Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

browser redirect virus: I think I got rid of it but now there are crashes


  • Please log in to reply
5 replies to this topic

#1 Jim Asafanaster

Jim Asafanaster

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:02 PM

Posted 02 May 2011 - 10:58 AM

The symptom I was observing was that links I clicked in Firefox would get redirected to other sites. I was seeing this with Google search results but that is where I mostly click links so it might have been occurring elsewhere also.

I ran several AV tools and one of them -- I think it was SuperAntiSpyware -- detected and removed hiloti. However, the problem did not go away, and we got a new problem, the BSOD with the following message:
...
*** STOP: 0x0000007E (0xC0000005, 0xBA1DA49D, 0xBA5070670, 0xBA50736C)
*** BusRMUSC.sys: Address BA1DA49D base at BA1D8000, DateStamp 465ce32a
...

This has occurred twice; once during a run of GMER, once during some other stuff, word processing I think. I killed several processes that I didn't need at the moment and it didn't happen again, so I think the timing during GMER was just a coincidence.

Anyway, I ran ComboFix (I know, I wasn't asked to, but I am an IT Professional and therefore impervious to consequences :-) -- or more precisely, I hadn't read all the instructions yet). It quarantined several files. We have not seen the redirect recur since, but we haven't done enough web browsing to feel any statistical certainty that it is indeed solved, and the crash occurred once after the ComboFix run, so there's still at least one problem.

So I ran a full backup, followed the instructions in your guide, and the relevant files are attached. My questions are:

  • Do I still have a virus, can you tell?
  • How would I fix the BSOD?
  • If answer to previous question is "reinstall the OS from the CD," is there a way to do that without wiping out all my files and other programs? The documentation on the restore function is a little unclear on this point.

Edit: Moved topic from XP to the more appropriate forum. ~ Animal

Attached Files



BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,944 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:09:02 PM

Posted 10 May 2011 - 05:42 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Please take note:

  • If you have since resolved the original problem you were having, we would appreciate you letting us know.
  • If you are unable to create a log because your computer cannot start up successfully please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • If you are unable to perform the steps we have recommended please try one more time and if unsuccessful alert us of such and we will design an alternate means of obtaining the necessary information.
  • If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • Upon completing the steps below another staff member will review your topic an do their best to resolve your issues.
  • If you have already posted a DDS log, please do so again, as your situation may have changed.
  • Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


Thanks and again sorry for the delay.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 Jim Asafanaster

Jim Asafanaster
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:02 PM

Posted 11 May 2011 - 01:41 AM

> If you have since resolved the original problem you were having, we would appreciate you letting us know.
I have not.

> If you are unable to create a log ...

I attached a couple of logs in my original message. These seem to me to be what you're asking for.

> Please tell us if you have your original Windows CD/DVD available.

Yes.

> If you have already posted a DDS log, please do so again, as your situation may have changed.
Since we're uncertain what software may be running on the computer and sending spam or trying to infect our other computers, the computer is turned off for the duration. Hence, the original logs would still reflect the current situation.

#4 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:02 PM

Posted 12 May 2011 - 06:28 PM

Hello Jim Asafanaster

Welcome to BleepingComputer :)
==========================
Sorry for the delay.

The blue screen's you had are more than likely from gmer this sometimes has conflicts with other software since it has to inject it's own driver into memory.
Have you had anymore blue screen's since the last one you mentioned?

Can you please post the combofix log if you still have it?
I just want to see what was removed.



Please submit the following files to one of these online file scanners.
(All you have to do is copy and paste the file path into the box when you click on Browse then once you have done that click on the open button then submit)

c:\windows\rmubcntl.dll
c:\windows\cvnet05.dll


Jotti File Scan
VirusTotal File Scan

This will produce a report after the scan is complete, please copy and paste those results in your next post.
Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

#5 Jim Asafanaster

Jim Asafanaster
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:02 PM

Posted 30 May 2011 - 08:44 PM

Sorry for the delay in responding -- we've been out of the country.

Have you had anymore blue screen's since the last one you mentioned?

No.

Can you please post the combofix log if you still have it?
I just want to see what was removed.

Done.

Please submit the following files to one of these online file scanners...

It listed a bunch of virus checking tools and next to each of them it said "Found nothing".
We had a flare-up of the "Defender" fake antivirus program, which I removed, but it reinforces my opinion that we didn't catch everything. I'm attaching the latest information from GMER and DDS.
Is there a way to reload the OS files and BIOS without rewriting the whole disk? We can reinstall other programs, but if there's some lurker that's hard to find I'd like to just stomp it.

Attached Files



#6 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:02 PM

Posted 31 May 2011 - 01:03 PM

It listed a bunch of virus checking tools and next to each of them it said "Found nothing".

Ok as long as it tested clean that is fine.
It doesn't always mean that you were still infected if you get another infection.
They are rampant on the net and you can get it from anywhere.

Is there a way to reload the OS files and BIOS without rewriting the whole disk?

No rewriting the disk is a format.
This has to be done in order to remove anything on the drive itself.
The bios if you flash it to the latest version then that will reprogram it.
I do not suspect any bios infection.


All of your logs are clean.
Are there any remaining issues at the moment?
If not you are all set.
Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users