Hijacked!

I have internet explorer, running on windows 7. I am being redirected to other pages that usually get blocked as dangerous by my anti virus. I have used spy bot search and destroy. It found Babylon toolbar which I was able to get rid of. I have also used spyzooka which mostly finds threatening cookies which it deletes. I have used microsoft security scan and come up with nothing. My anti virus is trend micro titanium, it scans and finds nothing. I ran hijack this, but in order to post my file, I need to rerun, I didn't save it correctly. When I downloaded Kaspersky, spyzooka and microsoft picked it up as a threat. I need help major bad. I followed the directions fto clear java cache and IE cache and ran TDSS? (TDNS?) I have avengr downloaded and ready to go if you want me to run it. Thanx KK

 

I have also run malware bytes. Here is my hijack this log.

 

Hello kksox !

Please read ALL of this message including the notes before doing anything.

Please follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide


and then attach the requested logs to your next reply when you finish these instructions.

• **** If something does not run, write down the info to explain to us later but keep on going. ****
• Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

• After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes, you could use a flash drive too, but flash drives are writeable and infections can spread to them.
3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!!!

* Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated - our system works the oldest threads FIRST.
​

 

Wow. First let me say thanx in advance for your help! This took me a long time. I think I have what you want. Check out what I have and tell me what I am missing because I am sure I have probably done something wrong. I compressed the hitmanpro file, I could not get it to attach here otherwise. If you can't open it, not sure how to save it so it opens. I am sabing it to my desktop as hitmanpro.xml. I can open it, but I cannot attch it here as a file it tells me invalid file. I will wait to hear from you. Thanx so much! KK

 

http://img225.imageshack.us/img225/760/blitzblank.gif Please download BlitzBlank to your desktop.

• Double-click BlitzBlank.exe to open (Vista/7 right-click and select Run as Administrator)
• Press OK at the warning prompt.
• Click the Script tab
• Copy the text inside the code box below and paste it into the text-field.

Code:

[COLOR="DarkRed"]DeleteFolder:[/COLOR]
c:\windows\installer\{95685d82-00b1-2ddc-542e-1409f604c4dc}
c:\users\keli\appdata\local\{95685d82-00b1-2ddc-542e-1409f604c4dc}

• Now click the Execute Now button.
• The fix will require a reboot in order to complete successfully.
• Upon reboot, locate C:\blitzblank.log and attach this log to your next message. (How to attach)

 

After you have completed the above steps, then and only then can you proceed with the below:

http://img850.imageshack.us/img850/4746/programsandfeatureswin7.gif From Programs and Features (via Control Panel), please uninstall the below:

• Java(TM) 7 Update 1 (64-bit)
• SpyZooka

__

http://img196.imageshack.us/img196/3557/tdsskiller.gif I want you to read and follow these instructions: TDSSKiller - How to run

__

http://img205.imageshack.us/img205/1894/otl.gif Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.

Code:

[COLOR="DarkRed"]:processes[/COLOR]
killallprocesses
[COLOR="DarkRed"]:files[/COLOR]
C:\ProgramData\Tarma Installer /d
C:\Program Files (x86)\SpyZooka /d
C:\user.js /d
C:\programdata\Microsoft\Windows\DRM\install_flashplayer.exe /d
C:\Users\All Users\Microsoft\Windows\DRM\install_flashplayer.exe /d
c:\windows\installer\{95685d82-00b1-2ddc-542e-1409f604c4dc} /d
c:\users\keli\appdata\local\{95685d82-00b1-2ddc-542e-1409f604c4dc} /d
dir /s C:\Users\Keli\AppData\Local\Dell /c
C:\Users\Keli\AppData\Local\Dell /d
C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job /d
C:\Windows\tasks\SystemToolsDailyTest.job /d
C:\Windows\SysWOW64\ctrestrt.exe
C:\ProgramData\McAfee /d
C:\Program Files (x86)\Common Files\mcafee /d
[COLOR="DarkRed"]:reg[/COLOR]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Apple Computer"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[COLOR="DarkRed"]:commands[/COLOR]
[clearallrestorepoints]
[emptyjava]
[emptytemp]
[resethosts]

Now click the http://img3.imageshack.us/img3/407/otlrunfix.png button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

__

http://img17.imageshack.us/img17/3214/baticonvista7.gif Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

__

Let me know how the computer is running after you have completed these steps.

 

Problem. BlitzBlank is giving me an error message that it "failed to execute, please make sure the application was started as an adminstrator". I right clicked on the program and clicked run as administrator as directed. I can't go further until I can get past this.
KK

 

Interesting. Ok instead of using BlitzBlank, try this tool instead and afterwards try to complete the aforementioned steps in post #6

http://img194.imageshack.us/img194/4930/combofix.gif Please download and run ComboFix and attach its log.
Read these instructions on how to use it: How to use ComboFix
Do not uninstall ComboFix yet as we may need it to fix remaining malware issues.

 

I ran combofix, I can no longer get on the internet. I have an error message that says Crogram files(x86)\internet explorer\iexplore.exe illegal operation attempted on a registry key that has been marked for deletion, can't open this item it might have been moved, renamed or deleted. Do you want to remove this item yes or no.

I will wait to hear from you, do I need to system restore?
thanx KK

 

It's a bug in ComboFix. Please reboot your computer as that typically fixes it.

 

ok. Mission accompplished. I have used IE to open a bunch of different web pages I normally use, and I have no redirecting right now. Could be ok. Let me know what next, you are a lifesaver!!
thanx,

KK

 

Use Windows Explorer to find and delete the following:

• c:\users\Keli\AppData\Local\PC MightyMax 2012 <== Folder

__


Zip and attach these to your next mesage:

• c:\windows\system32\blzblk.exe
• c:\windows\system32\blzblk.dat

 

ok here it is.
KK

 

Thanks.
Those are clean I think they are just part of BlitzBlank.

__

If you are not having any other malware related problems, it is time to do our final steps:

• Any programs we had you download and/or install can be removed at this time.
• If we had you download and run ComboFix, here is how to uninstall it:
  • Press and hold the Windows key http://i1106.photobucket.com/albums/h363/debojyotidas/Windows_Logo_key.gif and then press the letter R on your keyboard.
  • This opens the Run dialog box.
  • Copy and paste the below text inside the text-field:
    • "%userprofile%\desktop\ComboFix" /uninstall
  • Now press ENTER
  • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
• You can re-enable your Disk Emulation software at this time via DeFogger.
• If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
• Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
• Now we will toggle System Restore to remove any infected system restore points.
  • Read this: How to Disable And Enable System Restore
• Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
• Be safe

 

thanx so much. I just need to make sure my system restore creates a new restore date every day in case I need to restore. This was a problem a few weeks ago when the hijaxking started. I wanted to restore to a date last month and there were none stored. How do I make sure this option is on??
thanx so much for all your patience and help.

KK

 

You're welcome.

I'm not sure if that's possible. As far as I know you can only create System Restore points manually, but usually programs like Windows Update will automatically make a restore point prior to installing the updates. Other programs will do the same before performing any notable action.

I use Erunt as that works for me. Maybe you'd like it as well.

You can get more help on this subject in the Software forum.