Redirect malware

KenB2014 · Feb 17, 2013

My son had redirect malware and attempted to remove it himself with various programs. It did improve operation, but left some problems with IE9. I talked him through doing a repair using Windows Repair by Tweaking.com to try to get everything working. He was still having some issues.

I got his computer and ran through all your steps.
All logs are attached.

Google Crome works normally.

IE9 seems to work ok now if protected mode is OFF. With protected mode ON to the default settings, it will not load, even on Majorgeeks.com.

Never seen this but it takes multiple attempts, double clicking a folder on the desktop to get the folder to open. Right click and open, always opens it.

Thanks

Kestrel13! · Feb 18, 2013

So just to clarify, only Internet Explorer redirects? Where does it redirect to?

KenB2014 · Feb 18, 2013

KenB2014 said: ↑

IE9 seems to work ok now if protected mode is OFF. With protected mode ON to the default settings, it will not load, even on Majorgeeks.com.
Click to expand...

Google Chrome was never redirecting.
Internet Explorer was redirecting. By the time I got the computer, the redirect problem was almost resolved. I did not see where it was redirecting, but it did stop after the Windows Repair and IE Fix-it repair from MS, and then running all the MG steps that resulted in the attached logs. The problem with not being able to turn Protected Mode ON was corrected by reinstalling IE9 and running Windows Repair again.

At this point, I think I have the computer running correctly with no redirects and no issues thanks to the good guides and tools.

Do you see any remnants of the malware or potential issues in the logs that we need to remove or correct? Other than that, I think I have it running well.

Never seen this but it takes multiple attempts, double clicking a folder on the desktop to get the folder to open. Right click and open, always opens it.
Click to expand...

Disregard the desktop folder icon problem...It was an issue with the mouse and double click settings set to require too fast a double click.

Thanks!

Kestrel13! · Feb 18, 2013

Naw, the logs look good.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Press and hold the Windows key http://forums.majorgeeks.com/chaslang/images/Windows_Logo_key.gif and then press the letter R on your keyboard. This opens the Run dialog box.

Copy and paste the below into the Run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Redirect malware

KenB2014 Private First Class

Attached Files:

RKreport[1]_S_02172013_02d1156.txt

mbam-log-2013-02-17 (12-04-37) - Copy.txt

TDSSKiller.2.8.16.0_17.02.2013_12.15.00_log.txt

HitmanPro_20130217_1235.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

KenB2014 Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member