Chinese Browser Hijacker

Welcome to Major Geeks!

To you create the below policy

Code:

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)

Are the below settings that you configured and recognize? If not then add them to the fix down below when running analyze.exe.

Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Uninstall the below old versions of software:
Java(TM) 6 Update 10

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [lasassf] c:\svhcsots.exe
O20 - Winlogon Notify: winkill - C:\WINDOWS\SYSTEM32\winkill.dll
O23 - Service: Windows Live Safety Center (LiveServer) - Unknown owner - C:\Program Files\Outlook Express\oemiglib.exe (file missing)
O23 - Service: qikstvis server (qikstvis server) - Unknown owner - C:\WINDOWS\system32\qikstvis.exe
O23 - Service: Windows Internet Exp1orer - Unknown owner - C:\Program.exe (file missing)
O23 - Service: wstdin servoi (wstdin servoi yhne-ktsvcis.exe) - Unknown owner - C:\WINDOWS\system32\yihne-tsvcis.exe

NOTE: HJT may popup an error about the services. Ignore it and click OK to continue.
After clicking Fix, exit HJT.

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

We have more to do.

You did not run the Windows Messenger removal program as requsted. Please always complete all steps in the order given. Please do this step now.

Do you know what the below folder and file are?

Code:

2008-10-18 01:28 67 --a------ c:\program files\wod\1935.vbs 

If not then delete the wod folder.



Now we need to use ComboFix again.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Happy NY!

You still are not clean. Do not assume that you are clean just because things appear to be working OK. I will tell you when you are clean. You need to keep coming back until then.

The infection you have has made it difficult for the tools we use to remove it by choosing some service and file names with spaces in key places making the tools fail to recognize the names. We will need to collect some additional info from the registry in an attempt to create a manual fix where we can bypass this problem.

Many of the free programs seem to work better.

It's one of the sticky threads in the forum and we will get to it when we finish removing your malware.

It is quite simply. Each program finds things that others may miss. Choosing the right tools to use and in what order, gives us the best coverage and helps us to more effectively find and remove malware.

No! Basically you need to have a great understanding of Windows and of malware and its trends. And you need to have an understanding of all the scanners and specialty tools and what they can do for you.

Let's continue with your fixes by collecting some additional info so that another fix can be created.


Now download Registry Search (see the link titled RegSearch Download Link)

• Extract the files from Regsearch.zip into a folder.
• Doubleclick regsearch.exe to start the program.
• In the top 3 boxes under the Enter search strings case independen) and click Ok... option, enter the below three strings (use copy and past)
  • vcxrdf
  • cfrblie
  • cctvnews
• Then click "OK".
• Notepad will be opened with text in it (the file named RegSearch.txt will be saved in the program's folder as well).
• Attach this RegSearch.txt file.

 

Okay let's try this again using this new info. This thing inserted a load a registry keys.



Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now for some redundancy, please copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now run Ccleaner!

Now run the same procedure with RegSearch again to get a new log.

Now goto this link Using MGtools and download the new version of MGtools.exe from the black bold print link in the first sentence. Overwrite your previous MGtools.exe file with this one.



Run MGtools.exe then attach the below logs:

• C:\ComboFix.txt
• the new RegSearch.txt log
• C:\MGlogs.zip

Make sure you tell me how things are working now!