Possible Malware/Spyware - http://vrzc.search-help.net

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by h2o467, Aug 19, 2012.

  1. h2o467

    h2o467 Private E-2

    Hi,

    I'm not sure if this is some sort of browser hijack or what. It only seems to occur when I type an errant URL in the browser address bar. When that happens the browser seems to redirect to a fake "Verizon" search page (Verizon is my ISP - FiOS). I wasn't able to find any useful information online - in forums or google search results. I'm hoping someone here can help me out. I've stepped through the "Run and Read Me" section; logs attached.

    http://vrzc.search-help.net/index.php?origURL=http://www.sdsfsfsf.com

    Thanks,
    John
     

    Attached Files:

  2. thisisu

    thisisu Malware Consultant

    Welcome to MajorGeeks, John

    [​IMG] From Programs and Features (via Control Panel), please uninstall the below:
    • Java(TM) 6 Update 27

    __

    [​IMG] Please download OTL by OldTimer.

    • Save it to your desktop.
    • Right mouse click on the OTL icon on your desktop and select Run as Administrator
    • Check the "Scan All Users" checkbox.
    • Check the "Standard Output".
    • Change the setting of "Drivers" and "Services" to "All"
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      activex
      netsvcs
      
    • Now click the [​IMG] button.
    • One report will be created:
      • OTL.txt <-- Will be opened
    • Attach OTL.txt to your next message. (How to attach)
     
  3. h2o467

    h2o467 Private E-2

    Thanks!

    My system has the following installed:

    Java(TM) 6 Update 27
    Java(TM) 6 Update 27 (64 bit)

    Do you want me to uninstall both?
     
  4. thisisu

    thisisu Malware Consultant

    Yes.
     
  5. h2o467

    h2o467 Private E-2

    Log attached.
     

    Attached Files:

    • OTL.Txt
      File size:
      283.5 KB
      Views:
      3
  6. h2o467

    h2o467 Private E-2

    Extras.txt attached.
     

    Attached Files:

  7. thisisu

    thisisu Malware Consultant

    [​IMG] Fix items using OTL by OldTimer

    Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
    Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
    Copy the text in the code box below and paste it into the [​IMG] text-field.
    Code:
    [COLOR="DarkRed"]:otl[/COLOR]
    [2012/03/19 22:14:02 | 000,148,816 | ---- | M] () (No name found) -- C:\USERS\JODONNEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PZLR3FIS.DEFAULT\EXTENSIONS\AUTOFILLFORMS@BLUEIMP.NET.XPI
    O2:64bit: - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\SnagIt 8\DLLx64\SnagItBHO64.dll (TechSmith Corporation)
    O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItBHO.dll (TechSmith Corporation)
    O2 - BHO: (DCA BHO) - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files (x86)\Upromise\dca-bho.dll (Compete, Inc.)
    O2 - BHO: (Upromise TurboSaver) - {EDC0F17F-F4B7-47e4-B73E-887FAEB376FA} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKLM\..\Toolbar: (Upromise TurboSaver) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    O3 - HKLM\..\Toolbar: (SnagIt) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItIEAddin.dll (TechSmith Corporation)
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKU\S-1-5-21-1669735184-580064672-1571460556-1001\..\Toolbar\WebBrowser: (Upromise TurboSaver) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - C:\Program Files (x86)\Upromise\upromisetoolbar.dll (Upromise, Inc.)
    [2011/09/02 07:08:50 | 000,102,400 | ---- | C] () -- C:\Users\jodonnel\AppData\Local\ie_runner_app.exe
    [COLOR="DarkRed"]:commands[/COLOR]
    [clearallrestorepoints]
    [emptytemp]
    [resethosts]
    
    Now click the [​IMG] button.
    If the fix needed a reboot please do it.
    Click the OK button (upon reboot).
    When OTL is finished, Notepad will open. Close Notepad.
    A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    Attach this log to your next message. (How to attach)

    __

    Let me know if the problem persists after completing the above.
     
  8. h2o467

    h2o467 Private E-2

    Unfortunately the issue persists.
     

    Attached Files:

  9. thisisu

    thisisu Malware Consultant

    Open RogueKiller again,
    Press the Fix Hosts button.
    Attach that log when finished.
     
  10. h2o467

    h2o467 Private E-2

    Log attached.

    I placed this entry in the file to at least prevent my PC from connecting to the site:

    1.1.1.1 vrzc.search-help.net
     

    Attached Files:

  11. thisisu

    thisisu Malware Consultant

    I would leave the HOSTS file defaulted (don't customize it anymore).
    It does not appear that you are having any malware related issues.

    __

    If you are not having any other malware related problems, it is time to do our final steps:
    • Any programs we had you download and/or install can be removed at this time.
    • If we had you download and run ComboFix, here is how to uninstall it:
      • Press and hold the Windows key [​IMG] and then press the letter R on your keyboard.
      • This opens the Run dialog box.
      • Copy and paste the below text inside the text-field:
        • "%userprofile%\desktop\ComboFix" /uninstall
      • Now press ENTER
      • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
    • You can re-enable your Disk Emulation software at this time via DeFogger.
    • If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
    • Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
    • Now we will toggle System Restore to remove any infected system restore points.
    • Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
    • Be safe :)
     
    Last edited: Aug 20, 2012
  12. h2o467

    h2o467 Private E-2

    I agree. It doesn't seem to be malicious, however annoying. Thanks for your help!
     
  13. thisisu

    thisisu Malware Consultant

    No problem. Be safe :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds