Suspicious browser behavior conerning eBay

kitosumi · Nov 30, 2014

While using Firefox, at certain times when I would click on something within eBay's website, I would get a screen that said something along the lines of "Page could not be found." The same screen one would get when the internet is not working. I'd like to say I'm quite familiar with recognizing malware, and this definitely felt like it was.

Earlier today I followed nearly all the instructions on the following forums:

Fixing Google Redirection/hijacking and other redirection problems

Vista, Win 7 and Win 8 Malware Removal/Cleaning Procedure

...except for the step that requires restarting the router.
(I guess I was too lazy at the moment)

After restarting the router a few minutes ago, I notice that it isn't happening anymore, although a part of me is expecting it to happen again.

Even if problems no longer persist, should I be concerned about any personal information being taken from my eBay account?

Any information would be very helpful.

Thanks

Kestrel13! · Dec 1, 2014

Hi there and welcome.

More than likely not due to malware.

But where are the logs from Malware Bytes and MGTools?

Do this while we're at it:

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\0278971417402125mcinstcleanup (C:\Users\Allen\AppData\Local\Temp\027897~1.EXE -cleanup -nolog) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\0278971417402125mcinstcleanup (C:\Users\Allen\AppData\Local\Temp\027897~1.EXE -cleanup -nolog) -> Found

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Now once done, re run RK again and attach log.

kitosumi · Dec 1, 2014

Thanks!

Okay I've attached the missing logs. RKReport[3] is the log after rebooting.

Kestrel13! · Dec 2, 2014

Good morning!

Superfish Inc. VisualDiscovery <<< Uninstall this.

Do you know what these are?? I suspect Install_Clap is garbage.

C:\ProgramData\install_clap

C:\windows\59418264.005

kitosumi · Dec 2, 2014

Alright, I've uninstalled that. I don't know what those are, I agree they probably don't belong. I've tested out eBay for a few minutes here and nothing weird has happened so that's good. Nothing else strange in those logs though?

Kestrel13! · Dec 2, 2014

Are you able to delete these?

C:\ProgramData\install_clap

C:\windows\59418264.005

kitosumi · Dec 2, 2014

Oh sorry, I forgot to mention. I had already deleted those files when I posted my last reply. So yes, I was able to delete them.

Kestrel13! · Dec 2, 2014

Ready for final steps?

kitosumi · Dec 2, 2014

Sure thing!

Kestrel13! · Dec 3, 2014

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Suspicious browser behavior conerning eBay

kitosumi Private E-2

Attached Files:

MBRCheck_11.30.14_23.04.14.txt

RKreport[1].txt.log

HitmanPro_20141130_2351.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kitosumi Private E-2

Attached Files:

MalwarebytesLog1.txt

MGlogs.zip

RKreport[2].txt

RKreport[3].txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kitosumi Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kitosumi Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kitosumi Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Suspicious browser behavior conerning eBay

kitosumi Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kitosumi Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kitosumi Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kitosumi Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

kitosumi Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches