Have a google redirect malware, affects all browsers, all scans come up negative

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by mijgilbert, Feb 25, 2011.

  1. mijgilbert

    mijgilbert Private E-2

    Hello,

    I have a google/search redirect malware infecting my computer (Windows 7 64-bit Laptop). Whenever I search via google, I get a good results page with the correct content. However when I click on one of the search result links, it redirects me to another set of pages that are likely hiding other malware or other programs, not to my intended page.

    I have scanned with Norton AV, Spybot and Malwarebyte's Anti-malware in normal mode and safe mode and everything comes up clean. This affects both IE and Firefox browsers.

    I have gone through all of the instructions on the "Google redirect malware" thread. I have done everything on the Read and Run First thread and now I'm on the Vista Malware Removal/Cleaning Process thread.

    I am currently running the SuperAntiSpyware app and will post the log.

    TIA,
    Mike
     
    mijgilbert, Feb 25, 2011
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    We can't help you until you attach the requested logs. In addition to the ones needed, please also do this:

    Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!


    Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

    • Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
      Vista/Windows 7 users right-click and select Run As Administrator.
    • If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123tdk.com).
    • Click the Start Scan button.
    • Do not use the computer during the scan
    • If the scan completes with nothing found, click Close to exit.
    • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    • Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    • A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_14.17.05_log.txt) will be created and saved to the root directory ( usually Local Disk C ).
    • Attach this log to your next message
     
    TimW, Feb 25, 2011
    #2
  3. mijgilbert

    mijgilbert Private E-2

    Here are the logs from the scans I have run so far.
     

    Attached Files:

    mijgilbert, Feb 25, 2011
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Still need the C:\MGLogs.zip.
     
    TimW, Feb 25, 2011
    #4
  5. mijgilbert

    mijgilbert Private E-2

    Here are the final logs
     

    Attached Files:

    mijgilbert, Feb 25, 2011
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing any malware. Let's see if we can fix FireFox first.

    We are going to be uninstalling your old version of FireFox and installing the new version. So do the below to save bookmarks:

    • Run FireFox and click Bookmarks.
    • Then select Organize Bootmarks.
    • Then on the next window click File and then select Export. Save the bookmarks.html file to your Desktop for later use in importing.

    Now download and save the installer for the current version of FireFox but DO NOT install it yet. Get it here: Mozilla FireFox

    You will need to exit FireFox now and use Internet Explorer to continue with the below until we reinstall FireFox.

    Start by uninstalling FireFox and then reboot. Do not skip the reboot.
    After reboot, delete the below folders:

    C:\Documents and Settings\UserAccount\Local Settings\Application Data\Mozilla
    C:\Program Files\Mozilla Firefox

    where UserAccount is the actual user account name being used.

    Now reinstall FireFox from the file previously downloaded.
    Import your bookmarks file. (similar process to exporting).


    Is FireFox working okay now?
     
    TimW, Feb 26, 2011
    #6
  7. mijgilbert

    mijgilbert Private E-2

    So this is wierd - it seems like one of those last two processes fixed the problem. I no longer have the redirect issue. I have tried in both Firefox and Internet Explorer and both have normal search, results and links. One of those must have done it but it's not clear which - wierd!

    So thank you very much for your help and i'll mark this "resolved" until or unless the problem pops up again. That "Read and Run First" is exhaustive but it obviously worked.

    Thank you!!
     
    mijgilbert, Feb 26, 2011
    #7
  8. mijgilbert

    mijgilbert Private E-2

    Well after using the computer for another day, the redirect virus seems to be fixed, but there are some issues with the way the computer is working.

    1) The laptop won't hibernate. It won't do it either when I close the lid or when I press the power button. Something has obviously been changed and I went back through the power settings and they are right, but the computer just won't hibernate. Something is stopping it.

    2) I can't see anything in FLASH. I have gone to Adobe and downloaded and installed the newest flash version, but it still doesn't work. There must be some setting that is preventing me from using flash.

    Is there any equivalent to the "Read and Run First" post that shows what you're supposed to do after the malware is gone to re-enable the things that were disabled during the cleaning process?
     
    mijgilbert, Feb 27, 2011
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The two issues you mentioned need to be addressed in the software forum.

    As to the cleanup, please do the following:

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0

    Help Support MajorGeeks
    Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

    Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

    MajorGeeks on FaceBook
     
    TimW, Feb 27, 2011
    #9
  10. mijgilbert

    mijgilbert Private E-2

    Hi,

    I have to say "thank you" but also point out some feedback and what a portion of the "clean up" procedure has done to my computer. The advice to "flush the restore points" has caused me apparently to be unable to repair certain damage to my system that was done by some of the cleaning procedures.

    I posted a thread here (http://forums.majorgeeks.com/showthread.php?t=233694) about a problem that I'm having with my laptop now that the Malware is gone. However, it appears from talking with Dell support last night for several hours that the issue is likely with the installation of Windows 7 and we need to repair it or reinstall it. Repairing it is now basically impossible since we flushed the restore points, so now my only choice to fix the issue appears to be to reinstall windows, which I can not do because I won't be able to reinstall all of my licensed software. I could create another partition and run the computer off a new install of Windows 7 but that also has its issues and takes up >16GB of disk space.

    Any thoughts on how I can deal with this or whether the "flush restore points" is really a good idea? I'm disappointed with myself that I didn't question this one before doing it...

    -Mike
     
    mijgilbert, Mar 4, 2011
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    TimW, Mar 4, 2011
    #11

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds