Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Malware.Trace / Google link redirect Help (Server 2003)


  • This topic is locked This topic is locked
2 replies to this topic

#1 gmaslin

gmaslin

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:30 PM

Posted 09 August 2010 - 01:00 PM

Hello!

Thanks in advance for any effort in helping me fix this.

A few days ago I noticed that Google search result links were all getting redirected to seemingly random pages. This is a shared Windows Server 2003 PC. It is currently running the free Clamwin anti-virus software. Clamwin does not detect anything when I do a full scan. In fact, I could only find one software that found threats. I tried Spybot, Hitman, SmitFraudFix, Superantispyware, and few others. AVG, Avast, and some of the other better known free anti-virus softwares don't seem to install on Server 2003, hence the Clamwin.

I also ran Malwarebytes and it found 5 infected registry keys; it requires a full scan to see them. They are copied here:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{149256d5-e103-4523-bb43-2cfb066839d6} (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{149256d5-e103-4523-bb43-2cfb066839d6} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\WinServers (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Sysinternals Antivirus (Rogue.SysinternalsAntivirus) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ADBUPD (Trojan.Agent) -> No action taken.
Malwarebytes always reports that everything was successfully removed and quarantined when I prompt it to do so. However, the Malware.Trace always shows back up in no time at all.

As far as the logs that your site requests, DDS does not seem to be Server 2003 compatible. The first time I tried to run it, I received a message about an incompatible windows version when I was prompted to 'Hit any key to continue'. Now however, the program just closes/disappears with no message. Below is the copy/paste log from GMER. The file is also attached as requested. I have a HijackThis log file as well, but I believe I read not to post that unless asked.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-09 12:51:47
Windows 5.2.3790 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1.GEN\LOCALS~1\Temp\pgncqpog.sys


---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!DialogBoxParamW 773896A9 5 Bytes JMP 40CD54C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!SetWindowsHookExW 7738CE55 5 Bytes JMP 40DA9AC9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!CreateWindowExW 773923B8 5 Bytes JMP 40DADB1C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!CallNextHookEx 7739C062 5 Bytes JMP 40D9D0ED C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!MessageBoxExW 7739EE4A 5 Bytes JMP 40EA4612 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!UnhookWindowsHookEx 773A083D 5 Bytes JMP 40D1467C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!DialogBoxIndirectParamW 773A6296 5 Bytes JMP 40EA480F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!MessageBoxExA 773C42AD 5 Bytes JMP 40EA4674 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!DialogBoxParamA 773CA0AF 5 Bytes JMP 40EA47AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!DialogBoxIndirectParamA 773CA172 5 Bytes JMP 40EA4872 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!MessageBoxIndirectA 773D7D40 5 Bytes JMP 40EA4741 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] USER32.dll!MessageBoxIndirectW 773D7E30 5 Bytes JMP 40EA46D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] ole32.dll!OleLoadFromStream 776A00B4 5 Bytes JMP 40EA4B77 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] ole32.dll!CoCreateInstance 776A692A 5 Bytes JMP 40DADB78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] ws2_32.dll!WSASend 71C02430 5 Bytes JMP 00B0719D
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] ws2_32.dll!closesocket 71C02CB2 5 Bytes JMP 00B07331
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] ws2_32.dll!send 71C02EC2 5 Bytes JMP 00B07073
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] ws2_32.dll!recv 71C02F7F 5 Bytes JMP 00B070E6
.text C:\Program Files\Internet Explorer\iexplore.exe[5324] ws2_32.dll!WSARecv 71C09480 5 Bytes JMP 00B07237
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] USER32.dll!DialogBoxParamW 773896A9 5 Bytes JMP 40CD54C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] USER32.dll!CreateWindowExW 773923B8 5 Bytes JMP 40DADB1C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] USER32.dll!MessageBoxExW 7739EE4A 5 Bytes JMP 40EA4612 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] USER32.dll!DialogBoxIndirectParamW 773A6296 5 Bytes JMP 40EA480F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] USER32.dll!MessageBoxExA 773C42AD 5 Bytes JMP 40EA4674 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] USER32.dll!DialogBoxParamA 773CA0AF 5 Bytes JMP 40EA47AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] USER32.dll!DialogBoxIndirectParamA 773CA172 5 Bytes JMP 40EA4872 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] USER32.dll!MessageBoxIndirectA 773D7D40 5 Bytes JMP 40EA4741 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] USER32.dll!MessageBoxIndirectW 773D7E30 5 Bytes JMP 40EA46D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] ws2_32.dll!WSASend 71C02430 5 Bytes JMP 00B0719D
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] ws2_32.dll!closesocket 71C02CB2 5 Bytes JMP 00B07331
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] ws2_32.dll!send 71C02EC2 5 Bytes JMP 00B07073
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] ws2_32.dll!recv 71C02F7F 5 Bytes JMP 00B070E6
.text C:\Program Files\Internet Explorer\iexplore.exe[5448] ws2_32.dll!WSARecv 71C09480 5 Bytes JMP 00B07237
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!DialogBoxParamW 773896A9 5 Bytes JMP 40CD54C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!SetWindowsHookExW 7738CE55 5 Bytes JMP 40DA9AC9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!CreateWindowExW 773923B8 5 Bytes JMP 40DADB1C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!CallNextHookEx 7739C062 5 Bytes JMP 40D9D0ED C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!MessageBoxExW 7739EE4A 5 Bytes JMP 40EA4612 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!UnhookWindowsHookEx 773A083D 5 Bytes JMP 40D1467C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!DialogBoxIndirectParamW 773A6296 5 Bytes JMP 40EA480F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!MessageBoxExA 773C42AD 5 Bytes JMP 40EA4674 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!DialogBoxParamA 773CA0AF 5 Bytes JMP 40EA47AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!DialogBoxIndirectParamA 773CA172 5 Bytes JMP 40EA4872 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!MessageBoxIndirectA 773D7D40 5 Bytes JMP 40EA4741 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] USER32.dll!MessageBoxIndirectW 773D7E30 5 Bytes JMP 40EA46D6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] ole32.dll!OleLoadFromStream 776A00B4 5 Bytes JMP 40EA4B77 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] ole32.dll!CoCreateInstance 776A692A 5 Bytes JMP 40DADB78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] ws2_32.dll!WSASend 71C02430 5 Bytes JMP 00B0719D
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] ws2_32.dll!closesocket 71C02CB2 5 Bytes JMP 00B07331
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] ws2_32.dll!send 71C02EC2 5 Bytes JMP 00B07073
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] ws2_32.dll!recv 71C02F7F 5 Bytes JMP 00B070E6
.text C:\Program Files\Internet Explorer\iexplore.exe[5856] ws2_32.dll!WSARecv 71C09480 5 Bytes JMP 00B07237

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Fastfat \Fat B5AC01C2

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DesktopHeapLogging 1

---- EOF - GMER 1.0.15 ----

Attached Files

  • Attached File  ark.txt   11.18KB   0 downloads


BC AdBot (Login to Remove)

 


#2 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:05:30 PM

Posted 17 August 2010 - 07:50 AM

Welcome to the BleepingComputer Forums.

Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again.
  1. Double click on RSIT.exe to run RSIT.
  2. Click Continue at the disclaimer screen.
  3. Please post the contents of log.txt.
Thank you for your patience.

Please see Preparation Guide for use before posting about your potential Malware problem.

If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped.

Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so.

While we are working on your HijackThis log, please:
  1. Reply to this thread; do not start another!
  2. Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so.
  3. Do not run any other tool until instructed to do so!
  4. Let me know if any of the links do not work or if any of the tools do not work.
  5. Tell me about problems or symptoms that occur during the fix.
  6. Do not run any other programs or open any other windows while doing a fix.
  7. Ask any questions that you have regarding the fix(es), the infection(s), the performance of your computer, etc.
Thanks.
You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.

#3 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:05:30 PM

Posted 31 August 2010 - 08:57 AM

This subject is now closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.

You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users