Google redirection virus

Hi there, I've recently acquired a virus that sometimes redirects links from Google (this happens on IE, Firefox and Chrome). Chrome also gives me an "SSL Error" for websites that were previously reliable, saying that "the server presented a certificate signed using a weak signature algorithm". Also, sometimes a new tab will pop up with a similar website to those I get redirected to from Google.

I have followed the procedures on the READ & RUN ME FIRST. Malware Removal Guide, Fixing Google Redirection/hijacking and other redirection problems and Vista & Windows 7 Malware Removal/Cleaning Procedure threads, but my problem still persists. I have attached all the scan logs mentioned in these threads to this post (I have 7 logs, so they will actually be attached across 2 posts).

Any help to solve this problem would be greatly appreciated!

 

(The remaining 3 scan logs)

 

Welcome to MajorGeeks, benh128

http://img805.imageshack.us/img805/9659/rktigzy.gif Delete items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Once the scan is complete, go to the Registry tab and checkmark everything except the below items:

• [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0)
• [HJ] HKLM\[...]\System : EnableLUA (0)

Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[3].txt
Attach RKreport[3].txt to your next message. (How to attach)

__

http://3.bp.blogspot.com/-tH5H1icUyOc/T1XP6r4puoI/AAAAAAAAAQE/jLwmqQECjCg/s1600/hitmanpro.gif - Rescan with HitmanPro

This time if the below detections are found, choose the action I've listed below:

• services.exe - Trojan ==> Replace
• anbsr.dll - Malware ==> Delete
• ocrer.dll - Trojan ==> Delete
• Desktop.ini - Trojan ==> Delete

Ignore any other detections and click the Next button.
HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

__

http://3.bp.blogspot.com/-tH5H1icUyOc/T1XP6r4puoI/AAAAAAAAAQE/jLwmqQECjCg/s1600/hitmanpro.gif Once you are back in Windows, run another scan only with HitmanPro and then attach the latest hitmanpro.zip log. (How to attach)

__

Completely delete these two folders manually using Windows Explorer:

• c:\windows\installer\{caaf1133-061d-189e-85dc-248735f399b1}
• c:\users\ben\appdata\local\{caaf1133-061d-189e-85dc-248735f399b1}

Let me know if you were successful or not.

 

Thanks for the reply, I think that might have done it! I've been testing the redirects and they seem to have gone away, and Chrome no longer gives me the SSL warnings.

A note with the RK log, it saved as RKreport[2] instead of RKreport[3], I think maybe because I moved my previous log away from my desktop? Unless that number means something important though, that should be the correct log (the time matches when I did the scan).

 

You attached the right one, thanks.

http://img205.imageshack.us/img205/1894/otl.gif Please download OTL by OldTimer.

• Save it to your desktop.
• Right mouse click on the OTL icon on your desktop and select Run as Administrator
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.
  
  Code:

  activex
  netsvcs
  /md5start
  services.exe
  xsecva.exe
  /md5stop
  C:\Users\Ben\AppData\Roaming\xsecva /s
  

• Now click the http://img171.imageshack.us/img171/2405/runscanotl.png button.
• One report will be created:
  • OTL.txt <-- Will be opened
• Attach OTL.txt to your next message. (How to attach)

 

Thanks, here's the log!

 

http://img850.imageshack.us/img850/4746/programsandfeatureswin7.gif From Programs and Features (via Control Panel), please uninstall the below:

• Java(TM) 6 Update 2
• Java(TM) 6 Update 31

__

http://img205.imageshack.us/img205/1894/otl.gif Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.

Code:

[COLOR="DarkRed"]:processes[/COLOR]
killallprocesses
[COLOR="DarkRed"]:otl[/COLOR]
DRV - File not found [Kernel | System | Stopped] -- H:\VIRUS SCANS\SUPERAntiSpyware\SASKUTIL.sys -- (SASKUTIL)
DRV - File not found [Kernel | On_Demand | Stopped] -- H:\VIRUS SCANS\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - File not found [Kernel | System | Stopped] -- H:\VIRUS SCANS\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_AU&c=94&bd=Pavilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_AU&c=94&bd=Pavilion&pf=cnnb
IE - HKLM\..\SearchScopes\{5BE145AB-2487-4178-B2AC-9A07B752430A}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1347&query={searchTerms}&invocationType=tb50hpcnnbie7-en-au
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2260074389-4229988242-1198603330-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_AU&c=94&bd=Pavilion&pf=cnnb
IE - HKU\S-1-5-21-2260074389-4229988242-1198603330-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_AU&c=94&bd=Pavilion&pf=cnnb
IE - HKU\S-1-5-21-2260074389-4229988242-1198603330-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2260074389-4229988242-1198603330-1000\..\SearchScopes\{5BE145AB-2487-4178-B2AC-9A07B752430A}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1347&query={searchTerms}&invocationType=tb50hpcnnbie7-en-au
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2012/07/19 12:46:16 | 000,035,870 | ---- | C] () -- C:\Users\Ben\Desktop\VIRUS.odt
[2011/06/16 12:13:38 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[COLOR="DarkRed"]:files[/COLOR]
C:\Program Files\Java\jre1.6.0_02 /d
dir /s C:\Users\Ben\AppData\Roaming\xsecva /c
C:\Users\Ben\AppData\Roaming\xsecva /d
C:\Windows\Installer\{caaf1133-061d-189e-85dc-248735f399b1}
c:\windows\assembly\gac\desktop.ini /d
C:\Users\Ben\AppData\Roaming\anbsr.dll /d
C:\Users\Ben\AppData\Roaming\ocrer.dll /d
c:\users\ben\appdata\local\{caaf1133-061d-189e-85dc-248735f399b1}
dir /s C:\Users\Ben\AppData\Local\{33ED6400-CFF7-11E1-8270-B8AC6F996F26} /c
type c:\rkill.log /c
[COLOR="DarkRed"]:reg[/COLOR]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"anbsr"=-
"ocrer"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"ocrer"=-
"anbsr"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"startup"=dword:00000000
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5BE145AB-2487-4178-B2AC-9A07B752430A}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{5BE145AB-2487-4178-B2AC-9A07B752430A}]
[COLOR="DarkRed"]:commands[/COLOR]
[emptyjava]
[emptyflash]

Now click the http://img3.imageshack.us/img3/407/otlrunfix.png button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

__

http://img17.imageshack.us/img17/3214/baticonvista7.gif Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

 

Here are the next logs!

 

Your latest logs are clean.

__

If you are not having any other malware related problems, it is time to do our final steps:

• Any programs we had you download and/or install can be removed at this time.
• If we had you download and run ComboFix, here is how to uninstall it:
  • Press and hold the Windows key http://i1106.photobucket.com/albums/h363/debojyotidas/Windows_Logo_key.gif and then press the letter R on your keyboard.
  • This opens the Run dialog box.
  • Copy and paste the below text inside the text-field:
    • "%userprofile%\desktop\ComboFix" /uninstall
  • Now press ENTER
  • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
• You can re-enable your Disk Emulation software at this time via DeFogger.
• If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
• Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
• Now we will toggle System Restore to remove any infected system restore points.
  • Read this: How to Disable And Enable System Restore
• Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
• Be safe

 

Fantasic! Thank you very very much for your help and speedy replies, that had to be the most painless virus removal ever!

 

You're welcome