Malware causing redirects, aggressively resists cleaning

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Gwyon, Jun 28, 2009.

  1. Gwyon

    Gwyon Private E-2

    I first noticed the infection while browsing the internet, when my browser became increasingly sluggish and I noticed that my memory usage was sky-high. I looked in Task Manager, found that Acrord32.exe was the cause of the huge bloat. I killed it, closed the browser, ran Malwarebytes. Malwarebytes found nothing, but upon reopening the browser, I found myself being redirected to random ad/search sites when clicking links found on Google. I attempted to resolve the problem myself by booting into safe mode and running Combofix, but no such luck- Combofix gets to stage 50 of it's scan and reports 'Not enough main memory to complete the sort', then completes as normal but without taking any action.

    So, now I've run through READ & RUN ME FIRST, and the Windows XP malware removal guide. Some hidden system files have been found, but nothing removed during any of the scans.

    PROBLEM DETAILS:
    I'm using Firefox and only experiencing redirects when clicking on links from a Google search page. I haven't had any redirects when going to an address directly. The redirect almost never happens when I click a link I've visited before, only when trying to load a completely new page. The redirects happen when clicking links to reputable sites (such as this one) and others that I've visited many times with no problems before this, so I'm quite sure it's caused by malware on my end and not the links themselves. The pages I'm redirected to appear to be all bogus search engines and the like. The only other effects of this malware that I can see are significantly higher memory usage than normal, even after a fresh reboot (although to my untrained eye, I can't find any single process in Task Manager that's using more memory than it should); and my cd/dvd drive is now showing up twice, as both D: and E:. Putting a disc in the physical drive causes it to show up in both D: and E:, and there's only one physical drive shown in the hardware manager.

    Logs are included, I hope I haven't mussed anything up by trying to deal with it myself first. I've never run into anything before that MBAM (or Combofix in the worst case) couldn't handle!

    SCAN NOTES:
    Combofix showed the same 'Not enough memory to complete the sort' as it did the first time I ran it as noted above. This happened three times: once right after starting the program, before it even said 'Combofix is preparing to run'; once after reaching stage 50 of the scan; and once in the middle of preparing the log, although the program closed and the log popped up as normal.

    RootRepeal found the same set of hidden files with nonsense names that are noted in the combofix log, but crashed the instant it had found them all without producing a report, so I've included the crash report instead.
     

    Attached Files:

    Gwyon, Jun 28, 2009
    #1
  2. Gwyon

    Gwyon Private E-2

    MGTools log included. I also noticed that 'Not enough main memory to complete the sort' message during it's scan, although it went by too fast to tell you what else the scan was doing when it happened.
     

    Attached Files:

    Gwyon, Jun 28, 2009
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Do you know what the below is for?
    O4 - HKCU\..\Run: [nHancer] "C:\Program Files\nHancer\nHancer.exe" /tray



    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jun 29, 2009
    #3
  4. Gwyon

    Gwyon Private E-2

    nHancer is a freeware utility for nVidia graphics cards, used to optimize or force various rendering options. It's clean as far as I know, and the last time I updated it was at least a couple of months ago anyway.

    After following your instructions, I went to about 3-4 pages worth of google search links, and didn't get redirected on any of them. The only problem left that I know of is my disc drive still displaying twice. Of course, I have no idea if that's even related to the malware, all I know is that it happened immediately after my PC got infected.

    I completely forgot to disable AVG's on-access scan before running Avenger and MGTools. Just thought you might want to know in case that could've affected the scans.

    Also, since the time of my first post, I turned my DEP setting from 'Turn on DEP for essential Windows programs and services only' to 'Turn on DEP for all programs and services except those I select', at the advice of an acquaintance. Again, I only thought of this after running the programs you specified, is this something that could interfere with the tools being used?

    Thanks for the help!
     

    Attached Files:

    Gwyon, Jun 30, 2009
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    I suggest posting about this in the Software Forum.

    Not a problem.

    Your logs are clean.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Jul 2, 2009
    #5
  6. Gwyon

    Gwyon Private E-2

    I noticed the same redirect behavior continuing on the following day after my post. I shut my computer down at night, so whatever this is was probably still there and just reconstructed itself after reboot.

    Also, all those files that Avenger reported it was unable to delete because it couldn't find them? I didn't delete those through other means or anything. I had run scans with Spybot S&D and GMER while I was waiting, but neither of them even found anything. Other than that, I haven't taken any action with anti-malware tools since my first post in this thread except what you specified, so I dunno how those files would've just disappeared.

    Really worries me why something so relatively benign would be so hard to remove.
     
    Gwyon, Jul 2, 2009
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Some of the files listed in my fix may not have existed which is why they were not found. Some were in my fix just incase they did exist.

    Shutdown ALL protection software before doing the below.

    Please run RootRepeal again but before running the scan, click the Settings menu selection at the top and then select Options. Then click the General tab. Now the are under the Disk Access Level, slide the slide bar all the way to the bottom so that the text to the right of the slider shows High Level

    Then run a scan and attach the new log. Hopefully it runs this time.

    Now also download the current version of combofix.exeto your Desktop and run it by double clicking on it. Attach the new combofix.txt log.
     
    chaslang, Jul 4, 2009
    #7
  8. Gwyon

    Gwyon Private E-2

    Ah, I wondered if it was something like this, but I thought it worth mentioning just in case.

    RootRepeal ran successfully this time, as did Combofix. The issue I mentioned with two disk drives showing was no longer happening after running combofix. I had also been having issues with Windows explorer tooltips and windows sometimes leaving artifacts that wouldn't disappear until something forced a redraw on that part of the screen, as well as an issue with Speedfan not being able to detect my hard drive in it's SMART diagnostic feature. These issues all appear to be fixed after running combofix. I guess this malware was messing up a lot of other drivers.

    Google search links have not been redirected so far, even after another reboot. I'll post again if the redirect bahavior starts up again, but hopefully I'm clean now.
     

    Attached Files:

    Gwyon, Jul 4, 2009
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay let's just be safe and do the below since a couple other file could still be around.

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

    Now attach the below log:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jul 5, 2009
    #9
  10. Gwyon

    Gwyon Private E-2

    I copied the script as you described, Combofix updated itself and then ran with no problems that I could see. No problems with MGtools either.

    So far I've seen no sign of further infection, no browser redirects, no odd behavior. I hope the logs are clean! And thanks again for the help.
     

    Attached Files:

    Gwyon, Jul 7, 2009
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Your logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Jul 10, 2009
    #11

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds