v9.com browser redirect

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by TurChunkin, Sep 12, 2012.

  1. TurChunkin

    TurChunkin Private E-2

    Hey all, first of all a big thank you to anyone who runs or helps run this place, you guys are the f'ing best. For real.

    Now to get to it, I've been running the RTM version of windows 8 that was released mid August without issues, and a couple days ago my home page started getting redirected to v9.com.

    I just recently upgraded to an SSD, so I thought a simple reformat would be the easiest fix for me. No deal, it persists. Malwarebytes, MSE (windows defender in win8), CCCleaner, RogueKiller, FixTDSS, and MBR Check all come up with nothing and won't clear out this crap. I know it is creating some kind of hidden partition, but I'm not sure how to remove it.

    HitManPro detects 3 suspicious files, one called services.exe in system 32, but when I select the quarantine option and click next, it gets switched back to ignore and doesn't seem to work or do anything. History in HMP stays clear and another scan will detect the same file. Here is the HMP log.

    Thanks for any help with this. Here are my logs.
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You still need to attach the log from running MGTools.exe --- C:\MGLogs.zip
     
  3. TurChunkin

    TurChunkin Private E-2

    Hi, sorry I forgot to mention MGTools won't run in win8... :(
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please do the below so we can attempt to fix this.


    Now please click Start, and type cmd into the search box.
    • You should see a cmd.exe and icon appear in the Programs area of the Start Menu.
    • Right click on cmd.exe and select Run As Administrator
    Now in the Command Prompt window that opens, type in ver and hit enter. Tell me exactly what you get for output.
     
  5. TurChunkin

    TurChunkin Private E-2

    Hi. It says "Microsoft Windows [Version 6.2.9200]
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Thanks! Okay then try the below.

    Download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista or Win7 or Win 8, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )



    Now attach the below log:
    • C:\MGlogs.zip
     
  7. TurChunkin

    TurChunkin Private E-2

    Ok. Cool. I think it worked.
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Not really. The log is extremely incomplete as only the very first scan ran.

    Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.
    • Right click the Command Prompt entry and select Run As Administrator.
      • It is critical that you run it this way.
    • If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
    • Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple/brown is merely informational.
    cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
    SN64 <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
    nwktst <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
    GRK64 <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
    getnetinf<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
    Now look for the C:\MGlogs.zip file and attach it no matter what happened while doing the above.
     
  9. TurChunkin

    TurChunkin Private E-2

    Damn. Every command give me a "Your OS version is Unsupported by [command]" error. Here's the log again for what it's worth. I hope I'm not being too much trouble, never encountered something that can survive a reformat like this :(
     
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No not a problem. Actually we need your help here a little too to debug all the tools to get them working with Win 8. ;)

    Did you run TDSSkiller per the READ & RUN ME and did it run? If so attach the log.

    I will make another update later tonight to try getting MGtools to work but in the meantime, please do the below:


    Please download OTL by OldTimer.
    • Save it to your desktop.
    • Right mouse click on the OTL icon on your desktop and select Run as Administrator
    • Check the "Scan All Users" checkbox.
    • Check the "Standard Output".
    • Change the setting of "Drivers" and "Services" to "All"
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
    Code:
    activex
    netsvcs
    • Now click the [​IMG] button.
    • One report will be created:
      • OTL.txt <-- Will be opened
    • Attach OTL.txt to your next message. (How to attach)
     
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You forgot to attach it. I would have expected at least GRK64.bat to run . However please try another newer version of MGtools.

    Download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista or Win7 or Win 8, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


    Now attach the below log:
    • C:\MGlogs.zip
    If it does not appear to run properly, please run the same debug steps as in message # 8 again.
     
    Last edited: Sep 13, 2012
  12. TurChunkin

    TurChunkin Private E-2

    Hey guys, sorry for the long delay, I was literally waiting for a plane to Costa Rica when all of this BS started, and right now I am in the jungles of Panama on a surprisingly decent Wi-Fi card. Anyways, inexplicably when I finally fired up my laptop again today my browser didn't get redirected. Anyways, you were right about the newer version working, so here is the log, although I'm not sure if I need it anymore, since as far as I can tell one of the plethora of malware removal softwares I installed took care of my problem. Either way, thank you guys so much once again, and you will for sure get mentioned in my travel blog :D
     

    Attached Files:

  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    That's good because all of your logs are clean. Hitman was actually incorrect. It just does not yet recognize the Windows 8 version of services.exe.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds