BleepingComputer.com: how doi deal with a redirecting virus????please help

Jump to content

Forum Rules

When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.


If you have not received help after three days, please post a link to your topic HERE.
Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

how doi deal with a redirecting virus????please help

#1 User is offline   lulolias 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 31
  • Joined: 15-May 11

Posted 15 May 2011 - 06:07 AM

hello

i have a virus that redirects to to spampages on google and other searchengines...and also sometimes when i mon my normal pages.

i have ran malwarebytes , but it didnt help...it is still the same.

can someone pls helpme...i am starting to get despearet since i cant use my internet anymore...

this is what i got from my malware:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6582

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

5/15/2011 5:53:52 PM
mbam-log-2011-05-15 (17-53-52).txt

Scan type: Full scan (C:\|)
Objects scanned: 230595
Time elapsed: 1 hour(s), 46 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 4
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\WINDOWS\system32\0F6226 (Worm.AutoRun) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\5A8DCC (Worm.AutoRun) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\76682F (Worm.AutoRun) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ACF7EF (Worm.AutoRun) -> Quarantined and deleted successfully.

Files Infected:
c:\WINDOWS\system32\5A8DCC\dp1.fne (Worm.Autorun) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\5A8DCC\HtmlView.fne (HackTool.Patcher) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\5A8DCC\internet.fne (HackTool.Patcher) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\5A8DCC\krnln.fnr (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\5A8DCC\RegEx.fnr (Worm.AutoRun) -> Quarantined and deleted successfully.
c:\documents and settings\Anny\start menu\Programs\Startup\74BE16.lnk (Worm.AutoRun) -> Quarantined and deleted successfully.





thank u guys:)

#2 User is offline   coles1mom 

  • Forum Regular
  • PipPipPip
  • Find Topics
  • Group: Members
  • Posts: 212
  • Joined: 01-November 08
  • Gender:Female

Posted 16 May 2011 - 08:26 AM

Hi lulolias,

Try this for your redirects http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller
Then run malwarebytes again.

#3 User is offline   quietman7 

  • Bleepin' Janitor
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Global Moderator
  • Posts: 25,517
  • Joined: 09-July 05
  • Gender:Male
  • Location:Virginia, USA

Posted 16 May 2011 - 12:35 PM

Before doing anything if you have not already done so, you should back up all your important documents, personal data files and photos to a CD or DVD drive as some infections may render your computer unbootable during or before the disinfection process. The safest practice is not to backup any files with the following file extensions: exe, .scr, .ini, .htm, .html, .php, .asp, .xml, .zip, .rar, .cab as they may be infected.

After running TDSSKiller, a log file named TDSSKiller_version_date_time_log.txt will be created and saved to the root directory (usually Local Disk C:). Copy and paste the contents of that file in your next reply.
Microsoft MVP - Consumer Security 2007-2012 Posted Image
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users