PLEASE HELP WITH BROWSER HIJACKER!! Using HijackThis

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by tommyboy_to, Aug 22, 2009.

  1. tommyboy_to

    tommyboy_to Private E-2

    Hi there,

    I really need some help cleaning my computer. I have what I believe is a browser hijacker. The easiest and most common example I have is when I'm doing an online search. When on google or yahoo, and I have my search results, if I right click and "open in a new tab", the page comes up blank then says "internet explorer cannot display the web page". What it does show in the address bar is: http://cliccker.cn/ followed by about 100 characters. I went on a site that recomended using Hijackthis and then panicked when I had no idea which of the results was the culprit. So I'm listing the results in this forum and hopefully someone in the know can decipher what's going on.

    FYI...I have used both AVG antivirus and Spybot Search & Destroy to scan and it has found nothing.

    I really appreciate any help you can offer.

    Thanks,

    Tommy

    I also have attached the following logfile in the original text format in case it may be easier for you to view.
     

    Attached Files:

    Last edited by a moderator: Aug 25, 2009
    tommyboy_to, Aug 22, 2009
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Major Geeks!

    Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.

    • If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First. If TDSSserv is not found, just continue on with the READ & RUN ME.
    READ & RUN ME FIRST. Malware Removal Guide

    • If something does not run, write down the info to explain to us later but keep on going.
    • Do not assume that because one step does not work that they all will not.
    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:

    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
    ​
     
    TimW, Aug 25, 2009
    #2
  3. tommyboy_to

    tommyboy_to Private E-2

    Please help! Somethings up with my computer.

    Hi there. I have been having some serious issues with my computer. I wish I had come to you guys first! It probably would have saved me hours of time and heartache. But, I'm here now, begging for help. The following may be a bit long and tedious, but I want to let you know exactly what's been going on. And yes, I HAVE FOLLOWED THE READ ME FIRST POST!!!




    This all started about 2 weeks ago. I had what I believe is a browser hijacker. The easiest and most common example I have is when I'm doing an online search. When on google or yahoo, and I have my search results, if I right click and "open in a new tab", the page comes up blank then says "internet explorer cannot display the web page". What it does show in the address bar is: http://cliccker.cn/ followed by about 100 characters.

    Since that time, I have ran almost every scan I can get my hands on: spybot, ad-aware, avg, malawarebytes, trojan remover, Kapernsky (i think it was called), and a couple more I'm sure I'm forgetting. Each scan either found nothing, or in most cases would crash when scanning my windows/system32/config folder. As for my AVG, the resident shield kept finding a trojan, but would not delete it. It finally had over 1000 cases in it's log and I gave up as I was constantly receiving popups asking me to delete it and then telling me it couldn't. A friend suggested I try Bitdefender. I seem to be having the best results with this, although it has not solved the issue. As opposed to the constant popup AVG was giving me, now I only get it about 2-3 times an hour. This has helped me move along more quickly as I began to backup important files from my computer as my helplessness seemed to lead me to the path of "format and start over".

    By the way, Bitdefender keeps telling me it has found Trojan.TDss.WQ It's found it about 60 times in 3 days but wont delete it.




    MBAM seemed to have been the only scanner that would give me anything. ** I should mention, the scan kept freezing on system32/config. I had to reboot my computer as MBAM would not shut down (even trying to end the process). I reran the scan a 2nd and 3rd time and had to abort it after it found the infection, but before it scanned the config file. The next 3 days, seperate scans said this:

    Files Infected:
    c:\Windows\System32\kbiwkmmbtpbnys.dll (Rootkit.TDSS) -> Delete on reboot.

    The next day, MBAM gave me this:

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\net (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.

    Lastly, it said:

    Files Infected:
    C:\Windows\System32\kbiwkmupvukwbh.dll (Rootkit.TDSS) -> Delete on reboot.




    This time, when I rebooted my computer, I got the following message before the startup screen:

    LogonUI.exe - Bad Image
    globalroot/systemroot/system32/kbiwkmupvukwbh.dll is either not designed to run on windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.

    So, my login screen comes up. I log in and get this:

    AtBroker.exe - Bad Image
    blah, blah, blah (same as above)

    then,

    Userinit.exe - Bad Image
    blah, blah

    then,

    dwm.exe - Bad Image
    blah

    then,

    explorer.exe - Bad Image
    bla

    etc, etc, etc.......

    I actually wrote down 23 of these error msgs before realizing how much of a fool I was being.

    I searched online, the error msg I was receiving. Using the command prompt in safe mode, I deleted the .dll file that was corupt. I no longer got the error msg.





    I re-ran MBAM. The scan did not hang in the system32/config folder as previous. This time I got these results:

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbiwkmwptswrem (Rootkit.TDSS) -> Quarantined and deleted successfully.

    Files Infected:
    C:\Windows\System32\kbiwkmmbtpbnys.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Windows\System32\kbiwkmbphcttaf.dat (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Windows\System32\kbiwkmvbmucxxq.dat (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Windows\System32\drivers\kbiwkmnrpoprsc.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.





    So, I finally thought I kicked it, as MBAM successfully got rid of these files. But I keep having issues and I still can't seem to kick. So, I went through your READ ME FIRST post, and done nothing other than follow your steps, and am now providing the logs for review. The only problem I'm having is that Rootrepeal will not complete it's scan. It seems to lag at c:\windows\winsxs\manifests and then shuts down. I've scanned twice and the scan doesn't seem to want to complete. However, I am providing the other 4 logs to you.

    I really appreciate your help!
     

    Attached Files:

    tommyboy_to, Sep 8, 2009
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It appears as though the scans have taken care of the malware. We just have a few things to clean up.

    You have an infected autochk file. First we need to see if it is truly corrupted. So do this:
    Go to start / programs / accesories / then right click command prompt and chose run as administrator.
    Then type in this:
    sfc /VERIFYFILE=c:\windows\system32\autochk.exe
    If it reports it as corrupt, try typing:
    sfc /scannow.
    To close the command prompt, simply type exit.
    Let me know what happens.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now use add/remove programs to uninstall:
    J2SE Runtime Environment 5.0 Update 12

    Now re-run ComboFix.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip
     
    TimW, Sep 13, 2009
    #4

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds