google redirect virus need help

Discussion in 'Malware Help (A Specialist Will Reply)' started by scrabblefan, Mar 21, 2010.

  1. scrabblefan

    scrabblefan Private E-2

    Hello, I am a novice and believe I have the google redirect virus. When I have tried in the past to use google, a screen comes up that says "google sorry, we're sorry... but your computer or network maybe sending automated queries. To protect our users, we can't process your request right now. Type in the characters seen below. I figured out that if you typed in the direct www.com site you could eventually get to it after a 3 or 4 tries. I know that I had a lot of pop ups where it basically said that the site you are trying to get to is bad, click here to fix it and protect your computer. I had many sites come up from google searches that were not really real or just trying to sell things. I know it would send me to bing.com. I could not use the toolbar? in the upper right corner, it would make everything worse. I remember that I was researching how to actually build horse jumps and was looking at a lot of sites. I had a screen pop up that was nasty porn pictures(thank goodness that my young daughter was not in the room) I clicked off of this right away but remember all kinds of pop ups screens flashing at me. I hope I said no to everything but do not remember. That was in about November and have had nothing but trouble since.:cry I also have tons of cialis, viagra, rx drugs and sex emails now and all my contacts in my email have been wiped out. But I think that may be a problem for another forum, I do not know. I have been researching how to fix the google problems and was happy to find majorgeeks.
    I have went through every step of READ & RUN ME and my computer seems to being doing better! I have attached my logs. My problem now is that my google site has english and another language which I do not know!(Zoeken?) I want to have you check my logs please and see that I am finally rid of google redirect.
    I do know that I have microsoft windows version 5.1 service pack 3, windows xp professional version 2002, 32 bit.
    I have spybot, but after doing all this would like any suggestions you could offer to help keep this from happening again.
    I am sorry but could not figure out how to attach the malwarebytes log, so here it is:
    Malwarebytes' Anti-Malware 1.44
    Database version: 3892
    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    3/21/2010 12:34:32 PM
    mbam-log-2010-03-21 (12-34-32).txt

    Scan type: Quick Scan
    Objects scanned: 120528
    Time elapsed: 4 minute(s), 49 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\timesink ad client (AdWare.Cydoor) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)



    When I went to get the RRlog.txt there is nothing there. I am not sure what to do, should I run it again?

    thank you in advance for all help
     

    Attached Files:

    scrabblefan, Mar 21, 2010
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    1. Run this:

    Running HostXpert to Reset Default Hosts File

    2. Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
    Code:
    KILLALL::

File::
c:\documents and settings\All Users\Application Data\ParetoLogic\UUS2\Temp\Update.exe

Folder::
c:\program files\Common Files\ParetoLogic
c:\documents and settings\All Users\Application Data\ParetoLogic
c:\documents and settings\All Users\Application Data\ParetoLogic Anti-Virus PLUS
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe

      http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    3. Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

    4. Now tell me how the machine is behaving.
     
    Kestrel13!, Mar 22, 2010
    #2
  3. scrabblefan

    scrabblefan Private E-2

    Hi I tried Running HostXpert to Reset Default Hosts File but another window comes up with a fake looking sticker saying error.
    at http://http//forums.majorgeeks.com/showthread.php?t=138700&highlight=hostxpert
    Intranet settings are now turned off by default. Intranet settings are less secure than internet settings.
    The page you requested is no longer here [error 404]
    ... but we think we can help you
    In order to improve our service, you can inform us that someone else has an incorrect link to our site. We will do our best to notify them that this page has moved and ask them to update the link. Just press the button!
    You were incorrectly referred to this page by: forums.majorgeeks.com
    We suggest you try one of the links below:
    I am not sure how I should continue.
    Thanks,
    scrabblefan
     
    scrabblefan, Mar 22, 2010
    #3
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Kestrel13!, Mar 22, 2010
    #4
  5. scrabblefan

    scrabblefan Private E-2

    I am sorry but I do not see a file called hosts. I am so sorry I am such a novice. Could you please direct me further.
    scrabblefan
     
    scrabblefan, Mar 22, 2010
    #5
  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Take your time and read the information in the link I provided:

    To reset the hosts file back to the default, follow these steps:

    Click Start, click Run, type %systemroot% \system32\drivers\etc and then click OK.

    Note If you are using 64 bit version of Windows, type %systemroot% \SysWOW64\drivers\etc.

    Rename the hosts file to hosts.bak.

    Create the new default hosts file. To do this, follow these steps:

    • Right-click an open space in the %WinDir%\system32\drivers\etc folder, point to New, click Text Document, type hosts, and then press ENTER.
    • Click Yes to confirm that the file name extension will not be txt.
    • Open the new created hosts file in a text editor, for example, in the Notepad.
    • Copy the following text to the file:

    For Windows XP or Windows Server 2003

    Save and close the file.
     
    Kestrel13!, Mar 22, 2010
    #6
  7. scrabblefan

    scrabblefan Private E-2

    I went to support.microsoft.com/default...b;en-us;972034

    I used the fix it for me button, and ran the fix it wizard, it said at the end that this microsoft fix it has been processed and needed me to restart the computer.
    Can I proceed with the combofix or do I still need to Create the new default hosts file, etc. I want to make sure before I move on. If I still need to create the new default hosts file I am still really stuck on the rename the hosts file to hosts.bak. I do not see a file called hosts file to rename? I can understand the directions from then on but cannot find the hosts file.
    thank you very much again for trying to help me
    scrabblefan
     
    scrabblefan, Mar 22, 2010
    #7
  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes you're good to continue with the combofix step now :) I should have pointed out the fix it button, my apologies.
     
    Kestrel13!, Mar 22, 2010
    #8
  9. scrabblefan

    scrabblefan Private E-2

    hi,
    the machine seems to be running ok, I do not have other languages on google either
    I sure hope it is fixed, please let me know if there are ways to help protect it. Thank you so very much.
    I have included the logs you wanted.
     

    Attached Files:

    scrabblefan, Mar 23, 2010
    #9
  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You are most welcome :)

    Your logs are clean, you can now start to follow the final steps below:

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    Kestrel13!, Mar 23, 2010
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds