MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 09-12-12, 10:39
TurChunkin TurChunkin is offline
Private E-2
 
Join Date: Sep 2012
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
Default v9.com browser redirect

Hey all, first of all a big thank you to anyone who runs or helps run this place, you guys are the f'ing best. For real.

Now to get to it, I've been running the RTM version of windows 8 that was released mid August without issues, and a couple days ago my home page started getting redirected to v9.com.

I just recently upgraded to an SSD, so I thought a simple reformat would be the easiest fix for me. No deal, it persists. Malwarebytes, MSE (windows defender in win8), CCCleaner, RogueKiller, FixTDSS, and MBR Check all come up with nothing and won't clear out this crap. I know it is creating some kind of hidden partition, but I'm not sure how to remove it.

HitManPro detects 3 suspicious files, one called services.exe in system 32, but when I select the quarantine option and click next, it gets switched back to ignore and doesn't seem to work or do anything. History in HMP stays clear and another scan will detect the same file. Here is the HMP log.

Thanks for any help with this. Here are my logs.
Attached Files
File Type: log HitmanPro_20120912_0756.log (4.1 KB, 9 views)
File Type: txt MBRCheck_09.12.12_07.14.07.txt (10.1 KB, 5 views)
File Type: txt RKreport[3].txt (1,022 Bytes, 7 views)
File Type: txt mbam-log-2012-09-12 (08-24-30).txt (1.8 KB, 7 views)
Reply With Quote
Sponsored links
  #2  
Old 09-12-12, 14:29
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 45,921
Thanks: 400
Thanked 4,450 Times in 4,226 Posts
Default Re: v9.com browser redirect

You still need to attach the log from running MGTools.exe --- C:\MGLogs.zip
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #3  
Old 09-12-12, 14:30
TurChunkin TurChunkin is offline
Private E-2
 
Join Date: Sep 2012
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: v9.com browser redirect

Hi, sorry I forgot to mention MGTools won't run in win8...
Reply With Quote
  #4  
Old 09-13-12, 00:50
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 79,712
Thanks: 61
Thanked 7,413 Times in 3,965 Posts
Default Re: v9.com browser redirect

Quote:
Originally Posted by TurChunkin View Post
Hi, sorry I forgot to mention MGTools won't run in win8...
Please do the below so we can attempt to fix this.


Now please click Start, and type cmd into the search box.
  • You should see a cmd.exe and icon appear in the Programs area of the Start Menu.
  • Right click on cmd.exe and select Run As Administrator
Now in the Command Prompt window that opens, type in ver and hit enter. Tell me exactly what you get for output.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #5  
Old 09-13-12, 01:17
TurChunkin TurChunkin is offline
Private E-2
 
Join Date: Sep 2012
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: v9.com browser redirect

Hi. It says "Microsoft Windows [Version 6.2.9200]
Reply With Quote
Sponsored links
  #6  
Old 09-13-12, 01:25
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 79,712
Thanks: 61
Thanked 7,413 Times in 3,965 Posts
Default Re: v9.com browser redirect

Thanks! Okay then try the below.

Download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7 or Win 8, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )



Now attach the below log:
  • C:\MGlogs.zip
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #7  
Old 09-13-12, 04:26
TurChunkin TurChunkin is offline
Private E-2
 
Join Date: Sep 2012
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: v9.com browser redirect

Ok. Cool. I think it worked.
Attached Files
File Type: zip MGlogs.zip (1.9 KB, 3 views)
Reply With Quote
  #8  
Old 09-13-12, 09:10
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 79,712
Thanks: 61
Thanked 7,413 Times in 3,965 Posts
Default Re: v9.com browser redirect

Quote:
Originally Posted by TurChunkin View Post
Ok. Cool. I think it worked.
Not really. The log is extremely incomplete as only the very first scan ran.

Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.
  • Right click the Command Prompt entry and select Run As Administrator.
    • It is critical that you run it this way.
  • If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
  • Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple/brown is merely informational.
cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
SN64 <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
nwktst <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
GRK64 <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
getnetinf<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
Now look for the C:\MGlogs.zip file and attach it no matter what happened while doing the above.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #9  
Old 09-13-12, 16:08
TurChunkin TurChunkin is offline
Private E-2
 
Join Date: Sep 2012
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: v9.com browser redirect

Damn. Every command give me a "Your OS version is Unsupported by [command]" error. Here's the log again for what it's worth. I hope I'm not being too much trouble, never encountered something that can survive a reformat like this
Reply With Quote
  #10  
Old 09-13-12, 18:36
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 79,712
Thanks: 61
Thanked 7,413 Times in 3,965 Posts
Default Re: v9.com browser redirect

Quote:
Originally Posted by TurChunkin View Post
I hope I'm not being too much trouble, never encountered something that can survive a reformat like this
No not a problem. Actually we need your help here a little too to debug all the tools to get them working with Win 8.

Did you run TDSSkiller per the READ & RUN ME and did it run? If so attach the log.

I will make another update later tonight to try getting MGtools to work but in the meantime, please do the below:


Please download OTL by OldTimer.
  • Save it to your desktop.
  • Right mouse click on the OTL icon on your desktop and select Run as Administrator
  • Check the "Scan All Users" checkbox.
  • Check the "Standard Output".
  • Change the setting of "Drivers" and "Services" to "All"
  • Copy the text in the code box below and paste it into the text-field.
Code:
activex
netsvcs
  • Now click the button.
  • One report will be created:
    • OTL.txt <-- Will be opened
  • Attach OTL.txt to your next message. (How to attach)
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
Sponsored links
  #11  
Old 09-13-12, 21:34
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 79,712
Thanks: 61
Thanked 7,413 Times in 3,965 Posts
Default Re: v9.com browser redirect

Quote:
Originally Posted by TurChunkin View Post
Every command give me a "Your OS version is Unsupported by [command]" error. Here's the log again for what it's worth.
You forgot to attach it. I would have expected at least GRK64.bat to run . However please try another newer version of MGtools.

Download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7 or Win 8, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


Now attach the below log:
  • C:\MGlogs.zip
If it does not appear to run properly, please run the same debug steps as in message # 8 again.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter

Last edited by chaslang; 09-13-12 at 21:59..
Reply With Quote
  #12  
Old 09-20-12, 03:41
TurChunkin TurChunkin is offline
Private E-2
 
Join Date: Sep 2012
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: v9.com browser redirect

Hey guys, sorry for the long delay, I was literally waiting for a plane to Costa Rica when all of this BS started, and right now I am in the jungles of Panama on a surprisingly decent Wi-Fi card. Anyways, inexplicably when I finally fired up my laptop again today my browser didn't get redirected. Anyways, you were right about the newer version working, so here is the log, although I'm not sure if I need it anymore, since as far as I can tell one of the plethora of malware removal softwares I installed took care of my problem. Either way, thank you guys so much once again, and you will for sure get mentioned in my travel blog :D
Attached Files
File Type: zip MGlogs2.zip (266.4 KB, 1 views)
Reply With Quote
  #13  
Old 09-20-12, 20:46
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 79,712
Thanks: 61
Thanked 7,413 Times in 3,965 Posts
Default Re: v9.com browser redirect

You're welcome.
Quote:
Originally Posted by TurChunkin View Post
Anyways, inexplicably when I finally fired up my laptop again today my browser didn't get redirected.
That's good because all of your logs are clean. Hitman was actually incorrect. It just does not yet recognize the Windows 8 version of services.exe.

If you are not having any other malware problems, it is time to do our final steps:
  1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
  2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  5. Go to add/remove programs and uninstall HijackThis.
  6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  7. After doing the above, you should work thru the below link:
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Browser redirect sko Malware Removal 7 06-29-12 10:34
Browser redirect. personman Malware Removal 14 07-05-11 17:38
Browser redirect/Pop-ups? 012965 Malware Removal 18 04-15-10 21:17
Browser redirect g_man7505 Malware Removal 4 02-04-10 07:21
Browser Redirect abern01 Malware Removal 29 04-28-07 00:18


All times are GMT -5. The time now is 15:51.


MajorGeeks.Com Home Page
| Admin Tools | All In One | Anti-Spyware | Anti-Virus | Appearance | Backup | Benchmarking | BIOS | Browsers | Covert Ops |
Data Recovery | Diagnostics | Drive Cleaners | Drive Utilities | Drivers | Driver Tools Ergonomics | Firewalls | Games | Game Tweaks | Graphics | Input Devices | Internet Tools | Macintosh | Mail Utilities | Memory | Messaging | Monitoring | Microsoft | Multimedia | Networking | Office Tools | Process Management | Processor | Registry | Security | System Info | Toys | Video | Miscellaneous
|
Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger