Google still re-directing

Hello. I just found your forum when I started having malware problems 2 days ago. I am running Windows XP SP 2 on an HP Pavilion wireless laptop, and am now using Firefox for my browser. Like an idiot, I was still using Netscape Nav 9 as I really liked the browser and thought that Norton would catch any issues. So not the case, and I am usually careful about such things. The first action I took when I found out that my computer had malware was to use StopZilla which found and deleted many issues - the major one being Seneka. But once I did this, I noticed that Google was re-directing my searches in Firefox.

I have completed the Malware Removal guide, and am enclosing the logs below. I did Combofix once before I started the guide after reading another post so I will be enclosing 2 logs from Combofix. Hope that this doesn't cause any confusion.

I am quite unfamiliar with searching and destroying for malware, although I'd like to think that I'm proficient with a PC. Hopefully someone can guide me in the right direction so that I can purge my system of these headaches. Thanks so much for your guidance.

 

And here are the other logs:

 

http://www.majorgeeks.com/images/grenade.gifWelcome! to MajorGeeks.com!http://www.majorgeeks.com/images/grenade.gif


Pre-Instructions:

1. First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.
   
2. Print out these instructions or save them to a text file so that you can operate with All Browser Windows CLOSED.

Step 1:

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

Again, make sure ALL browser windows are closed when you click FIX.​

Step 2:

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.​

Step 3:

Default Security Settings

To Default Security Settings:
For Internet Explorer 6 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up navigate to the Security Tab and click Default Level for the following:

• Internet
• Local Intranet
• Trusted Sites
• Restricted Sites.

Click OK to exit.

For Internet Explorer 7 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up, navigate to the Security Tab and simply click the "Reset all zones to default level" button. Click OK to exit.

NOTE: If it's "grey" then it's already at the default level.​

Step 4:

Please download ATF-Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF-Cleaner menu to close the program.​

Step 5:

Finally, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

​

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Hello there and thanks so much for such a blazingly fast response. I have completed all that you asked and am enclosing the logs. Unfortunately, when I tried to restart StopZilla, it would not initiate so I rebooted my computer. Once back in, StopZilla found another trojan, Catch Me, and eliminated it(?). I tried Google again but am still getting re-directed. Only 1 attempt out of about 7 links went where it was supposed to. Hmmm....these malwares are definitely not easy. My hat is off to you - you've got a tough job!!! What should I do next? :confused

 

Oh, I also forgot to ask...I am assuming that it is alright that Combofix and CFscript.txt disappeared from my desktop? :confused

 

No, this is why my fix did not work. Also, "catchme" is part of ComboFix and this is part of why the fix didn't work as well.

You need to disable ALL antivirus & antispy programs, download ComboFix and save to your desktop and run my previous fix again.

Once complete, attach the new logs.

 

Sorry that this took so long. I actually verified multiple times that all anti-spyware and anti-virus programs were exited before I started your instructions. The first time I did this yesterday, Combofix said that it needed to download an update at which time both Combofix.exe and CFscript.txt disappeared once it completed its cycle.

Today, I again completed your instructions and dropped CFscript on top of Combofix and it hung up at the "scanning for infections" prompt without progressing through the stages for hours. After stopping the program through Ctrl-Alt-Del, I re-did this step twice and it finally progressed through the stages. But when the system rebooted, Malwarebytes, StopZilla, and SUPERAntispyware all activated once my desktop was activated and the MGlogs were still being created. Now, I'm not sure that anything was accomplished as Google is still re-directing.

Did I do everything wrong once again? I'm really beginning to doubt my PC skills which usually don't suck this bad! Please advise if I am doing something wrong. I am simply exiting the anti-spyware programs and turning off Norton for 5 hours as you suggested. Is there a better way? Thanks again as I know that you're very busy!!!

 

Pre-Instructions:

1. First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.
   
2. Print out these instructions or save them to a text file so that you can operate with All Browser Windows CLOSED.

Step 1:

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.​

Step 2:

Finally, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

​

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Seriously, how are you keeping up this pace - it's amazing?! :strong Here are the logs that were generated after I completed the tasks that you requested. I did have an error generate when completing the GetLogs.bat as follows:
ProcessDll.exe error
Process id= 0xac (172)
Thread id = 0xcdc (3292)
Press Ok to terminate or Cancel to debug (I pressed Ok).

I hope that I'm doing this correctly. Checked - still re-directing - must have more malware? I will wait for more directions. Thanks again.

 

Now let's try running GooRedFix.

• Please download GooredFix and save it to your Desktop.
• Double-click Goored.exe to run it.
  • Select 1. Find Goored (no fix) by typing 1 and pressing Enter.
  • A log will open which you can just close. The log file is named Goored.txt and is on your Desktop.
• Please attach the Goored.txt log to your next reply
• Note: Do not run Option #2 yet.

 

Here's the log. I just noticed that my Norton and other anti-spyware programs were on. Will this cause a problem? :confused

 

You should print these instructions because all FireFox browsers MUST be closed before running the fix.

• Please double-click Goored.exe on your Desktop to run it.
  • Select 2. Fix Goored by typing 2 and pressing Enter.
  • Make sure all instances of Firefox are closed at this point.
  • Type y at the prompt and press Enter again.
  • A log will open which you can just close. The log file is named Goored.txt and is on your Desktop.
• Now rerun FireFox and please attach the new Goored.txt log to your next reply
• Let me know if there is any change.

​

 

Wow, I am seriously happy now. :hyper You are truly the master!!!! I went to Google and every link that I hit on multiple searches came up golden. Awesome, stupendous, simply...YEAHHHHHH!!! Thank you so much. It looks my malware nightmare may be at an end. Anything that I can do in return, just let me know. I am so lucky to have found this forum, and am now a devoted student of MajorGeeks.com.

 

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware & Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources (except a little disk space) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\combofix folder from combofix (if it exists)
3. If we had you run Avenger, you can delete all files related to Avenger now.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to Add/Remove Programs and uninstall HijackThis.
8. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
9. If you are running Windows Vista, Windows XP or Windows ME, you need to follow the below:
   • Refer to the cleaning steps in the READ ME for your Windows version and see the steps to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

All done. Thank you, thank you, thank you!!!! You da man!!!! And get some rest, because, WOW, you are like a malware cleaning machine. :celebrate
And I'm sure that others will want to join in a group hug... :grouphug
Anything you need that I can do, just let me know.

 

You're Welcome!

Surf Safely!:major