4

I bought a brand new Dell Inspiron 15 7567 laptop factory sealed and new. I booted it up went through the install process and finally logged in. Opened the edge browser and went to Youtube to play some music, all is working well. I wanted to install Atmel studio 7 and clicked on the link to download it, while that is happening another tab opens and redirects me to a fake site and asks me to download adobe flashplayer but the site in not by Adobe. This keeps happening every time I click any link on the website. I tried other websites with the same result. Same result in Google Chrome as well.

Now the really fun part. Getting rid of this adware or malware.

  1. Restoring the PC to state I got it in, nothing changed, same problem.

  2. Resetting the PC! Didn't get rid of the malware. (Multiple times)

  3. Downloaded a separate Window 10 ISO burned it USB drive and Installed with keep Nothing option. Didn't work either

  4. Formatted the entire HDD and installed Windows 10. This as a fresh as it gets, still no joy. (Multiple times)

  5. Tried Ubuntu without installing (There is an option for that), opened Firefox and went to the Atmel site again. Surely the redirect malware can't work here right? Wrong! It still opens another tab and redirects me to another fake website.

Where is this malware hiding to avoid a complete nuke of the system? Is it in the BIOS or the MBR. I read that these malware can survive in these places even after completed nuking of the system. The redirect happens through "onclickrev.com" to a fake website for adobe or some ads about stupid weight loss methods. I used MalwareBytes, Kaspersky to scan for any boot or root kit in the MBR. Couldn't find one that checks BIOS.

I remember that the Laptop crashed with BSOD during an update install by Dell. That was the only weird thing that happened before the adware/malware started showing up.

What should I do? How can I remove it? Is replacement my only hope? I can't trust this computer at all for any type of online payment or banking.

TL;DR: A redirect malware infected my new laptop. Tried almost every method to get rid of it! Are there more methods?

EDIT: Apparently the onclickrev.com is redirect virus of some sort, found some people experiencing the same problem (None of them tried OS reinstall). Some of the solutions provided by websites (the sites appears to be not trust worthy either) to remove this virus looks suspicious. I can't figure out how this thing can still be in the system after a complete reinstall. Google search 'onclickrev.com removal' and see what comes up!

The redirect url for this advertisement virus or malware is http://onclickrev.com/afu.php?zoneid=1220488

  • 3
    Maybe th culprit is not your laptop but your router? Can you try connecting your laptop to the internet through a different router or a friend's or public access point, or can you try connecting a different device to your current router? – Byte Commander Sep 10 '17 at 13:01
  • 3
    @newbie: It is not atypical for malware in infected websites to not affect all computers but for example only on first visit, only specific platforms, only if not logged in to Facebook etc. Again, this is more likely than some strange MBR or BIOS virus which affects all installed OS but only if the user visits the Atmel site. – Steffen Ullrich Sep 10 '17 at 16:07
  • 2
    4 and 5 exclude MBR residency as they both end up wiping the MBR and having it able to infect the installation to stay resident with both the windows and the ubuntu livecd would be very hard, BIOS or more likely EFI residency is possible.That said, I would be looking at router and other networking stuff as a far more likely infection point. – ewanm89 Sep 10 '17 at 19:07
  • 2
    Updating the BIOS does indeed completely reflash it. In theory, BIOS malware could force the operating system to say "yep, it's successfully flashed" while actually doing nothing, in which case you'd have to do it manually with a hardware SPI programmer. But it is incredibly unlikely that this is actually an infection in the BIOS. – anon Sep 11 '17 at 8:17
  • 4
    Have you Considered that advertisements on the Atmle site is creating this behavior? Try to install some Adblocking (like Ghostry or other) and try to access the site. Then look at every request that is an 4xx – Serverfrog Sep 11 '17 at 16:07
2

As @ByteCommander stated in one of the comments this Ad you are seeing is most likely coming from either the router you are connected to or (directly or indirectly) from your ISP.

Things you could do to test/fix this issue:

  • Setup an SSH or VPN tunnel to a server you trust (or possibly even use TOR).
  • Switch out your router (if it is yours and you are not "borrowing" internet from someone else.
  • Change your computers DNS settings to 8.8.8.8 (google dns)

I seriously doubt this has anything to do with your MBR or BIOS. You are correct in suspecting something outside the OS because the issue persists on your Ubuntu Live CD ... however, if your BIOS was infected the code would most likely be targeting windows (quite difficult to write a cross compatible root-kit in C/C++ with limited ROM space).

0

Might be a browser ad on. If it is, it might sync your extensions/ad ons whenever you log onto the browser, resulting in this redirect.

  • I wasn't logged into any of the browser. – newbie Sep 11 '17 at 6:05
  • It's not going to be a browser add-on issue on a clean system with 2 different operating systems... – James Snell Sep 11 '17 at 8:55
  • @JamesSnell it could be if it was chrome and he was logged in – CaffeineAddiction Sep 18 '17 at 13:22
  • @CaffeineAddiction - not really, since they specifically said the problem occurs in Edge too. Though I tend to find uninstalling google Chrome is usually a very good idea. – James Snell Sep 18 '17 at 15:22
  • @newbie there are some programs that can install extensions/add ons directly to your browser as well. The only way where the hyperlinks on the page can be manipulated is when there's an add on/extension pulling strings. Trying to modify these kind of things using some kind of dll injection seems too difficult for the average hacker. Do you have some pictures/video of the problem? – Kelvin Wang Sep 19 '17 at 1:26
0

@Serverfrog in the comments mentioned that the redirects could potentially be coming from Atmle website itself. I'm also getting from your question is that whenever you visit the Atmle website, you get a new tab that opens up to the fake Flash website.

Now, it is possible that it's the website itself causing these new tabs to open; this behaviour is commonplace on less "decent" websites, where the basic action of clicking things on the website is enough to get malicious popups to appear, even if the things you clicked on weren't even links. With a more professional website like this, this behaviour is unlikely, and when it does happen, it can be because the website has been compromised and injected with malicious scripts.

Is this website the website you're referring to? I put it into VirusTotal and it came up as clean (0/65 detections), and I don't get any redirect behaviour just by loading up the page, at least on Chrome OS. I even turned off uBlock, both for the page I linked and the download page, and I've got no redirects.

My suggestion here is to stay away from the website for the software. If this new tab behaviour stops, then it is the website itself causing this problem. You could also try visiting the site with all JavaScript turned off, and see if the behaviour still persists (if it doesn't, there's some malicious JavaScript on the website).

0

Not certain if this will work with EFI, but - if you are certain that you have a "clean" system - have you tried overwriting the MBR and repartitioning? I've used a piece of code from (Microsoft) many times. It works from the DEBUG command-line and uses assembly code to overwrite the MBR. Between flashing the BIOS, overwriting the MBR and repartitioning the HDD - that should knock most nasties out. Then I would install NoScript, an ad-blocker and Ghostery in any browser I used.

Of course, this is only going to work with a PC infection - if your router/network or the website itself is compromised - then you'll need to take other action.

BTW, I would use a live Linux distro to pull off any good files that you have on the PC and put them onto a USB, etc. Then scan them to ensure they're good before putting them back on your "new" machine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.