Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google Redirect Virus.


  • Please log in to reply
17 replies to this topic

#1 dragonfall1221

dragonfall1221

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Local time:07:53 AM

Posted 02 January 2010 - 06:08 PM

Hello,

I have a Compaq Presario SR1750NX running Windows XP Professional service pack 2. Over the past week I have been dealing with a Google redirect bug. At first it only redirected a few times, now its constant. I ran AVG free, SUPERAntiSpyware, and Mbam, but nothing seemed to detect it. I have also run Dr. Web fixit, which seemed to work until I restarted my computer. The redirect always uses this link first http:// r9237242.cn/Lk22xeVP8E6Q0XU075a811404d23fdd2bc679e889770928a27h then immediately takes me to random search engines

I have logs from MBAM and HijackThis! saved from yeaterday. I also have DDS logs if that would be useful. Any help would be greatly appreciated Thank you so much in advance,
dragonfall

UPDATE

Just noticed I am also unable to enter SafeMode. When I tried the computer got as far as booting MUP.SYS and then restarted itself.

Edited by dragonfall1221, 02 January 2010 - 06:48 PM.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,441 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:53 AM

Posted 02 January 2010 - 06:55 PM

Hello and welcome

SUPERAntiSypware has a built in "Repairs" feature to fix policy restrictions and certain Windows settings which are sometimes targeted by malware infection. To use this feature, launch SUPERAntiSypware.
  • Click the Repairs tab.
  • Click on (highlight) "Repair broken SafeBoot key" and then click the Repair button.
  • You may be asked to reboot your computer for the changes to take effect.

Please post the MBAM log
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.

Now run Part 1 of S!Ri's SmitfraudFix .
Please download SmitfraudFix

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 dragonfall1221

dragonfall1221
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Local time:07:53 AM

Posted 02 January 2010 - 07:09 PM

Hi!!

Here's the MBAM log

Malwarebytes' Anti-Malware 1.42
Database version: 3453
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/1/2010 04:47:08 PM
mbam-log-2010-01-01 (16-47-08).txt

Scan type: Full Scan (C:\|)
Objects scanned: 360018
Time elapsed: 2 hour(s), 34 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

running smitfraud fix now

#4 dragonfall1221

dragonfall1221
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Local time:07:53 AM

Posted 02 January 2010 - 07:16 PM

And the SmitFraudFix Log

SmitFraudFix v2.416

Scan done at 16:13:40.46, Sat 01/02/2010
Run from C:\Documents and Settings\Rainya.R2D2\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\help and things\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Documents and Settings\Rainya.R2D2\Desktop\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

hosts


C:\


C:\WINDOWS


C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32


C:\WINDOWS\system32\LogFiles


C:\Documents and Settings\Rainya.R2D2


C:\DOCUME~1\RAINYA~1.R2D\LOCALS~1\Temp


C:\Documents and Settings\Rainya.R2D2\Application Data


Start Menu


C:\DOCUME~1\RAINYA~1.R2D\FAVORI~1


Desktop


C:\Program Files


Corrupted keys


Desktop Components



o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



IEDFix
!!!Attention, following keys are not inevitably infected!!!




Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000001


Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""




DNS

Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Packet Scheduler Miniport
DNS Server Search Order: 192.168.1.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{897A0D76-4FC8-4660-B9D8-BB57C34B84E8}: DhcpNameServer=192.168.1.254


Scanning for wininet.dll infection


End

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,441 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:53 AM

Posted 02 January 2010 - 07:16 PM

Update and Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Check your JAVA
Go into Control Panel>Add Remove Programs. Be sure the 'Show Updates' box is checked. Go down the list and tell me what Java applications are installed and their version. (Highlight the program to see this).

Edited by boopme, 02 January 2010 - 07:18 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 dragonfall1221

dragonfall1221
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Local time:07:53 AM

Posted 02 January 2010 - 07:51 PM

Here's the new MBAM log

Malwarebytes' Anti-Malware 1.43
Database version: 3483
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/2/2010 04:45:50 PM
mbam-log-2010-01-02 (16-45-50).txt

Scan type: Quick Scan
Objects scanned: 173316
Time elapsed: 22 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


JAVA Applications

J2SE Runtime Enviornment 5.0 Update 6 Version 1.5.0.60
JAVA ™ 6 Update 15 Version 6.0.150

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,441 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:53 AM

Posted 03 January 2010 - 01:10 PM

How's it now??
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Runtime Environment (JRE)" JRE 6 Update 17.
  • Click the Download button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u17-windows-i586.exe to install the newest version.
  • If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 dragonfall1221

dragonfall1221
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Local time:07:53 AM

Posted 03 January 2010 - 07:39 PM

Hi,

did as ordered. Deleted all old Java and installed the newest updates, but IE is still redirecting. I have noticed that Firefox doesnt, if that's any help.

Thanks for taking the time to help me on this,
dragonfall1221

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,441 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:53 AM

Posted 03 January 2010 - 07:55 PM

You're welcome... let's run Drweb-cureit and a rootkit scan and see if we can find it.



Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet.
alternate download link
Note: The file will be randomly named (i.e. 5mkuvc4z.exe).

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:
  • Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version
  • Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
  • The Express scan will automatically begin.
    (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
  • If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
  • If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)
  • After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
  • In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
  • Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
  • Please be patient as this scan could take a long time to complete.
  • When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
  • Click Select All, then choose Cure > Move incurable.
  • In the top menu, click file and choose save report list.
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)


We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop.
  • Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all seven boxes: Posted Image
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 dragonfall1221

dragonfall1221
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Local time:07:53 AM

Posted 03 January 2010 - 08:27 PM

I still can't boot up in safemode, and I followed your instructions about the safeboot repair. :thumbsup:
The computer tries, gets to MUP.SYS, then automatically reboots itself.

#11 dragonfall1221

dragonfall1221
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Local time:07:53 AM

Posted 03 January 2010 - 11:22 PM

Okay, situation gone from bad to seriously screwed up.

I after the last set of problems I just shut down the computer. I just tried to restart it and I'm getting nothing but this message after a lot of strange script.

Windows could not start because the following file is missing or corrupt:
<Windows root>system32\hal.dll
Please re-install a copy of the above file


What's happening? I can't do anything now because all the computer shows is this one thing (i'm writting this on a laptop). I don't have a Windows XP installation disk so I can't boot up from one. I'm pulling my hair out here!!!!

Thanks in advance for you help!
dragonfall1221

#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,441 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:53 AM

Posted 03 January 2010 - 11:35 PM

I have been trying to find something for you. I think you should open a topic in XP at the top. I'm almost certain one of the advisors there knows how to do this.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 dragonfall1221

dragonfall1221
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Local time:07:53 AM

Posted 03 January 2010 - 11:43 PM

You're there!

Okay, just started a thread in XP. Thank you for helping me with this. Hopefully someone there can help me fix this and I can get back to following your instructions on getting rid of this evil bug.

Thanks again,
dragonfall1221

#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,441 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:53 AM

Posted 03 January 2010 - 11:51 PM

You're welcome. There is a way ,I just don't know it. we'll keep this open.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 dragonfall1221

dragonfall1221
  • Topic Starter

  • Members
  • 68 posts
  • OFFLINE
  •  
  • Local time:07:53 AM

Posted 04 January 2010 - 11:02 PM

Hi again boopme,

I had to go ahead and recover my PC (very long, frustration story there). I was wondering if I should restart the cleansing process you told me here, just to be sure? Could whatever it was that tried to kill my computer still be hiding?

Thanks!
dragonfall1221




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users