Browser Hijack

Hi and welcome

Our first steps guide is the best to follow, once you have completed it attach all the requested logs, then to take the hard work out of working out what to remove, our malware experts will do that job for you and issues you some tailored manual removal instructions to help clean up your PC.


Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.




​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • CounterSpy
  • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat
  • HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

 

The only potential problem observed in your logs is MovieCommander.

On March 23, 2007 someone installed MovieCommander. As far as I know this is malware. Did you knowingly install this. If so, are you sure it is not the cause of your problems. You should uninstall now. Make sure it actually uninstalls and that the folder and files for it are deleted. (see: C:\Program Files\MovieCommander )

Also uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders which may be left behind by the uninstall:
C:\Documents and Settings\All Users\Application Data\Sunbelt Software
C:\Program Files\Sunbelt Software


I also suggest that you uninstall the below old Sun Java versions and get the current version.

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 6
Java(TM) SE Runtime Environment 6

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

 

Older Java versions are subject to Virtumonde and other infections. These infections take advantage of the fact that the old Java versions are still being used. It's your decision, but it is a security risk.


Now please run this WareOut Removal and attach the FixWareOut log when you come back.

Now click Start, Run, and enter ipconfig /flushdns into the box and click OK. This will briefly flash a command prompt window and disappear.


Now download HostsXpert and then follow the below steps

• Unzip HostsXpert.zip
  [*]It will create a folder named HostsXpert in whatever folder you extract it to.
  [*]Run HostsXpert.exe, click Restore Microsoft's Hosts File and then click OK.
  [*]Click the X to exit the program

Now please download F-Secure's BlacklightBeta

• Download fsbl.exe and save it to the Desktop.
• Once saved... double click fsbl.exe to install the program.
• Click accept agreement and Click scan
• This application may trigger a warning from your antivirus. Let the driver load. Wait for it to finish.
• If it displays any items...don't do anything with them yet. Just hit exit (close)
• It will drop a log on Desktop that starts with fsbl....big number

Please attach the BlackLight log.

 

Okay FixWareOut found a hidden process. How are things working now?

Double check to make sure the below files have been deleted:

C:\Windows\system32\kdooy.exe
C:\WINDOWS\Temp\kdooy.ren