Avast displays pop-ups about "JS:Redirector-BXI [Trj]"

[Puk]

Hello,

I seem to have a little virus problem. Almost every time I open a new page, Avast generates pop-ups indicating that it has blocked a harmful webpage or file, sometimes multiple times. The infection is specified as JS:Redirector-BXI [Trj] and the process affected is just "firefox.exe". I'm assuming this is a JavaScript related issue, but I haven't been able to find a permanent fix yet. I am well aware that free software will often try to install malware that causes such issues, but I have not installed any such software lately. This has only started happening very recently, and the only software I installed recently is CCleaner, which I doubt is the culprit here.

I have tried a clean reinstall of Firefox, both a full scan and a boot-time scan using Avast (which came up with nothing), starting Firefox in Safe Mode, none of which fixed the problem. The only extensions I have are AdBlock Plus and the extension that comes with Avast (Avast Online Security), which is disabled anyway. Firefox is my default web browser, and this issue only happens in Firefox and not in Internet Explorer. The only thing I did that fixed the problem was renaming "firefox.exe" to "firefox1.exe" and running the renamed file, but I am looking for a more permanent solution. I am using Windows 8.1 64-bit and the latest version of Firefox.

Please let me know if you require further information. Thanks in advance.

Edit: I have just run a Malwarebytes Anti-Malware scan which also came up with no threats and the issue persists.

Edit 2: I had been connecting to the Internet through a different router at a different location (in fact in a different country) before this issue appeared. In fact, this issue popped up immediately after I started connecting through the current one. Furthermore, I have this issue on both of my laptops, which worked fine before. This leads me to believe that the problem is with the router/network and not with the computer itself. However, resetting the router did not fix the problem.

Also, I noticed that Steam also seems to be affected. Clicking anywhere on the page in Steam Store will often create a new window, which Avast doesn't even block.

[LIMPET235]

Hi,
I've seen a recent ref; to that file on the AVAST forum.
So, you may want to check there?
> https://forum.avast.com/index.php?board=4.0
Found a sort-of recent thread naming the beast...but it was not completed.
> https://forum.avast.com/index.php?topic ... msg1242561

But a Google brings these...
> https://www.google.com/search?q=JS:Redirector-BXI+[Trj]&ie=utf-8&oe=utf-8&rls=org.mozilla:en-US:official&client=firefox-a&gfe_rd=cr&ei=xPH7VdmzGaru8we0yI2YCw


Moving to the Tech. forum...

[Puk]

Hi LIMPET235,

Thanks for the links you have provided. I have tried the suggestions in the thread that you linked to but no luck so far. I have created a thread on the same issue on the Avast forums as well, hopefully I will have some luck there. In the mean time, any suggestions are welcome.

[LoudNoise]

Did Firefox1.exe work?

[JayhawksRock]

Plenty of company over at Mister Softee
https://encrypted.google.com/search?sit ... LReDAevwfE

[Puk]

I have updated my original post with more details which might be useful in identifying the cause of the problem.

Did Firefox1.exe work?

Yes, I do not get pop-ups when I run firefox1.exe.

Plenty of company over at Mister Softee
https://encrypted.google.com/search?sit ... LReDAevwfE

Microsoft claims that those Redirector viruses will be removed by a scan with Microsoft Security Scanner, however the scan did not fix anything for me. Also, most of those guides involve steps like deleting registry entries created by the trojan and identifying the trojan in Task Manager, even though I don't know what those registry entries might be and don't recognize an unfamiliar process in Task Manager.

[LIMPET235]

Hi,
May I suggest that you go to...
> http://bleepingcomputer.com/
Register & check the forum for the beastie.

You could also try this free program from that site as well.
> adwCleaner > http://www.bleepingcomputer.com/download/adwcleaner/
Said to be very good at finding & removing "stuff", as are the experts there.

[Puk]

Thanks LIMPET235. AdwCleaner didn't help much, but I did find a solution in a topic I created on the Avast forums:
https://forum.avast.com/index.php?topic=176664.0

I managed to fix the problem using FRST as suggested in that topic.

[LIMPET235]

Thanks for the feedback.
It's much appreciated & yes, essexboy is very good at his job.

Also, It's recommended to perform whatever essexboy suggests to complete the clean-up.

Stay safe.