MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 08-11-11, 23:37
jis3 jis3 is offline
Private E-2
 
Join Date: Aug 2011
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
Angry Google Chrome Redirect virus infection - have logs and programs ready to go

I have tried and tried so unsuccessfully to remove this redirect virus in google chrome. Followed ALL the steps, have the logs, have the necessary downloads. PLEASE HELP ME! Looking forward to working with you.

James

::logs attached
Attached Files
File Type: txt TDSSKiller.2.5.15.0_11.08.2011_23.16.35_log.txt (67.5 KB, 4 views)
File Type: txt MBRCheck_08.11.11_23.15.40.txt (14.9 KB, 5 views)
File Type: txt GooredFix.txt (1.1 KB, 2 views)
Reply With Quote
Sponsored links
  #2  
Old 08-12-11, 00:38
jis3 jis3 is offline
Private E-2
 
Join Date: Aug 2011
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Google Chrome Redirect virus infection - have logs and programs ready to go

Sorry did not attach the mbam log, combo fix log, super antispyware log and mglogs.zip

They are attached

Got this redirect virus a week ago, 7/30-7/31. I go to google.com and enter search, results display, click link, but am redirected to a different site that is advertising.

Thanks and sorry for the missing logs~!
Attached Files
File Type: log SUPERAntiSpyware Scan Log - 08-12-2011 - 00-10-16.log (580 Bytes, 5 views)
File Type: txt combofixlog.txt (19.7 KB, 3 views)
File Type: txt mbam-log-2011-08-12 (00-12-59).txt (889 Bytes, 2 views)
File Type: txt ComboFix.txt (19.7 KB, 2 views)
Reply With Quote
  #3  
Old 08-12-11, 00:40
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
 
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,175
Thanks: 270
Thanked 1,437 Times in 1,356 Posts
Default Re: Google Chrome Redirect virus infection - have logs and programs ready to go

Hi and welcome to Major Geeks!

Do you have your Windows 7 DVD and your data backed up? We will need to make use of the Windows 7 DVD to fix your infected Master Boot Record (MBR).

You were supposed to do a Complete Scan with SUPERAntiSpyware. Please do this now and then attach the new SAS log.
Also, please attach MGlogs.zip
Reply With Quote
  #4  
Old 08-12-11, 22:21
jis3 jis3 is offline
Private E-2
 
Join Date: Aug 2011
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Google Chrome Redirect virus infection - have logs and programs ready to go

Thanks for the fast reply. Ok, I re ran super spy complete scan (nothing found) and attached the log with mglogs.zip.

Have the W7 DVD.

Are we going to have to wipe my hard drive? I ask because I installed W7 from vista onto a new 80gb SSD, then replaced processors in the process damaging some of the heads, so had to get a new MOBO. As the vista license was OEM with my Dell, I am afraid to reboot vista on the old drive since then. It also used up my second license of W7 when I switched mobo's which is neither here nor there but I will fix that by calling microsoft if I ever need to install it on another computer, don't foresee that at the moment. Just would rather not boot up Vista and have it say, this is unregistered or whatever because of the mobo switch and it being OEM license.

Let me know how to proceed
Attached Files
File Type: zip MGlogs.zip (232.4 KB, 6 views)
File Type: log SUPERAntiSpyware Scan Log - 08-12-2011 - 21-55-05.log (584 Bytes, 1 views)
Reply With Quote
  #5  
Old 08-13-11, 17:29
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
 
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,175
Thanks: 270
Thanked 1,437 Times in 1,356 Posts
Default Re: Google Chrome Redirect virus infection - have logs and programs ready to go

Quote:
Are we going to have to wipe my hard drive?
No! I am suspecting an MBR infection on your external 500GB Hard Drive. Let's do this first. You can leave the 500GB Hard Drive plugged in for this.
Also, please tell me if you still have a 37GB physical hard drive (will be advertised at 40GB) plugged into the laptop. One of the logs show it being it there, and another does not.

From Programs and Features (via Control Panel), please uninstall the following:
  • Java(TM) 6 Update 26

Now we need to make use of ComboFix by sUBs
  • Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
    • If it is not on your desktop, the below will not work.
  • Shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
  • Open Notepad and copy/paste the text in the below quote box into Notepad:
Quote:
KillAll::

FileLook::
C:\Windows\system32\pxcpya64F.dll
C:\Windows\SysWOW64\pxcpya64F.dll

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
  • Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
  • At this point, you must exit all browsers now before continuing!
  • You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
  • Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  • This shall launch ComboFix.
    Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
  • Allow ComboFix to update itself if prompted.
  • When it finishes, a log will be produced at C:\ComboFix.txt
    Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
  • Attach this log to your next message. (How to attach items to your post)

Now download and install JRE 7
See the download links under this icon

Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message.(How to attach items to your post)
Notes:
  • This will automatically update all the logs inside MGlogs.zip
  • Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

*** Let me know how the PC is running after you have completed these steps! ***
Reply With Quote
Sponsored links
  #6  
Old 08-13-11, 18:26
jis3 jis3 is offline
Private E-2
 
Join Date: Aug 2011
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
Thumbs up Re: Google Chrome Redirect virus infection - have logs and programs ready to go

Totally awesome! I believe we are out of the woods. Google Chrome does not appear to be redirecting!!

Re: Last post
I disconnected the 40gb drive and it is not currently connected, was using it on my macbook. I will not reconnect it if you believe there is a problem there.

Also, I installed JRE-7 after I ran getlogs.bat? is that wrong? should i run again?

Going forward, I will re-enable McAfee, I have AdAware, but what programs do you recommend that I have up and running to prevent this from happening again??

Attached find the requested logs.

Fingers crossed, I believe you have done it!!!! THANK YOU SO MUCH!@#!@


MAJOR GEEKS RULES!@
Attached Files
File Type: txt ComboFix.txt (18.3 KB, 12 views)
File Type: zip MGlogs.zip (237.4 KB, 5 views)
Reply With Quote
  #7  
Old 08-18-11, 22:03
thisisu's Avatar
thisisu thisisu is offline
Malware Consultant
 
Join Date: Apr 2006
Location: Houston, TX
Posts: 8,175
Thanks: 270
Thanked 1,437 Times in 1,356 Posts
Default Re: Google Chrome Redirect virus infection - have logs and programs ready to go

Quote:
Going forward, I will re-enable McAfee, I have AdAware, but what programs do you recommend that I have up and running to prevent this from happening again??
Nothing is 100%, but I would recommend ESET Nod32, SpywareBlaster, FireFox with NoScript and AdBlockPlus plugins and safe surfing habits

Quote:
Fingers crossed, I believe you have done it!!!! THANK YOU SO MUCH!@#!@


MAJOR GEEKS RULES!@
You're welcome

If you are not having any other malware problems, it is time to do our final steps:
  1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
  2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
    • "%userprofile%\Desktop\combofix" /uninstall
      • Notes: The space between the combofix" and the /uninstall, it must be there.
      • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
  3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
  6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  7. Go to add/remove programs and uninstall HijackThis if it present
  8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning procedures pointed to by step 7 of the READ ME
      for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
  10. After doing the above, you should work thru the below link:
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Google redirect virus but only in google chrome... zdavies Malware Removal 5 08-12-11 15:11
Google Chrome/Firefox google search redirect virus help. time_warrior66 Malware Removal 3 07-12-11 11:54
Google Redirect Virus.. Did scans.. Posting logs LvingLgend Malware Removal 17 04-06-11 00:43
Google Firefox & Chrome Redirect Virus geek_mark Malware Removal 10 09-10-10 01:03
Google redirect virus (logs inc inside post) brit_girl Malware Removal 6 05-09-10 15:18


All times are GMT -5. The time now is 10:48.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger