Redirected to url4short.info when trying to visit a certain site

[cottonball]

That's strange...

That notice is one you get for using FireFox.
Try running ESET in Firefox, and see what happens.

 

[ThisIsMadness91]

I think ESET may have updated their site. I decided to check again in IE to see if that message appeared, and when I clicked the link cottonball provided, I got sent here.

ESET Free Online Scanner :: Complete Malware Detection :: ESET

When I click to run the online scanner in IE, it doesn't tell me I'm trying to run it in a different browser. Shall I go ahead now?

 

[cottonball]

Yes, please.

 

[ThisIsMadness91]

When prompted, do I click run or save? Or does it not matter?

 

[cottonball]

It does not matter...

 

[ThisIsMadness91]

I started the scan, but aborted it when it detected files relating to an Ask toolbar. I use Avira Free Antivirus which comes with an option to install the Ask toolbar to get free web protection. I don't know if these files are part of Avira or something else, but I decided to abort the scan in case it removed files that might cause Avira to stop working properly. Should I restart the scan without setting it to remove found threats?

 

[cottonball]

My apology for the delay. Got a bad cold.

Yes, please. Run the scan and uncheck the option to remove all threats.

Once you post its log, we can determine what entries need to go.

 

[ThisIsMadness91]

No worries. Hope you feel better soon. This is what ESET found.

C:\Program Files (x86)\Avira\AntiVir Desktop\apnic.dll a variant of Win32/Bundled.Toolbar.Ask application
C:\Program Files (x86)\Avira\AntiVir Desktop\apntoolbarinstaller.exe a variant of Win32/Bundled.Toolbar.Ask application
C:\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe a variant of Win32/Bundled.Toolbar.Ask.D application

 

[cottonball]

The Ask Toolbar is considered a nuisance. It hijacks the browser homepage and replaces the default search engine. However, it is up to you whether you want to keep it or not.

If you uninstall this component, Web Protection will be no longer available for Avira Free Antivirus.

 

[ThisIsMadness91]

I didn't choose to install the toolbar when installing Avira, so I've never had the free web protection. My home page and search engines are the same as they've always been.

 

[Jacee]

You can remove the 'Ask toolbar'. Read this: Enable Web Protection in Avira Free Antivirus without SearchFree Toolbar ? Raymond.CC

 

[ThisIsMadness91]

Thanks, but I never installed the toolbar or the web protection.

 

[cottonball]

I use Avira Free Antivirus which comes with an option to install the Ask toolbar to get free web protection. I don't know if these files are part of Avira or something else...

ESET is reporting the files as: Bundled.Toolbar.Ask application

I never installed the toolbar or the web protection...

The Ask Toolbar is showing on the ESET report, though.
It is your decision as to what to do, but, it would be in your best interest to check out the info provided by Jacee.


On your initial concern, are you still being redirected to url4short.info?

 

[ThisIsMadness91]

The files are detected on my laptop as well, which also has Avira Free Antivirus. If you like, I can uninstall Avira on that, then run the scanner again to see if the files are still there afterwards. I had a look at Jacee's information, and it's definitely something worth keeping in mind if I want to get the web protection in the future.

As for url4short.info, I just tried visiting the forum for the first time in over two weeks and yes, I still get redirected.

 

[cottonball]

On: url4short.info

Please do the following:
1. Click Start -> All Programs -> Accessories

2. Right click Notepad and select: Run as administrator

3. Click Yes/Continue on the UAC window.

4. When Notepad opens. click: File > Open

5. In Filename, type C:\Windows\System32\Drivers\etc\hosts

6. Click: Open

:ar: Please post the contents of the Hosts file in your reply.

 

[cottonball]

Is the website you are visiting the only one that is giving you the url4short.info issue, or are there others doing the same thing?

Is the website a forum running the Invision Power Board (IP.Board) software?

 

[ThisIsMadness91]

This website is the only one that's given me a redirect, yes. As for the IP.Board software, I can't remember, but I think it does. I haven't tried visiting any other forums to see if the redirect happens.

 

[cottonball]

If it is only a particular website causing the problem, it appears the site is compromised with some sort of code, and causing the redirection.

Since we do not know how/if the website has been specifically affected, if you use a password to the site, you may want top reset it with a difficult one. That may not solve the immediate problem, but may deter your system from being the 'recipient' of any fallout.

 

[ThisIsMadness91]

I've visited the forum occasionally over the last year or two, but never created an account there. Also, I don't know if this information helps at all, but the redirect doesn't happen on my iPhone, possibly because it sends me to the mobile version of the forum rather than the desktop version.

 

[Jacee]

Flush the DNS cache and restore MS Hosts file...


Copy and paste these lines in Note pad.


@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0


Save as flush.bat to your desktop.
Double click on the flush.bat file to run it.


Next, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.


Tell us how you're doing now.