Browser redirection - Terminal server

Welcome to Major Geeks!

You need to run the main body of the below. The Google Redirect link sent you back to this in step 5.


READ & RUN ME FIRST. Malware Removal Guide


Also are you saying that there are many user accounts on this server that people actually use to do surfing????

Note that MBRcheck does indicate that there could be a problem with the MBR. Do you have all files backed up on this server? If not, you should do that before going any further as repairing the MBR can sometimes cause problems. Most of the time it is not a problem, but there is always the chance. Also this is Windows Server not Windows XP/Vista/7.

Do you have a Windows Server 2008 Boot CD to use to repair the MBR?

 

Try running the below.

Please download and save the below to your Desktop or anywhere else you can find it ( if the Desktop is not showing )

http://download.bleepingcomputer.com/grinler/unhide.exe

Now run it ( if you are running Vista or Win 7, use right click and select Run As Administrator ). Did that help with your missing items?

Also note that Grinler ( the creator of unhide.exe ) has the below link which gives info on restoring some system defaults when the unhide program
cannot find backups. Scroll down in the link:

http://www.bleepingcomputer.com/forums/topic405109.html

Yes try those instructions. If something does not work, just move on to the next. At the end, I still expect that MGtools should work.

So they should not have Adminstrator permissions then?

Not until we see results from other steps.

 

Okay a few different infections are showing up. Hitman also confirms what I said earlier about your MBR being infected

Code:

   Master Boot Record (sector 0)
    > G Data . . . . . . : MBR:SST [Rtk]
    > DrWeb  . . . . . . :  Trojan.Tdlbkfs.1
    > Ikarus . . . . . . : Rootkit.Boot.Sst!IK
    > HitmanPro  . . . . : Win64/Bootkit

I want to give you a fix that does not including fixing the MBR first and then we will come back to this.

I will post another message with a fix in a little while.

Are you sure this is a work PC???? There are quite a few questionable ( porn ) files showing up in the logs. You need to manually clean all this stuff up. See the zafind.txt log in MGlogs.zip. No wonder this PC is infected. Also the zafind.txt log is excessively long because of all of this.

You also need to empty all of the C:\$Recycle.Bin folders for all the accounts shown. Again look at zafind.txt

 

Right the below folders are on this hard disk still and you can find files there to manually restore if you still need them. But do this soon before the temp folders get cleaned out.

Code:

d--h--w                 0 2012-10-08 05:39:21  C:\Users\Administrator\Local Settings\TEMP\smtmp\1
d--h--w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\4
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs
d-----w                 0 2012-10-08 05:39:21  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Accessories
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\APC PowerChute Business Edition
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\BarTender 9.4
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\CutePDF
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Google Chrome
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Internet Explorer
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Malwarebytes' Anti-Malware
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\MYOB AccountRight Enterprise v19
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\MYOB Premier Enterprise v6.5
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Nuance PDF Professional 6
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\QuickTime
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Startup
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Symantec Backup Exec
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Symantec Endpoint Protection
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\TransPost
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Windows SBS
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\WinZip
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\YouSendIt Desktop App
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\ZebraNet Utilities
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Terminal Services
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\CutePDF\PDF Writer
----a-w             1,133 2012-10-08 05:13:30  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk
----a-w             1,133 2012-10-08 05:13:30  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk
d-----w                 0 2012-10-08 05:44:12  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Malwarebytes' Anti-Malware\Tools
----a-w             1,157 2012-10-08 05:13:30  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Malwarebytes' Anti-Malware\Uninstall Malwarebytes Anti-Malware.lnk
----a-w             1,306 2012-10-08 05:13:30  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\MYOB AccountRight Enterprise v19\MYOB Tools
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\MYOB Premier Enterprise v6.5\MYOB Tools
d-----w                 0 2012-10-08 05:44:13  C:\Users\Administrator\Local Settings\TEMP\smtmp\1\Programs\TransPost\TransPost Tools
---ha-w             1,115 2012-10-08 05:13:30  C:\Users\Administrator\Local Settings\TEMP\smtmp\4\Malwarebytes Anti-Malware.lnk

 

Okay after observing what I posted in my previous message cleaning up all that garbage, please continue here.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: (no name) - {3a7f3254-eafa-4dbc-b4f3-0d40916f3352} - C:\Program Files (x86)\ReferenceBoss_1p\bar\1.bin\1pSrcAs.dll (file missing)
O3 - Toolbar: ReferenceBoss - {c4676d53-fce5-4a19-be4d-97e6eaf7e19a} - C:\Program Files (x86)\ReferenceBoss_1p\bar\1.bin\1pbar.dll (file missing)
O4 - HKUS\S-1-5-21-3247755219-2071388787-105539922-1170\..\Run: [dplaysvr] C:\Users\tmcleod.VIGORELLA\AppData\Local\dplaysvr.exe (User 'TMcLeod')
O4 - HKUS\S-1-5-21-3247755219-2071388787-105539922-1170\..\Run: [Internet Security] C:\ProgramData\isecurity.exe (User 'TMcLeod')
O4 - HKUS\S-1-5-21-3247755219-2071388787-105539922-1187\..\Run: [Ihzitew] C:\Users\sdevon.VIGORELLA\AppData\Roaming\Aqokhu\aczo.exe (User 'SDevon')

After clicking Fix, exit HJT.

Now rerun RogueKiller and run a scan. After it finishes the scan, select the Registry tab and then select any of the below that still exist and then click the Delete button.

Then immediately reboot your PC at this point.

After reboot, please download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe and select Run as administrator to run it.
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
  the code box

Code:

:Processes
explorer.exe

:Files
C:\Users\sdevon.VIGORELLA\AppData\Roaming\Aqokhu\aczo.exe
C:\ProgramData\isecurity.exe
C:\Users\sdevon.VIGORELLA\AppData\Roaming\Aqokhu
C:\Windows\tasks\PC Optimizer Pro Updates.job
C:\Windows\tasks\PC Optimizer Pro64 startups.job
C:\Windows\TEMP\*.tmp
C:\Users\tmcleod.VIGORELLA\AppData\Local\dplaysvr.exe
C:\Program Files (x86)\ReferenceBoss_1p

:Reg
[-HKEY_USERS\S-1-5-21-3247755219-2071388787-105539922-1187\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ihzitew]
:Commands
[purity]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
  ) and choose Paste.
• Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

After reboot, run a new scan with RogueKiller and save a log as in original instructions and attach the new log.
Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).
Then attach the below logs:

• the C:\_OTM\MovedFiles log
• the new RogueKiller log
• C:\MGlogs.zip

 

You're welcome. Looks good now. But there are still quite a few temp files from IE5 that could be cleaned up. Not necessary but would not hurt just to make sure none of these contain components that caused the infection. See the zafind.txt log Also empty the recycle bin folders.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
3. Go back to step 4 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 6 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Yes they are. Running MGclean.bat will possibly cleanup all of this. If not you can delete later.

No! Ignore it and continue. MGclean.bat will clean this up too.

No! Which is why I did not touch it. I was not sure it it was something that someone knowingly installed. Personally I don't like any toolbars except the one that are actually part of Windows.

 

You're welcome. Surf safely!