Google Chrome Redirect virus infection - have logs and programs ready to go

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by jis3, Aug 12, 2011.

  1. jis3

    jis3 Private E-2

    I have tried and tried so unsuccessfully to remove this redirect virus in google chrome. Followed ALL the steps, have the logs, have the necessary downloads. PLEASE HELP ME! :) Looking forward to working with you.

    James

    ::logs attached
     

    Attached Files:

  2. jis3

    jis3 Private E-2

    Sorry did not attach the mbam log, combo fix log, super antispyware log and mglogs.zip

    They are attached :)

    Got this redirect virus a week ago, 7/30-7/31. I go to google.com and enter search, results display, click link, but am redirected to a different site that is advertising.

    Thanks and sorry for the missing logs~!
     

    Attached Files:

  3. thisisu

    thisisu Malware Consultant

    Hi and welcome to Major Geeks!

    Do you have your Windows 7 DVD and your data backed up? We will need to make use of the Windows 7 DVD to fix your infected Master Boot Record (MBR).

    You were supposed to do a Complete Scan with SUPERAntiSpyware. Please do this now and then attach the new SAS log.
    Also, please attach MGlogs.zip
     
  4. jis3

    jis3 Private E-2

    Thanks for the fast reply. Ok, I re ran super spy complete scan (nothing found) and attached the log with mglogs.zip.

    Have the W7 DVD.

    Are we going to have to wipe my hard drive? I ask because I installed W7 from vista onto a new 80gb SSD, then replaced processors in the process damaging some of the heads, so had to get a new MOBO. As the vista license was OEM with my Dell, I am afraid to reboot vista on the old drive since then. It also used up my second license of W7 when I switched mobo's which is neither here nor there but I will fix that by calling microsoft if I ever need to install it on another computer, don't foresee that at the moment. Just would rather not boot up Vista and have it say, this is unregistered or whatever because of the mobo switch and it being OEM license.

    Let me know how to proceed :)
     

    Attached Files:

  5. thisisu

    thisisu Malware Consultant

    No! I am suspecting an MBR infection on your external 500GB Hard Drive. Let's do this first. You can leave the 500GB Hard Drive plugged in for this.
    Also, please tell me if you still have a 37GB physical hard drive (will be advertised at 40GB) plugged into the laptop. One of the logs show it being it there, and another does not.

    From Programs and Features (via Control Panel), please uninstall the following:
    • Java(TM) 6 Update 26

    Now we need to make use of ComboFix by sUBs
    • Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
      • If it is not on your desktop, the below will not work.
    • Shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • Open Notepad and copy/paste the text in the below quote box into Notepad:
    • Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
    • At this point, you must exit all browsers now before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
    • Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
      [​IMG]
    • This shall launch ComboFix.
      Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    • Allow ComboFix to update itself if prompted.
    • When it finishes, a log will be produced at C:\ComboFix.txt
      Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
    • Attach this log to your next message. (How to attach items to your post)

    Now download and install JRE 7
    See the download links under this icon [​IMG]

    Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
    Then attach C:\MGlogs.zip to your next message.(How to attach items to your post)
    Notes:
    • This will automatically update all the logs inside MGlogs.zip
    • Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

    *** Let me know how the PC is running after you have completed these steps! ***
     
  6. jis3

    jis3 Private E-2

    Totally awesome! I believe we are out of the woods. Google Chrome does not appear to be redirecting!!

    Re: Last post
    I disconnected the 40gb drive and it is not currently connected, was using it on my macbook. I will not reconnect it if you believe there is a problem there.

    Also, I installed JRE-7 after I ran getlogs.bat? is that wrong? should i run again?

    Going forward, I will re-enable McAfee, I have AdAware, but what programs do you recommend that I have up and running to prevent this from happening again??

    Attached find the requested logs.

    Fingers crossed, I believe you have done it!!!! THANK YOU SO MUCH!@#!@
    :)

    MAJOR GEEKS RULES!@
     

    Attached Files:

  7. thisisu

    thisisu Malware Consultant

    Nothing is 100%, but I would recommend ESET Nod32, SpywareBlaster, FireFox with NoScript and AdBlockPlus plugins and safe surfing habits :)

    You're welcome ;)

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis if it present
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds