Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser Results Redirect to another site


  • Please log in to reply
10 replies to this topic

#1 RGary3829

RGary3829

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 15 November 2009 - 03:12 PM

I am new to this forum.

I have contacted Mcafee and they claim (after going through my system) that my computer is virus-free.

I have a Dell Dimension 2400 Desktop computer and I am using the following:

MicroSoft XP Home Edition with Service Pack 3 version 5.1.2600
Pentium 4 2.53 GHz
Internet Explorer 8 version 8.0.6001.18702
Comcast high-speed Internet
Mcafee Virus Protection - scanned - no viruses detected
Malwarebytes - scanned - no malware detected
Ad-Aware - scanned - no critical adware detected - only cookies

When I do a GOOGLE or MSN search and click on the results - I am re-directed to another site that is usually selling something. However, if I copy the url and paste into the address box it seems to work OK.

BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:05 PM

Posted 17 November 2009 - 09:12 PM

Welcome to BC


:trumpet:
We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop.
  • Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all seven boxes: Posted Image
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

----------------------------------

Please note: If Rootrepeal fails to run, try this step: Click Settings - Options. Set the Disk Access slider to High

Also try: right-click on rootrepeal.exe and rename it to tatertot.scr

===========================

:flowers:
Please download Win32kDiag.exe by AD and save it to your desktop.
alternate download 1
alternate download 2
  • This tool will create a diagnostic report
  • Double-click on Win32kDiag.exe to run and let it finish.
  • When it states Finished! Press any key to exit..., press any key on your keyboard to close the program.
  • A file called Win32kDiag.txt should be created on your Desktop.
  • Open that file in Notepad and copy/paste the entire contents (from Starting up... to Finished! Press any key to exit...) in your next reply.
--------------------------------------


:thumbsup: Go to Posted Image > Run..., then copy and paste this command into the open box: cmd
Click OK.
At the command prompt C:\>, copy and paste the following command and press Enter:
DIR /a/s %windir%\scecli.dll %windir%\netlogon.dll %windir%\eventlog.dll >Log.txt & START notepad Log.txt
A file called log.txt should be created on your Desktop.
Open that file and copy/paste the contents in your next reply.
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 RGary3829

RGary3829
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 17 November 2009 - 11:05 PM

Not certain if I have done this correctly - I really appreciate the time you are spending to help me.

Gary

Volume in drive C has no label.
Volume Serial Number is 88E7-6462

Directory of C:\WINDOWS\$NtServicePackUninstall$

08/04/2004 02:56 AM 180,224 scecli.dll

Directory of C:\WINDOWS\$NtServicePackUninstall$

08/04/2004 02:56 AM 407,040 netlogon.dll

Directory of C:\WINDOWS\$NtServicePackUninstall$

08/04/2004 02:56 AM 55,808 eventlog.dll
3 File(s) 643,072 bytes

Directory of C:\WINDOWS\ServicePackFiles\i386

04/13/2008 07:12 PM 181,248 scecli.dll

Directory of C:\WINDOWS\ServicePackFiles\i386

04/13/2008 07:12 PM 407,040 netlogon.dll

Directory of C:\WINDOWS\ServicePackFiles\i386

04/13/2008 07:11 PM 56,320 eventlog.dll
3 File(s) 644,608 bytes

Directory of C:\WINDOWS\SYSTEM32

04/13/2008 07:12 PM 181,248 scecli.dll

Directory of C:\WINDOWS\SYSTEM32

04/13/2008 07:12 PM 407,040 netlogon.dll

Directory of C:\WINDOWS\SYSTEM32

04/13/2008 07:11 PM 56,320 eventlog.dll
3 File(s) 644,608 bytes

Total Files Listed:
9 File(s) 1,932,288 bytes
0 Dir(s) 12,295,270,400 bytes free

#4 RGary3829

RGary3829
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 18 November 2009 - 06:36 AM

Sorry - I forgot to include this report in the last post

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/11/17 22:58
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xB19B8000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7999000 Size: 8192 File Visible: No Signed: -
Status: -

Name: IsDrv122.sys
Image Path: C:\WINDOWS\System32\Drivers\IsDrv122.sys
Address: 0xAFA38000 Size: 211840 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xAF99D000 Size: 49152 File Visible: No Signed: -
Status: -

==EOF==

#5 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:05 PM

Posted 18 November 2009 - 06:35 PM

Your system is infected with a new rootkit variant that has become quite pervasive as evidenced by these entries:
08/04/2004 02:56 AM 55,808 eventlog.dll
The rootkit itself is a protection module used to terminate a variety of security tools by changing the permissions on targeted programs so that they cannot run or complete scans. Disinfection will require the use of more powerful tools than we recommend in this forum.

Rootkits, backdoor Trojans, Botnets, and IRCBots are very dangerous because they compromise system integrity by making changes that allow it to by used by the attacker for malicious purposes. Rootkits are used by Trojans to conceal its presence (hide from view) in order to prevent detection of an attacker's software and make removal more difficult. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. They can disable your anti-virus and security tools to prevent detection and removal. Remote attackers use backdoors as a means of accessing and taking control of a computer that bypasses security mechanisms. This type of exploit allows them to steal sensitive information like passwords, personal and financial data which is send back to the hacker. To learn more about these types of infections, you can refer to:If your computer was used for online banking, has credit card information or other sensitive data on it, you should stay disconnected from the Internet until your system is fully cleaned. All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised and change each password using a clean computer, not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connect again. Banking and credit card institutions should be notified of the possible security breach.

Although the infection has been identified and may be removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if the malware appears to have been removed. In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired so you can never be sure that you have completely removed a rootkit. The malware may leave so many remnants behind that security tools cannot find them. Tools that claim to be able to remove rootkits cannot guarantee that all traces of it will be removed. Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:Should you decide not to follow that advice, we will do our best to help clean the computer of any infections but we cannot guarantee it to be trustworthy or that the removal will be successful. If you wish to proceed, please do the following.

Please read the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log". If you cannot complete a step, then skip it and continue with the next. In Step 6 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log.

Start a new topic and post your DDS log along with the results of the Log.txt from Post #3 and #4 reports in the HijackThis Logs and Malware Removal forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If DDS will not run, then just post the results of the Log.txt. Be sure to include a note that you tried to follow the Prep Guide but were unable to get DDS to run. If you already downloaded Combofix, do not use it until instructed to do so by the Helper in that forum.

Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

Edited by garmanma, 18 November 2009 - 06:37 PM.

Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#6 RGary3829

RGary3829
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 18 November 2009 - 10:22 PM

Thanks for your hard work and helping me.

Would it be best to purhase a new computer and start over?

#7 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:05 PM

Posted 19 November 2009 - 08:54 PM

purchase a new computer

Oh heck no, but I would reinstall the OS

Do you have the Dell CD's that came with the computer?

Dells also have a recovery partition
http://support.dell.com/support/topics/glo...toggle=&dl=
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#8 RGary3829

RGary3829
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 19 November 2009 - 09:40 PM

Yes - I do have the Dell O/S CD

I am very concerned about some of the programs and data that I have - can this be saved?

#9 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:05 PM

Posted 20 November 2009 - 07:33 PM

That's is a tricky question without a simple answer
In all likelihood ,any pictures should be alright, music should be OK. It's usually the codecs that get infected not the music.
Data files are a different story. There is no telling where this infection has attached itself to.
As far as programs go, have a look here:
Freeware Replacements For Common Commercial Apps
http://www.bleepingcomputer.com/forums/topic272284.html

Like I said the decision is yours. You can still try the HJT forum

Edited by garmanma, 20 November 2009 - 07:35 PM.

Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#10 RGary3829

RGary3829
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:01:05 PM

Posted 21 November 2009 - 07:55 AM

I apologize for asking so many questions.

This is a very difficult decision, as I have all of my wife's small business records (Quicken, TurboTax, MS Word, MS Excel, MS Database, emails) in this computer.

I believe from what you have shared through your postings that there is no way to ensure that corrupted files can be found and eliminated.

I read my options as:

1. Re-Load the Operating System (Window XP Home) which I have the original CD. However, there is a risk on the infection remaining.

2. Re-Load the Operating System and Re-Format the Hard Drive. Which will give me a fresh start, but all programs will need to be re-installed (most I have the original CDs). Even if I copied all the files - there is a risk bring thenm into the newly formatted Hard Drive.

3. Purchase a new computer and use the old computer for off-line (non-internet use) only. This option would prevent bring old files (data) into the new computer.

If you were in this position, what would you have done?

Additionally, is there a program or service that would have prevented this infection?

#11 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:05 PM

Posted 21 November 2009 - 07:49 PM

If you were in this position, what would you have done?

I would probably try the HJT forum
If all goes well and they're satisfied it's clean, I would then do this
Instead of buying another computer, I would spend my money on a new hard drive.
Burn the data you want to save to CD's
I would wipe and format the old drive
I would then remove the drive and install it in a remote hard drive enclosure
Install the OS on the new hard drive
I would then purchase a program called Acronis, which is a backup/ghosting application
I would create a full back up image of the drive and then have it set up to do a incremental back up every week

This new infection is getting a lot of people who thought they were sufficiently protected
It would be best to read the pinned topics and ask any questions in this forum
AntiVirus, Firewall and Privacy Products and Protection Methods
http://www.bleepingcomputer.com/forums/f/25/antivirus-firewall-and-privacy-products-and-protection-methods/


===================================



Tips to protect yourself against malware and reduce the potential for re-infection:
• "Simple and easy ways to keep your computer safe".
• "How did I get infected?, With steps so it does not happen again!".
• "Hardening Windows Security - Part 1 & Part 2".
• "IE Recommended Minimal Security Settings" - "How to Secure Your Web Browser".

• Avoid gaming sites, underground web pages, pirated software, crack sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smrgsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Edited by garmanma, 21 November 2009 - 07:51 PM.

Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users