Redirect malware in BIOS or MBR can't remove it

Question

I bought a brand new Dell Inspiron 15 7567 laptop factory sealed and new. I booted it up went through the install process and finally logged in. Opened the edge browser and went to Youtube to play some music, all is working well. I wanted to install Atmel studio 7 and clicked on the link to download it, while that is happening another tab opens and redirects me to a fake site and asks me to download adobe flashplayer but the site in not by Adobe. This keeps happening every time I click any link on the website. I tried other websites with the same result. Same result in Google Chrome as well.

Now the really fun part. Getting rid of this adware or malware.

1. Restoring the PC to state I got it in, nothing changed, same problem.

2. Resetting the PC! Didn't get rid of the malware. (Multiple times)

3. Downloaded a separate Window 10 ISO burned it USB drive and Installed with keep Nothing option. Didn't work either

4. Formatted the entire HDD and installed Windows 10. This as a fresh as it gets, still no joy. (Multiple times)

5. Tried Ubuntu without installing (There is an option for that), opened Firefox and went to the Atmel site again. Surely the redirect malware can't work here right? Wrong! It still opens another tab and redirects me to another fake website.

Where is this malware hiding to avoid a complete nuke of the system? Is it in the BIOS or the MBR. I read that these malware can survive in these places even after completed nuking of the system. The redirect happens through "onclickrev.com" to a fake website for adobe or some ads about stupid weight loss methods. I used MalwareBytes, Kaspersky to scan for any boot or root kit in the MBR. Couldn't find one that checks BIOS.

I remember that the Laptop crashed with BSOD during an update install by Dell. That was the only weird thing that happened before the adware/malware started showing up.

What should I do? How can I remove it? Is replacement my only hope? I can't trust this computer at all for any type of online payment or banking.

TL;DR: A redirect malware infected my new laptop. Tried almost every method to get rid of it! Are there more methods?

EDIT: Apparently the onclickrev.com is redirect virus of some sort, found some people experiencing the same problem (None of them tried OS reinstall). Some of the solutions provided by websites (the sites appears to be not trust worthy either) to remove this virus looks suspicious. I can't figure out how this thing can still be in the system after a complete reinstall. Google search 'onclickrev.com removal' and see what comes up!

The redirect url for this advertisement virus or malware is http://onclickrev.com/afu.php?zoneid=1220488

Answer 1

As @ByteCommander stated in one of the comments this Ad you are seeing is most likely coming from either the router you are connected to or (directly or indirectly) from your ISP.

Things you could do to test/fix this issue:

• Setup an SSH or VPN tunnel to a server you trust (or possibly even use TOR).
• Switch out your router (if it is yours and you are not "borrowing" internet from someone else.
• Change your computers DNS settings to 8.8.8.8 (google dns)

I seriously doubt this has anything to do with your MBR or BIOS. You are correct in suspecting something outside the OS because the issue persists on your Ubuntu Live CD ... however, if your BIOS was infected the code would most likely be targeting windows (quite difficult to write a cross compatible root-kit in C/C++ with limited ROM space).

Answer 2

@Serverfrog in the comments mentioned that the redirects could potentially be coming from Atmle website itself. I'm also getting from your question is that whenever you visit the Atmle website, you get a new tab that opens up to the fake Flash website.

Now, it is possible that it's the website itself causing these new tabs to open; this behaviour is commonplace on less "decent" websites, where the basic action of clicking things on the website is enough to get malicious popups to appear, even if the things you clicked on weren't even links. With a more professional website like this, this behaviour is unlikely, and when it does happen, it can be because the website has been compromised and injected with malicious scripts.

Is this website the website you're referring to? I put it into VirusTotal and it came up as clean (0/65 detections), and I don't get any redirect behaviour just by loading up the page, at least on Chrome OS. I even turned off uBlock, both for the page I linked and the download page, and I've got no redirects.

My suggestion here is to stay away from the website for the software. If this new tab behaviour stops, then it is the website itself causing this problem. You could also try visiting the site with all JavaScript turned off, and see if the behaviour still persists (if it doesn't, there's some malicious JavaScript on the website).

Answer 3

Not certain if this will work with EFI, but - if you are certain that you have a "clean" system - have you tried overwriting the MBR and repartitioning? I've used a piece of code from (Microsoft) many times. It works from the DEBUG command-line and uses assembly code to overwrite the MBR. Between flashing the BIOS, overwriting the MBR and repartitioning the HDD - that should knock most nasties out. Then I would install NoScript, an ad-blocker and Ghostery in any browser I used.

Of course, this is only going to work with a PC infection - if your router/network or the website itself is compromised - then you'll need to take other action.

BTW, I would use a live Linux distro to pull off any good files that you have on the PC and put them onto a USB, etc. Then scan them to ensure they're good before putting them back on your "new" machine.

Answer 4

Might be a browser ad on. If it is, it might sync your extensions/ad ons whenever you log onto the browser, resulting in this redirect.