Google redirect virus - Windows XP

Thank you for your time!

My problems started Sat. 09/10/10. 18yr old son used my computer, but of course did nothing (cough). I shortly there after Googled something, clicked a result and was redirected to another search engine. Click back button to return to Google to try again and was instead taken to the originally intended web page. Repeated this several times with different search quires. Verified 100% reproducible.

Also confirmed these results with Opera, Google Chrome, Safari, FireFox and Opera. (I develop websites).

Ran pre-existing AVG, tried updating, would not update.

DL Ad-Aware, installed, executed, would not update.

DL Spybot and RBAM. Both installed but will not execute.

Found this entry in my Services…
Service Name: Bonjour Service
Display Name: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##
Description: ##Id_String2.6844F930_1628_4223_B5CC_5BB94B879762##
Path to executable: "C:\Program Files\Bonjour\mDNSResponder.exe"
… Disabled it.

This allowed me to update and run both AVG and Ad-Aware. Still could not execute Spybot or RBAM. Both running software found and removed minor threats.

Google issue still exists. Found this website. Read and very meticulously followed all instructions provided in “READ & RUN ME FIRST” including all instructions provided with each of the 5 removal tools. All tools were downloaded on a non-infected system and transferred to the infected system with a USB memory stick.

As to your instructions my results are as follows…

SuperAntiSpyware – Downloaded and installed, will not run. Tried to obtain the stand alone version. It is not available, tried from 3 different computers and even another network. Starts to download at less the 1kb/s but eventually times out.

RBAM – Downloaded, renamed the downloaded mbam-setup.exe file to mb.exe and installed. – Will not run.

ComboFix – Saved to desktop, will not start.

RootRepeal – Saved to desktop, executed, log file attached.

MB Tools – Saved to desktop, executed, Zip file attached.

Sorry for the long post but thought it better to provide all the information I possibly could for both my and your benefits.

Sincere regards and thanks,
Jeff

 

My Log files.

 

Tim,
Thank you for your time. It is very kind of you to help others.

C:\WINDOWS\Tasks\Nkakxs.job
C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job

Neither file was initially visible in the directory. “Show hidden files” was selected in folder options, confirmed. Under the “advanced” bar “show hidden tasks” was available. “Hidden tasks” revealed {22116563-108C-42c0-A7CE-60161B75E508}.job only. Deleted.

To confirm, and also with “show hidden files” selected I scanned the entire drive for Nkakxs.job. 0 files found.

C:\Windows\temp\
9995 files and folders found. 9994 deleted (I haven’t been using this system since this discovering this issue). Remaining file: Perflib_Perfdata_69c.dat (in use).

C:\Documents and Settings\Admin\Local Settings\Temp\
760 found, all but Perflib_Perfdata_f3c.dat (file in use) deleted.

TDSSKiller, executed normally without requiring renaming. The first reboot failed, login and desktop loaded, mouse and keyboard remained active but the taskbar failed to become active. Gave it 30 minutes and was able to soft boot the system with task manager. Subsequent restart loaded normally. Aside from copying the TDSSKiller log to a USB memory stick, I have performed no other actions on the system. I will wait for your instructions.

Your efforts are appreciated,
Thank You.

 

Although at first look things seemed to be improving. I tried several Google searches and was not redirected. However another troubling issue has developed.

As a precaution I disabled my network connection to prevent the system from communicating with the Internet or my other systems. When I went to enable it in “Network Connection” a new connection was present, active and transferring packets.

So I’m only used to seeing just the one connection:
LAN or High-Speed Internet
Local Area Connection
Connected
Realtek PCI Fast Ethernet NIC

I am now also seeing:
Internet Gateway
Internet Connection
Connected
Internet Connection

The properties for this connection says it is for sharing an Internet connection connected to another computer. It had been connected since yesterday.

I tried several times to disable this new connection but it re-enables itself within 5 seconds. I also tried to delete this connection and was presented with message box stating that the connection cannot be deleted. When I took the next precaution and simply disconnected the CAT5 cable from my switch this new connection disappeared on its own. Just to double check I plugged the cable back in and sure enough it was back. So at this point I’ve left the cable disconnected. And yes it did disappear again when I did.

The log file is attached.

Again, Thank you.

 

I'm still not able to disable this new connection and it is active despite that I have nothing running that would be connecting to the Internet. I've gone through the properties and everything is blank.

I do use a router and a switch. The router is my gateway for all my systems.

I am now able to run ComboFix and I've attached the log.

 

Hi Tim,

Just an update on that mystery network connection. It was talking so much it was driving me crazy. I’m pretty handy with services and the registry so I tackled that and I was able to finally get rid of it. And my regular connection is dead quiet for now.

 

Tim,

Everything seems to be humming along beautifully. Thank you again for taking your time to help me. I appreciate all that you have done to assist me!

I will work through the clean up process.

Cheers