Google Chrome Won't Load, Google Search re-directing....

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by geoffclark, May 6, 2010.

  1. geoffclark

    geoffclark Private E-2

    Hi, I had some malware on my PC a couple of days ago. I believed I successfully removed it, however I'm getting reccuring issues.

    -Google Chrome won't load any HTML files. From the web or locally saved.
    -In IE and Firefox, Google Searches will redirect to ads/other sites.
    -I'm getting sporatic pop-ups.

    I've run many antispyware software software and it's all coming up clean :-/ I'm stuck.

    Anyone want to give a hand?
     
  2. geoffclark

    geoffclark Private E-2

    Some logs attached....

    Root Repair won't run (giving a driver error?)
    and Combo Fix ended with a virtural memory dump after a restart :-/
    MGTools.exe is coming up as a trojan from AVG.
     

    Attached Files:

    Last edited: May 6, 2010
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Did you read the below quoted from the Using MGtools link
    You need to ignore AVG and shut it down. Then run MGtools as requested and attach the log.

    If AVG was running, it may also be the reason for your problem with ComboFix.
     
  4. geoffclark

    geoffclark Private E-2

    ok, thanks. I was relictant to disable AVG becaust I didn't want this thing to start spreading like wildfire again.

    Attached is the MG log. Thanks in advance for helping!
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please see step 6 of the READ & RUN ME and disable your Daemon Tools disk emulation software as requested. Do this before continuing!

    Now delete the below copy of MGtools.exe since it does not belong here:
    C:\Users\Chris\Downloads\MGtools.exe

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O4 - HKLM\..\Run: [combofix] "C:\ComboFix\CF4548.cfxxe" /c "C:\ComboFix\C.bat"
    O4 - HKLM\..\RunOnce: [Cleanup] C:\cleanup.exe
    O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
    O4 - HKCU\..\Run: [HKCU] C:\Windows\install\javaupdate.exe
    O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Windows\install\javaupdate.exe
    O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Windows\install\javaupdate.exe
    O23 - Service: PEVSystemStart - Unknown owner - C:\ComboFix\PEV.cfxxe

    After clicking Fix, exit HJT.

    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save programs here and defintely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here like you are doing.

    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\USERS\CHRIS\LOCALS~1\TEMP
    C:\Windows\Temp

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  6. geoffclark

    geoffclark Private E-2

    Thanks, but unfortunately this didn't fix the problem :-/

    Google Chrome still won't load. Google searches still redirect.

    Any more assistance is appreciated. Thanks for your help.
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes I know. We did not fix it yet. We had to fix other things first and needed to get you to run Defogger first too as originally requested in the READ & RUN ME. Locating an infected driver is now what we will be doing next. Locating it will also not fix it. It is just the first step to eventually fixing it.

    You need to shutdown AVG while doing the below or else it may just get in the way.

    Now please run this Finding TDL with RootRepeal and attach the log from this version of RootRepeal if it runs.

    Now run this GMER - running with a random name and attach the log from GMER if it runs.



    Now go to TDSSKiller and Download TDSSKiller.zip to your Desktop
    • Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
    • Click Start > Run and copy/paste the following bold command into Run box and hit Enter.
    "%userprofile%\Desktop\TDSSKiller.exe" -v
    • Follow the instructions to type in "delete" when it asks you what to do when if finds something.
    • When done, a log file should be created on your C: drive named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the logs from RootRepeal and GMER if they ran
    • C:\avenger.txt
    • C:\MGlogs.zip
     
  8. geoffclark

    geoffclark Private E-2

    Ok, the requested info's attached. Thanks again for the help!

    I'm replying again to attach the MGTools log, hope this doesn't count as a bump ;) don't want to be pushed to the bottom of the list :p
     

    Attached Files:

  9. geoffclark

    geoffclark Private E-2

    MGLog attched, see the previous reply for the rest of the attached logs :cool
     

    Attached Files:

  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Once you complete step 6 of the READ & RUN ME as requested multiple times we will be able to continue. After you disable Daemon Tools you will have to repeat my last fix ( you can skip the Avneger part of the fix) and attach all new logs from GMER, RootRepeal and MGtools.
     
  11. geoffclark

    geoffclark Private E-2

    Ok, I was under the impression that Daemon Tools was disabled. It certainly wasn't running in the task manager.

    Regardless, it's un-installed now. So hopefully that should clear up any conflicts.

    Logs are attached. Thank you for your time.
     

    Attached Files:

  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Not according to your logs. The drivers are still loading and the folders are still there. Please do as requested multiple times and run Defogger as requested in step 6 of the READ & RUN ME.


    Now please delete the C:\ComboFix folder.
    Now also delete your current copy of ComboFix.exe from your Desktop.

    Now shut down all protection software and download the current version of ComboFix from here combofix.exe and save it to your Desktop.


    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  13. geoffclark

    geoffclark Private E-2

    Fogger ran.

    Unfortunately the problem still persists.

    Logs attached. Thanks.
     

    Attached Files:

  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Do you have your Windows 7 boot DVD that could be used to boot to the System Recovery Options? The below procedure requires you to be able to boot to this Recovery Environment. You may even be able to access the recovery console from the F8 boot options when you start your PC.

    Please read ALL of the below and print it to refer to while trying to follow the instructions while offline. Make sure you understand all of it and ask any questions you have before starting.
    • Please download maxlook and save it to your Desktop.
    • Right click maxlook.exe and select Run As Administrator to run it.
      • Note - you must run it only once!
    • As instructed when the tool runs, restart the computer and logon to the System Recovery Environment.
      • Select Command Prompt like you did the previous time
      • Once you get to the System Recovery Options screen, we will have to change directories and drive to the E drive which you have now determined to be your operating system drive. The instructions are below.
    • Type the following bolded command at the x:\sources> prompt (or x:\windows\system32>) then hit Enter.
      • cd /d x:\windows <--- the red x represents your operating system drive letter, as shown in the image below which happens to show drive C rather than x. So where you see C: in the below, you should have your actual Windows drive which may also be C. Also note that this picture shows Vista but you will have Windows 7. NOTE: there is a space ater the cd and before the c:
    [​IMG]
    • At the x:\Windows> prompt type the following look.bat command then hit Enter (You can see how it looks in the above image).
      • look.bat
    • You will see many files copied then return to the x:\windows> prompt.
    • Type Exit then restart your computer and logon in normal mode.
    • Please click Start > Run and type
      • maxlook -sig
    • Then hit enter. A logfile will open, please attach this logfile.
     
  15. geoffclark

    geoffclark Private E-2

    Log attached.

    FYI I've been getting an increasing number of virtual memory dumps since I've become infected. I feel like I've gotten more after running combofix, but I'm not positive that that had any effect on it.

    My gut tells me that something, an infected driver perhaps that manipulated the svchost.exe on my computer. Before I disabled AVG I was getting messages associated with that.

    Any help is appreciated. Thanks,
     

    Attached Files:

  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay Maxlook helped us locate the problem file. Let's try the easy way to fix it first. If this does not work, we will have to manually replace the file from the System Recovery console.



    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  17. geoffclark

    geoffclark Private E-2

    Thanks, logs attached, the problem persists......
     

    Attached Files:

  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Sorry about that! I gave you the wrong filename path in the fix. Let's try the easy method again with correct file name.

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  19. geoffclark

    geoffclark Private E-2

    Thanks, logs attached, the problem persists......
     

    Attached Files:

  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It appears that ComboFix is not even attempting to repair the file. We will use the System Recovery Console, but first, do the below.

    In a normal Windows boot environment ( that is, NOT from the System Recovery Console), use Windows Explorer to copy the C:\WINDOWS\system32\drivers\disk.sys and put the copy into the C:\windows folder so that you have c:\windows\disk.sys

    Make sure that the file does appear in the Windows folder before continuing on with the below.



    Okay then boot back to that System Recovery, Command Prompt line and at the command prompt, enter the below series of commands that are in bold black each followed by the enter key. The purple and brown text is just informational.

    cd drivers
    • Note the space after the cd. The prompt should change to e:/windows/system32\drivers>
    • If it does not change to this prompt, you must not continue. Just come back and tell me what happened.
    ren disk.sys disk.sys.old
    • Note the space before each disk.sys
    copy C:\windows\disk.sys disk.sys
    • The above should make a copy of the file you copied into your Windows folder while normal Windows was running and put it into the drivers folder. You should see a message about 1 file being copied
    dir disk.sys
    • Make sure you get a file listing showing the disk.sys file. If you do not, that means something above did not work. You must not shutdown or reboot until you get this file copied because your PC may not boot up if this file is missing. If it becomes necessary to get the file back, just use ren disk.sys.old disk.sys to rename back the original copy.
    After you get the file copied, reboot your PC normally and run TDSSkiller one more time.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  21. geoffclark

    geoffclark Private E-2

    This is confusing to me, you want me to copy the disk.sys file from the system32/drivers directory to the c:/windows directory, then make sure it's not in the windows directory i just copied it too? Also should I leave it in the system32drivers directory too? please elaborate on this thanks,
     
  22. geoffclark

    geoffclark Private E-2

    Disregard the previous message, I got it figured out. Please see the attached logs.

    Unfortunately all the problems still persist. :(
     

    Attached Files:

  23. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Chaslang will be gone for a few days, so let me suggest the following.

    First, you shouldnt have Utorrent running at start up.

    You need to run CCLeaner and then make sure this folder is clean:
    C:\Windows\temp\

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::
    
    TDL::
    C:\Windows\system32\drivers\nvstor.sys
    
    Registry::
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "uTorrent"=-
    
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the previous file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    [​IMG]
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  24. geoffclark

    geoffclark Private E-2

    Thank you, unfortunately the problem still persists :-/
     

    Attached Files:

  25. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not sure the ComboFix script worked properly. Please do this again:

    * Click Start > Run and copy/paste the following bold command into Run box and hit Enter.

    "%userprofile%\Desktop\TDSSKiller.exe" -v

    * Follow the instructions to type in "delete" when it asks you what to do when if finds something.
    * When done, a log file should be created on your C: drive named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply.
     
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Actually, since a new version of TDSSkiller has come out while I was on vacation, it would be a good idea to use the new version by downloading again.



    Go to TDSSKiller and Download TDSSKiller.zip to your Desktop
    • Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
    • Click Start > Run and copy/paste the following bold command into Run box and hit Enter.
    "%userprofile%\Desktop\TDSSKiller.exe" -v
    • Follow the instructions to type in "delete" when it asks you what to do when if finds something.
    • When done, a log file should be created on your C: drive named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds