Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

browser being redirected/can't access updates or some websites


  • This topic is locked This topic is locked
14 replies to this topic

#1 duffer1

duffer1

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 19 February 2010 - 09:42 PM

Hi,

I have run malwarebytes anti-malware, Spybot Search and Destroy, Rootkit Revealer and Superantispyware free edition and the only thing they found was trojan.banker which malwarebytes said it would remove. After re-scanning it did not re-surface.

The problems I am experiencing are that the browser is being re-directed from google to random sites. Also when I try to update the above mentioned anti-malware programs the update process will stall or will not work at all. (I get an error message 730 00 when I try to update Malwarebytes Anti-Malware program). I did update them manually by getting the manual update files and then running them.

I had to get the manual updates on another computer because I cannot access websites that have to do with getting rid of malware such as the malwarebytes.org website, Microsoft windows update website or other websites that are usually accessed to fight this type of problem.

I have attached GMER and DDS logs.

I did run Defogger too.

I would appreciate any help you can give me.

THANKS!!!

Duffer1

Attached Files



BC AdBot (Login to Remove)

 


#2 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:43 AM

Posted 20 February 2010 - 02:12 PM

Thanks for those logs. Let's start with Combofix.

Download and Run Combofix

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Refer to this page on instructions on doing so.

Please include the C:\ComboFix.txt in your next reply for further review.

Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#3 duffer1

duffer1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 20 February 2010 - 08:01 PM

Thanks, Extremeboy, ComboFix log is attached.

I appreciate your help.

Duffer1

Attached Files

  • Attached File  log.txt   13.23KB   2 downloads

Edited by duffer1, 20 February 2010 - 08:02 PM.


#4 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:43 AM

Posted 20 February 2010 - 08:26 PM

Hello.

Let's do the following.

Run ComboFix with CFScript

We will run ComboFix again. This time, the instructions are slightly different.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are unsure how.
  • Open notepad (Start>Run>"notepad") and copy/paste the text in the quotebox below into it:
    CODE
    Driver::
    JXKBOXXQ
    Registry::
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "LWA"=-
    "LWB"=-
    "LWC"=-
    "LWD"=-
    "LWE"=-
    "LWF"=-
    "LWG"=-
    "LWH"=-
    "LWI"=-
    "LWJ"=-
    "LWK"=-
    "LWL"=-
    "LWM"=-
    "LWN"=-
    "LWO"=-
    "LWP"=-
    "LWQ"=-
    "LWR"=-
    "LWS"=-
    "LWT"=-
    "LWU"=-
    "LWV"=-
    "LWW"=-
    "LWX"=-
    "LWY"=-
    "LWZ"=-
    Save this as CFScript.txt, in the same location as ComboFix.exe. (This should be your desktop.)

    Refering to the picture above, drag CFScript into ComboFix.exe.
When finished, it shall produce a log for you at "C:\ComboFix.txt". Post back with that log.

Do not mouseclick ComboFix's window while it's running. That may cause it to stall

--
Download and run RootRepeal CR

Please download RootRepeal from the following location and save it to your desktop.
  • Unzip the RootRepeal.zip file it to it's own folder. (If you did not use the "Direct Download" mirror to download RootRepeal).
  • Close/Disable all other programs especially your security programs (anti-spyware, anti-virus, and firewall) Refer to this page, if you are unsure how.
  • Physically disconnect your machine from the internet as your system will be unprotected.
  • Double-click on RootRepeal.exe to run it. If you are using Vista, please right-click and run as Administrator...
  • Click the tab at the bottom.
  • Now press the button.
  • A box will pop up, check the boxes beside All Seven options/scan area
  • Now click OK.
  • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  • The scan will take a little while to run, so let it go unhindered.
  • Once it is done, click the Save Report button.
  • Save it as RepealScan and save it to your desktop
  • Reconnect to the internet.
  • Post the contents of that log in your reply please.
--
  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Under "Extra Registry" please check "Use Safelist" and also check "LOP Check" and "Purity Check" as pictured.
  • Copy and Paste the following code into the textbox. Do not include the word "Code"

    CODE
    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %ALLUSERSPROFILE%\Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    CREATERESTOREPOINT

  • Push
  • A report will open. Copy and Paste that report in your next reply.
  • Two reports will open, copy and paste them in a reply here:
    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Are the Redirects still there?

Edited by extremeboy, 20 February 2010 - 08:27 PM.

Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#5 duffer1

duffer1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 21 February 2010 - 08:54 PM

Thanks.

Still have the redirect problem.

I have attached the new logs. Combofix got hung up the first time I ran it after it re-booted the computer.

thanks, again for all your help!

Duffer

Attached Files



#6 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:43 AM

Posted 22 February 2010 - 08:43 PM

Yes, we need to replace a file here.

We need to create a batch file to run from the Recovery Console.
  • Open notepad
  • Copy the contents of the Code Box below to the notepad window
  • Click File -> Save As...
  • In the File name: field, type C:\runme.txt, then click Save
  • Close notepad

CODE
ren c:\windows\system32\drivers\atapi.sys atapi.old
copy C:\WINDOWS\ServicePackFiles\i386\atapi.sys c:\windows\system32\drivers



Now give the instructions to boot into recovery console. To boot into the Recovery Console, once your computer passes the BIOS, you will have 2 seconds in the OS choice menu to choose Windows XP or Windows Recovery Console. Use you arrow keys to move up. High-light it and hit Enter on your keyboard.

Once in recovery console:

Type the following command at the C:\Windows prompt then hit Enter: (note the space between ...ch C:\...)

batch C:\runme.txt


Reboot normally. Redirects gone? Take a new OTL scan run for me.
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#7 duffer1

duffer1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 22 February 2010 - 11:39 PM

YES! redirects gone, thanks.

I still cannot access certain websites (malwarebytes.org, ESET online scan and other sites pertaining to fixing malware problems)

I have attached new OTL logs.

Thanks, again!

Attached Files



#8 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:43 AM

Posted 23 February 2010 - 07:39 PM

Let's get a new Combofix run please. Run Combofix again and post the log.
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#9 duffer1

duffer1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 24 February 2010 - 08:40 AM

OK, here is the combofix log. thanks!

Attached Files

  • Attached File  log.txt   11.04KB   1 downloads


#10 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:43 AM

Posted 24 February 2010 - 05:56 PM

Hello.

Run ComboFix with CFScript

We will run ComboFix again. This time, the instructions are slightly different.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are unsure how.
  • Open notepad (Start>Run>"notepad") and copy/paste the text in the quotebox below into it:
    CODE
    File::
    C:\Windows\System32\drivers\etc\hosts
    DDS::
    TCP: {B983C3E1-9079-4D21-9FC4-9D4242AB62B4} = 93.188.162.103,93.188.166.85
    Registry::
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000143
    "NoDriveAutoRun"=dword:03ffffff
    "NoDrives"=dword:00000000
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableClock"=-
    Save this as CFScript.txt, in the same location as ComboFix.exe. (This should be your desktop.)

    Refering to the picture above, drag CFScript into ComboFix.exe.
When finished, it shall produce a log for you at "C:\ComboFix.txt". Post back with that log.

Do not mouseclick ComboFix's window while it's running. That may cause it to stall

Update and Scan with MalwareBytes Anti-Malware
  • Launch Malwarebytes' Anti-Malware
  • Go to the Update tab
  • Select Check for Update and let MBAM download and install any available updates.
  • After the update is complete go to the Scanner tab.
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

How's the computer running now? Are those problems still there?
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#11 duffer1

duffer1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 25 February 2010 - 12:09 AM

I can access the websites and update the programs now (after re-installing). Seems to be working normally. I have attached the Combofix and Maywarebytes logs.

Thanks, very much! I really appreciate all your help!

Anything else I should do?

THANKS!!!

Attached Files



#12 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:43 AM

Posted 26 February 2010 - 05:18 PM

No problem. Glad we could resolve that. smile.gif

Just one final step: wrapping up and cleanup our mess. smile.gif

Please follow/read the steps below to remove the tools we used and for some more information. smile.gif


Uninstall ComboFix

Remove Combofix now that we're done with it.
  • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
  • Please follow the prompts to uninstall Combofix.
  • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
This will uninstall Combofix and anything assoicated with it.

Download and Run OTC

We will now remove the tools we used during this fix using OTC.
  • Download OTC by OldTimer and save it to your desktop.
  • Double click icon to start the program. If you are using Vista, please right-click and choose run as administrator
  • Then Click the big button.
  • You will get a prompt saying "Being Cleanup Process". Please select Yes.
  • Restart your computer when prompted.

System A bit Slow? Try StartupLight

You may wish to try StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve preformance.

If that does not work, you can try the steps mentioned in Slow Computer/browser? Check Here First; It May Not Be Malware.


Congratulations! You now appear clean! specool.gif

Now that you are clean, please follow and read some of the prevention tips below.

Preventing Infections in the Future


Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

Some of the main things you should consider to perform/read are:
  • Disabling Autorun/Play on Flash-Drive/Removable Drives
  • Avoid gaming sites, underground web pages, pirated software sites, and Peer to Peer Programs
  • Keep Windows Updated through going to Windows Updates
  • Updating Non-Microsoft Programs
  • Keeping Security softwares updated

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Update all programs regularly - Make sure you update all the programs you have installed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help and thank you for choosing Bleeping Computer as you malware removal source.
Don't forget to tell your friends about us and Good luck thumbup2.gif


If you have no more questions, comments or problems please tell us, so we can close off the topic.

Thanks smile.gif

With Regards,
Extremeboy

Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#13 duffer1

duffer1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 26 February 2010 - 08:29 PM

ok done with cleanup. I really appreciate your help!!! Many Thanks!!! Duffer1

I would like to donate but am a little leary about using my credit card online since my computer was so infected. Is there an address I could send a check to?

Thanks.

Edited by duffer1, 26 February 2010 - 08:32 PM.


#14 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:43 AM

Posted 26 February 2010 - 09:49 PM

Hello again duffer1,

I'm glad I could help out. smile.gif

Thanks for your consideration of donating. Regarding your query, I don't know if it's possible to send a "check" online, so if you wish to donate, PayPal would be probably the easiest and most secure way. If you don't feel secure, you can use another computer however, the computer is now clean and should be good to use, then again the computer was quite severely infected with the warning I mentioned earlier. Your call.

Good luck and happy surfing again the future!

Cheers

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#15 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:43 AM

Posted 06 March 2010 - 03:06 PM

Hello.

Since the problem appears to be resolved, this topic is now Closed. Glad we could help smile.gif
If you need this topic reopened, please Send Me a Message. In your message please include the address of this thread in your request.

This applies only to the original topic starter

Everyone else please start a new topic.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users