Checkeran.com - curiouser and curiouser

thatswhen · Jan 26, 2011

Hi, has anyone any experience of removing site redirections to 'checkeran.com' please? I've been reading around here and on google and am a bit stumped

Browser on an ''infected'' PC is redirecting to checkeran.com (not a legit site from what I can see), as well as not allowing me to run things like Spybot, HiJackThis, AdAware, all of which I've downloaded today to a clean PC following a read around

Google searches (from another, working PC) are not saying very much about checkeran.com either - other than it seems new and quite vicious... It's my son's PC, just found out that Norton was "off" for several weeks too

Hope OK to post so little information at this stage, it's just that I've got the 'bad' PC in safe mode now, am currently scanning using Malwarebytes - and have updated and switched Norton on too. I can post a HiJack this log too, but was surprised couldn't find anything very much on checkeran, which is why I'm posting now

What little I can find (such as http://www.cleanpcguide.com/remove-checkeran-com-how-to-remove-checkeran-com/) doesn't seem legit either, which is why it all seems curious

Any help will be gratefully appreciated!

dr.moriarty · Jan 26, 2011

Welcome to MajorGeeks!

My research shows:

Checkeran.com is a dangerous Hijacker that is the same family of Antivirus.net. Checkeran.com is installed via Trojans that display false error messages and security warnings on the infected computer, it bares its essentiality by hijacking your system and displaying many misleading pop-ups.
Click to expand...

Please read ALL of this message including the notes before doing anything.

Please download TDSSKiller.exe and save it to your Desktop. <-Important!!!

Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
Vista/Windows 7 users right-click and select Run As Administrator.

If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123tdk.com).

If you do not see the file extension, please refer to: How to view hidden, system files & folders!

Click the Start Scan button.

Allow the application to run if prompted by Windows or any security programs you have installed

Do not use the computer during the scan

It will start the scan and run rather quickly and will notify you of whether anything is found or not.

Follow the instructions to delete/quarantine if asks you what to do when if finds something.

Whether an infection is found or not, a log file should be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )

*Then - follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide

and then attach the requested logs to your next reply when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****

Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

* Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated - our system works the oldest threads FIRST.

thatswhen · Jan 29, 2011

Just a note to give a HUGE thank you

I have to say that initially all those pages of directions seemed daunting, but they were very clear and took me through it all step by step

Yes, it took some time, I'm new to this after all, but a day or so later and the 'infected' pc seems as good as new. In fact, I'm typing this message from the problem pc itself - without any problems at all

What a difference a day makes and thanks again!

dr.moriarty · Jan 29, 2011

You're very welcome, thatswhen!

If you don't feel the need for me to review your logs, I have some cleanup steps for you:

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and re-enable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work through the below link:

How to Protect yourself from malware!

Click to expand...

Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif

thatswhen · Jan 29, 2011

Again, many thanks, can't believe how easy you made it all seem

I couldn't find the SASlog.txt log though that was generated. Whatever problem was there is well and truly gone though (no popups, no redirection AND internet access fully restored)

Thought it best just to say thanks rather than given an incomplete post back!

You were, of course, absolutely correct it seems and had I searched for Antivirus.net too and not just checkeran.com could have saved you a bit of time perhaps :-o

So, if I can find the SASlog.txt log I'll post again - for which thanks in advance - and will certainly follow your clean up advice too

I have an older laptop too that I use that has been getting really slow at times, so will follow the advice you've already given - that is, if it IS malware that's the problem there, instead of it being a little old and coal driven :-D

As before, can't believe how easy you made it all seem, your help has been really appreciated

So..... I post at http://www.consumeractiongroup.co.uk/forum/ mainly on the http://www.consumeractiongroup.co.uk/forum/forumdisplay.php?65-Residential-and-Commercial-Lettings from time to time. CAG has an IT section, but it's much more a consumer action group, rather than dealing with specific IT issues!

Trust it will be OK to post a link to MajorGeeks there?

dr.moriarty · Jan 29, 2011

:cool

I'm glad that you "took the plunge" and discovered that working through our procedures isn't that difficult... and you got your machine cleaned without any additional help.

thatswhen said:

Trust it will be OK to post a link to MajorGeeks there?
Click to expand...

Sure! We'd appreciate that!!

*Just start a new thread if you find that you need help cleaning "the coal burner". :-D

dr.m

thatswhen · Jan 29, 2011

Message now posted on CAG. It's at http://www.consumeractiongroup.co.u...seful-IT-help-worth-a-sticky-(2-Viewing)-nbsp and posted unedited due to the late hour!

Thanks again though - and will post again once I've gone through the RUN & READ ME post on the ol'coal burner. It's an Acer Aspire 5610Z, pretty much built of plastic, so heat seems to be it's enemy too , which might be part of the issue

Anyway, thanks again, really appreciated!

Log in or Sign up

Checkeran.com - curiouser and curiouser

thatswhen Private E-2

dr.moriarty Malware Super Sleuth Staff Member

thatswhen Private E-2

dr.moriarty Malware Super Sleuth Staff Member

thatswhen Private E-2

dr.moriarty Malware Super Sleuth Staff Member

thatswhen Private E-2