BleepingComputer.com: Google Redirect won't let me run any anti-malware applications

I realised this evening that I had been infected with a Google redirect virus. I have AVG and Malwarebytes reali time protection running on my machine but neither was detecting anything. So, I came to bleeping computer and was going through the steps to compile logs before posting a topic. When I got to the last stage of the gmer log the computer refused to save the file and started giving me errors on anything I attempted to open or run. I had to go to my son's computer to post this topic as I can't get online on my machine now. The computer is also not recognizing the USB port I attempted to use to reload malwarebytes on my machine. I am at a total loss as to what to do now. Any help would be greatly appreciated.

I restarted my computer hoping that I wouldn't end up with it not booting and luckily it booted up. I was able to run the gmer application fully and save the log, so I will attach it as well as the logs from the dds application to this reply. It is allowing me to run malwarebytes now, but so far has still found nothing - the scan is not done yet though.

The scan finally finished and showed no infections found. My printer (which had stopped working earlier when the computer went completely psycho) is now functioning, but google is still being redirected. I am going to also attach the hijack this log that I just did, in case its of any help.

This post has been edited by originalgrissel: 08 April 2011 - 01:09 AM

to BC

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

I attempted to run combofix, after disabling both AVG and Malwarebytes real time protections but got a warning message saying that I should not run Combofix while AVG9 was installed and it would be dangerous to continue. Attempted to uninstall AVG9 but got an error message saying the uninstall failed. What is the best way to proceed?

Let's use AppRemover to do that. Download it here here and run it.

Follow the instructions here to remove AVG9. You can install it or another AV later.

Then run ComboFix.

Alrighty! Managed to get AVG removed with appremover and ran combofix with no problems so I am posting the log file here. It says it disinfected a file, I don't seem to be getting redirected via google any longer and my soundcard driver that was giving me an error earlier today is now functioning again. Thanks for all your help!!!

Something I should point out, regarding CCleaner,Glary Utilities, TuneUp Utilities and similar products

It's not recommended to use of registry cleaners. These often cause more problems than they fix. One of the Experts at Geekstogo, miekiemoes has an excellent writeup here
Another excellent article by Bill Castner is located here.


Let's continue.

Step 1.
Remove unwanted software:


Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

BitLord 1.2


Optional removals
BitLord 1.2 and P2P programs in general are legal themselves, but much of the content downloaded with them is downloaded illegally. They are also a great way to infect yourself with malware.
It's up to you if you want to remove the above programs, however I recommend you do.


Step 2.
MBAM:

• Launch Malwarebytes' Anti-Malware
  
• Update Malwarebytes' Anti-Malware
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Step 3.
Security check:


Download Security Check from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Step 4.
Things I would like to see in your reply:

• Which softwares have you uninstalled?
  
• The content of the log from MBAM in step 2.
  
• The content of checkup.txt from step 3.

Attached are the two logs from Malwarebytes and security check. I had un-installed bitlord earlier before your last reply as I'd been a bit worried about it anyway and had only rarely used it and not for several months. I also un-installed CCleaner. I can't even remember why I had installed it in the first place, and if it's something I don't need that could be causing problems I have no problem getting rid of it.

Thanks again for all your help.

A final scan before we do some housekeeping.

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic

Below is the log file from the ESET scan:


ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.17095 (vista_gdr.101217-1830)
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=11e1308f306c344bbc9f015d4ab61ef5
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-04-09 08:11:36
# local_time=2011-04-09 04:11:36 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 26748852 26748852 0 0
# compatibility_mode=1032 16777173 100 95 0 45394694 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=315916
# found=15
# cleaned=15
# scan_time=5346
C:\old dell backup\Kristie's Data\downloads\MK.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\old dell backup\Kristie's Data\downloads\Setup_FreeVideoConverter.exe Win32/Adware.Toolbar.Dealio application (deleted - quarantined) 00000000000000000000000000000000 C
C:\old dell backup\Kristie's Data\downloads\tzsr.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\old dell backup\Kristie's Data\downloads\Video2Flash.exe probably a variant of Win32/Bifrose.DPOPYEA trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\old dell backup\Kristie's Data\downloads\Purchased Software Updates\Nero-9.2.6.0_update.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
C:\old dell backup\Kristie's Data\downloads\Purchased Software Updates\Nero_BackItUp-4.2.16.0_update.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\avgtdix.sys.vir_ Win32/Olmarik.ZC trojan (cleaned - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\mouclass.sys.vir Win32/Olmarik.ZC trojan (cleaned - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\rdpcdd.sys.vir Win32/Olmarik.ZC trojan (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP460\A0048478.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP460\A0048479.exe Win32/Adware.Toolbar.Dealio application (deleted - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP460\A0048480.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP460\A0048481.exe probably a variant of Win32/Bifrose.DPOPYEA trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP460\A0048482.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP460\A0048483.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C

Hey there, originalgrissel !

OK! Well done, your log is clean again!

Time for some housekeeping.

Step 1.
Clean up:

We need to do is to remove all the tools that you have used. This is so that should you ever be re-infected, you will download updated versions. It will also remove the quarantined Malware from your computer.

First:

• Click START then RUN
  
• Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
  

Second:
Click Here to download OTC
Double-click OTC.exe to run it.
Click the Clean up button
Click Yes to the reboot.

Now delete any tools/logs that is left over after you ran OTC.


Step 2.
Prevention:

OK, lets carry out a few preventative steps to make sure you reduce the risk of further infections.

First:
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. NOT supported for use in 9x or ME

Upgrading Java :

• Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 24 .
  
• Click the JDK 6 Update 24 (JDK or JRE) "Download JRE" button to the right.
  
• Select your Platform, Register and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  
• Click on Continue.
  
• Click on the link to download Windows Offline Installation ( jre-6u24-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java version.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u24-windows-i586.exe and select "Run as an Administrator.")

Second:
One of the essentials is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vulnerable. It is best if you have these set to download automatically.

Automatic Updates for Windows

• Click Start.
  
• Select Settings and then Control Panel.
  
• Select Automatic Updates.
  
• Click Automatic (recommended)
  
• Choose a day and a time when you know the computer will be on and connected to the Internet.
  
• Click Apply then OK.

Third:
Now lets download some preventative programs that will help to keep the nasties away! We will start with Anti Spyware programs. I would advise getting a couple of them at least, and running each at least once a month.

Anti Spyware

• SpywareBlaster to help prevent spyware from installing in the first place. A tutorial can be found here.
  
• SpywareGuard to catch and block spyware before it can execute. A tutorial can be found here.

.
Note: If you find your system slows down after installing any of these, just uninstall it, or disable it from running at startup.


Fourth:
Next lets look at Firewalls. These help to prevent unauthorized access both to and from the Internet or your local network. A firewall is considered a first line of defense in protecting private information. Below are two free firewalls to choose from, if you do not already have one. Note: You only need one firewall one your system.

Personal Firewalls

• Comodo is a free fully functional firewall
  
• Online Armor (Free edition) personal firewall

Fifth:
Nearly done! If you like to use chat, MSN and Yahoo have vunerabilities that can leave you open to infections. There are however a couple of very good, Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN):

Instant Messengers

• Trillian or,
  
• Miranda-IM

Lastly:
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein.


I will keep this log open for the next couple of days, so if you have any further problems post another reply here.

OK, all the best, and stay safe!

Had a couple quick questions... Firstly, while trying to uninstall Combofix I got the "combofix cannot run while AVG is installed it would be dangerous to continue" message again. So I'm not sure if it actually uninstalled it or if it stopped part way through. Will I need to uninstall AVG again before uninstalling combofix and then reinstall AVG?

Secondly, you said that I only need one firewall on the computer but if I have my windows firewall active, does that still mean I need one in addition to that one? Or is that one enough?

Quote

No

Download this uninstaller. Run it to uninstall ComboFix.

Quote

Only one firewall i need. There should never be more then one. It's your choice which one you want to use, the one provided with Windows or another one. If you chose another one then disable Windows firewall.

Did you manage to get ComboFix uninstalled?

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.