Win32/HackTool.Patcher.D potentially unsafe application cleaned by deleting - quarantined

C:\Program Files\formZ 8\formZ 8.5 Pro 64\formz imager 8.5 pro 64_patch.exe a variant of Win32/HackTool.Patcher.D potentially unsafe application cleaned by deleting - quarantined

C:\Program Files\SimLab\SimLab Composer 6\simlab.composer.6.(2016).x64-patch.exe.122820.gzquar a variant of Win32/HackTool.Patcher.T potentially unsafe application cleaned by deleting - quarantined

C:\Users\Matias\.frostwire5\updates\frostwire-6.1.5.windows.coc.premium.exe a variant of Win32/OpenCandy.C potentially unsafe application deleted - quarantined

C:\Users\Matias\AppData\Roaming\uTorrent\updates\3.4.3_40298.exe a variant of Win32/OpenCandy.C potentially unsafe application cleaned by deleting - quarantined

And here's Malwarebytes log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 20/10/2015
Scan Time: 12:03 a.m.
Logfile: mbam.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.10.19.07
Rootkit Database: v2015.10.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Matias

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 526558
Time Elapsed: 28 min, 1 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

How is it running so far?

Before running ESET and MBAM, I was still getting ads and redirections on google chrome, as soon as I enabled javascript. I've been browsing today, and it seems to have improved a lot, no ads so far, since running ESET and MBAM. Should I get any more protections than the antivirus? I'm using Avast right now. Thanks for all the help

I'll update about what's been happening. I was happy thinking the ads were gone, but browsing a few websites (using Chrome), linkbucks ads appeared again. The only temporary solution I've found is in Chrome settings, turn off javascript (I posted the image on a previous post). It seems this linkbucks won't go easily lol

What were you doing that triggered linkbucks ad? As far as I know, linkbucks ad come up when you click links that tied to it.

For example yesterday when I was entering this forum. I wrote the URL address on chrome, press enter and inmediately the linkbucks page appears, and won't let you go to the website you want. This happened with most pages I tried to go to, so it gets impossible to reach them. This pop ups and redirections stop when I disable javascript content on chrome settings (that's the only way I've been able to reach this forum). Same thing is happening on internet explorer.

I saw avast has a network security scan, it took a few seconds and gave this warning (I wanted to post a screenshot, but can't upload images without enabling javascript, really sorry)


Your router is infected!
Your router has been compromised and your network connections are being routed through a malicious remote server.

Description
Your router has been hacked and its DNS settings have been modified to serve malicious contents. DNS records on your wireless router are hijacked. While you browse the web, hackers can freely redirect you from an authentic site to a fake one. Sensitive information such as user names, passwords, and credit card details can be acquired. Your personal data is at risk, and so is the security of all devices connected to this network.

The manual solution is to change the DNS records on your router through its admin interface.

Alternatively, you can use our SecureDNS feature to shield yourself from the hijacked DNS servers.

I think one way to do it is to reset your router. Try pushing the reset button and monitor it for few days.