Google Hijack + Infinite Redirect Loops + Should Not See Me

Novaa · Apr 25, 2009

Okay, I don't know what to do anymore.

My Mozilla Firefox google homepage does not work. It comes up with this:

"Redirect Loop
Firefox has detected that the server is redirecting the request for this address in a way that will never complete."

If I google something from google.ca, every now and then I will be redirected to something completely different. The sites I get are usually videos on break.com, or some other xyzz site. I don't understand this part at all. I have heard of the Google Hijack virus before, though.

When restarting/shutting down, a "end now" dialog box has popped up, asking me to end "should not see me" -- that seems a little fishy and odd.

I believe my source of these problems has come from a virus-carrier "QuickPlaeyr" (spelt like that)

I have reformatted TWICE now, I don't see how anything could have lived thru this.

During the first reformat, I attempted to go into my drives and got an error about "RECYCLE" something something something. On my USB stick, which had internet drivers on it, was an empty folder named RECYCLE, so perhaps the stick is infected?...

Can anybody tell me how to get rid of this?!

Also, here is a HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:42:39 PM, on 4/25/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 1437 bytes

The log looks pretty damned clean to me.

I really do hope someone can help me. Thanks in advance.

It also appears that both of the laptops in the house are having the same Google problem.

Has the network somehow been corrupted?!

Novaa · Apr 26, 2009

Bump.

Novaa · Apr 26, 2009

Bump.

TimW · Apr 29, 2009

Each time you "bumped" it put you back at the end of the line per this sticky thread Don't Bump! It Only Hurts You!!! which you should have read. I would suggest you refrain from that in the future.

Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.

If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.

TDSSserv Non-Plug & Play Driver Disable

If something does not run, write down the info to explain to us later but keep on going.

Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode. You can run steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

To avoid addtional delay in getting a response, it is strongly advise that after completing the READ & RUN ME you also read this sticky Don't Bump! It Only Hurts You!!!. Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

Novaa · Apr 29, 2009

Hey TimW,

thanks for the info and for the reply.
I did the steps you linked me to, and no, TDSSserv.sys was not found.

Funny enough Rogers just called me explaining how they've detected a virus of some sort on my system. The indian call center guy, of course could not help me at all.

TimW · May 2, 2009

I am afraid I cant help you unless you follow the instructions I gave you and attach the requested logs.

Novaa · May 2, 2009

Problem has been fixed.
I simply ran MalewareBytes in safe mode, and reset the modem while I was booting back to normal mode. This prevented the virus from coming back. I did this to the laptops to, at the same time.

TimW · May 6, 2009

Good to know....

Log in or Sign up

Google Hijack + Infinite Redirect Loops + Should Not See Me

Novaa Private E-2

Novaa Private E-2

Novaa Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Novaa Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Novaa Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member