Google redirect problem

Hi there

My laptop has been infected with some kind of search engine redirect virus. It started a couple of days ago, and as well as redirecting search engines in Firefox and Internet Explorer it won't let me install Malwarebytes (even when I rename the file). I've gone through the steps recommended in the following two posts:

- Reload this Page Fixing Google Redirection/Hijacking Problems http://forums.majorgeeks.com/showthread.php?t=230267
- Windows XP Malware Removal/Cleaning Procedure http://forums.majorgeeks.com/showthread.php?t=139313

Unfortunately they don't seem to have fixed the problem, so I'm now posting the various logs that I have as follows:

SASlog 5.7.11.txt log from SuperAntiSpyware
CFix log 5.7.11.txt from ComboFix
rootrepeal 5.7.11.txt from Rootrepeal
MGlogs.zip from MGtools
(No Malwarebytes log as it won't let me install this program.)

I'm not much of an expert when it comes to fiddling around under the bonnet with my laptop, so I may not understand instructions or questions first time - please bear with me! I'd really, really appreciate some help with this!

PS I uninstalled AVG2011 before running the various scans as requested in the malware removal guide - should I reinstall it now?

 

I've tried to attach my ComboFix log, but get the following message in 'Manage Attachments':

CFix log 5.7.11.txt:
Your file of 409.3 KB bytes exceeds the forum's limit of 375.0 KB for this filetype

What should I do???

 

- No!

We have a copy of your combofix.txt in MGlogs.zip so don't worry about this

 

Hi there

Have you managed to look at the log files I posted, and if so do you have any advice/instructions for me? I still have the same redirect problem, and I'm not protected by an anti-virus software (having uninstalled AVG as part of the malware removal process), and I have to continue to use the laptop...

Sorry to be asking for things, and I do really appreciate the help that you're providing people like me, but I'd really be grateful for an update.

Thanks

 

Goto the below link and follow the instructions for running TDSSKiller from Kaspersky

• TDSSkiller - How to run

Be sure to attach your log from TDSSKiller

Also please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

 

Hi there

Thanks for getting back to me - much appreciated.

I downloaded and tried running TDSSKiller, but it wouldn't run. I renamed it, twice, for example to 123zsa.com, and it wouldn't run. Nothing happened. Anything else I should try?

I had more luck with MBRCheck. The log is attached.

 

Hi there

Do you have your boot CD? Let's try this.

You need to use your Windows XP CD to boot to the Recovery Console and run the fixmbr command to clear a Master Boot Record infection that you have.

You must boot off the CD after you insert it in your CD/DVD drive.

1. Insert the CD
2. Reboot your computer
3. At the DELL Splash screen, press F12
4. This takes you to the Boot Menu
5. Select CD/DVD Rom from the selection by using the Down / up arrows
6. PRESS Enter have you have selected the CD/DVD Rom drive.
7. You'll hear the CD spinning up, be ready to press ANY key when you see the following message:

http://ww2.justanswer.com/uploads/anuangelanu/2010-05-06_055805_1.gif

When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
If you have a dual-boot or multiple-boot computer, select the installation that you must access from the Recovery Console.
http://support.microsoft.com/Library/Images/2399081.png
When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.

Now type in FIXMBR
It will warn you that replacing the MBR can be dangerous.
Press Y To proceed
It should say Operation completed successfully
Type exit

Now reboot your computer

You can also read the following to help you do this: http://support.microsoft.com/kb/307654

After running the fixmbr command then boot back to normal mode Windows and try running TDSSkiller now. Then attach the log. Also explain if you are still having any malware problems.

 

I've run the fixmbr command in the Recovery Console, which in turn has enabled me to run TDSSKiller. The log is attached. Anything interesting on that?

My search engine redirect problem also seems to have gone away ... for the moment at least! So we're definitely making progress - thank you!

Should I run Malwarebytes (which it wouldn't let me run before), or any other scans, to check for problems? What do I need to do to make sure my laptop is completely clear? And when should I reinstall AVG?

Thanks again

 

You had an MBR infection, it looks like fixmbr worked.

This is good news

Just keep following these steps

Once we are completely done, although I see traces of NOD32 on your system. I'd choose NOD32 over AVG if you have a choice, much more light-weight and effective IMO.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Yes please attempt to rerun Malwarebytes Anti-Malware as per the instructions here: http://forums.majorgeeks.com/showthread.php?t=154672

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Attach both the log from MBAM and mglogs.zip

 

Here are the logs as requested.

Looks like it's all fine now! Let me know what to do next.

Thanks again...

 

Please download and save the below tool from Grinler @ bleepingcomputer to your Desktop or anywhere else you can find it ( if the Desktop is not showing )

http://download.bleepingcomputer.com/grinler/unhide.exe

Now run it.


Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.


Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

 

I've run through everything and it all seemed to go fine. Here's MGlogs.zip.

Thanks again!

 

Using Explorer, please delete the following empty folders:

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Thanks for this. Wwhen I went to c:\documents and settings\Anthony Wright\Local Settings\temp\ge192 it wasn't there. I assume that this isn't a significant thing, unless you tell me otherwise. Everything seems to be working fine now anyway, and I've worked through the steps to finish things off.

Thank you so much for your help with this. I really appreciate your time and expertise.

Best wishes

 

If it's not there, don't worry about it. It was empty anyways.

You're welcome. Browse safely!