Hijackthis log -XP - Redirects Firefox to antivirus sites

Dear Forum,

I kept trying to download Deckards and I got a generic site just saying “download now” in huge letters. Earlier, I was trying to download an antivirus system in both internet exploder and mozilla firefox and again the specific web address typed in at the top was hijacked over multiple times to the same site that I’d never heard of.

I installed Avast after the virus got in. At least sometimes Avast announces verbally that malware was thwarted, much better than the $1000 Walmart shopping card vocals. However, my outside drives are blocked. My thumb drive is seen by the computer because it tells me that a more modern USB port could run it faster, but on “my computer” it doesn’t show up. The tactic is to block me from transferring software from another computer. The same goes with the CD drive.

I just clicked on “properties” under “my computer”. I got a popup box saying “security warning”. “Application cannot be executed. The file rundll32.exe is infected. Do you want to activate your antivirus software now?” The “x” close-the-window box in the corner looks a little bit fake. Also, I hit the start button and it permanently covered up about half of this popup box. Messy, a bit fake for a popup warning. The messy popup box stayed in front of my MS Word “save as” popup box but I typed behind it to save this document. After minimizing the Word document, the popup’s “yes” button is on top of a piece of the “start” menu, which is on top of half of the actual “security warning”.
More fun: ctrl-alt-delete seems jammed sometimes. Also, the computer gets stuck between “shutting down” and actually shutting down. I flip the surge strip’s power switch off. I tried to turn on the XP firewall following your site’s instructions but mozilla firefox immediately jumped into "download this product" mode. Ctrl-alt-delete did get me into the task manager this time and I bombed out of mozilla. Then I got into control panel / windows firewall and I selected “no exceptions”.

I bought the computer used and it didn’t come with an XP repair disk.

Finally I got hijackthis downloaded and ran it. File enclosed.

Thanks!
-Paul Klinkman

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

We need to create a New FULL OTL Report

• Please download OTL from here if you have not done so already:
  
  • Main Mirror
• Save it to your desktop.
• Double click on the icon on your desktop.
• Click the "Scan All Users" checkbox.
• Change the "Extra Registry" option to "SafeList"
• Push the button.
• Two reports will open, copy and paste them in a reply here:
  
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized

After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.

Best Regards,
oneof4.

I'm sorry. I gave up and paid someone $50. Now he's having trouble and is running three days later than he planned. I realize that this isn't what you wanted to hear.

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

Reopened by OP request.

One of the problems of disconnecting from the internet to run scanning software is that the instructions disappear. I didn't disconnect the antivirus program, which has now become Microsoft Security Essentials and Malwarebytes Anti-Malware.

I downloaded GMER. It started itself up.

I pulled the cable out to the router.

There was no "scan all users" checkbox to check. The computer only has one user named "user".

I didn't see an "extra registry" option either.

I scanned for an hour. There was no OTL.txt opened. There was no extra.txt file minimized. I saved the log file as klinkman.log.

Let's see what I do next.

Thanks,
Paul Klinkman

Hello Klinkman,

• Welcome to Bleeping Computer.
  
• My name is fireman4it and I will be helping you with your Malware problem.
  
  Please take note of some guidelines for this fix:
  
• Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools.
  
• If you do not understand any step(s) provided, please do not hesitate to ask before continuing.
  
• Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean".
  
• Finally, please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply, unless they do not fit into the post.

We need to get a little more information on what we are dealing with before we begin cleaning your machine.


1.
Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

* When done, DDS will open two (2) logs:

1. DDS.txt
2. Attach.txt

Save both reports to your desktop post the contents of the DDS.txt log. Save the other report incase I need to look at it later.


2.
Please download Rootkit Unhooker from one of the following links and save it to your desktop.
Link 1 (.exe file)
Link 2 (zipped file)
Link 3 (.rar file)In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

• Double-click on RKUnhookerLE.exe to start the program.
  Vista/Windows 7 users right-click and select Run As Administrator.
• Click the Report tab, then click Scan.
• Check Drivers, Stealth, and uncheck the rest.
• Click OK.
• Wait until it's finished and then go to File > Save Report.
• Save the report to your Desktop.
• Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

3.
Please download MBRCheck to your desktop.

1. Double click MBRCheck.exe to run it (Right click and run as Administrator for Vista).
2. It will open a black window, please do not fix anything (if it gives you an option).
3. Exit that window and it will produce a log (MBRCheck_date_time).
4. Please post that log when you reply.

Things to include in your next reply::
DDS.txt
Attach.txt
RkuUnhooker log
MBRCheck log

Hello.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 5-7 days the topic will need to be closed.

Thanks for understanding

With Regards,
fireman4it

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.