Redirecting/opening new tabs - logs included

Locaj · Sep 13, 2012

Hi,

Around week ago I noticed new tabs popping up. Mostly ad sites.
It started after certain type of browsing

I followed Sticky Fixing Google.... I followed Read and Run First.
I followed all steps including disabling virtual disks and all possible instructions.

Only point I skipped was uploading files to cloud by Hitman, it would take several hours, not possible in my case. File I canceled was FileSearchEX - GOFF Concepts. Zip package and installation file. Downloaded from official website.

Attaching all logs created during Read and Run me First (not Fixing Google Redirection)

Could you please help locate problem.

Many thanks

Regards

Kestrel13! · Sep 14, 2012

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these 4 detections:

[STARTUP][BLACKLIST DLL] ctfmon.lnk @Locaj : C:\Windows\System32\rundll32.exe|C:\Users\Locaj\AppData\Local\Temp\wgsdgsdgdsgsd.exe,FQ10 -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-3101609260-623253318-1740216395-1000\$83006d5385235180a874b95eefc4d634\n.) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$83006d5385235180a874b95eefc4d634\n.) -> FOUND

[HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$83006d5385235180a874b95eefc4d634\n.) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.

And the same for the Files/Folder tab please with the below.

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND

[ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-18\$83006d5385235180a874b95eefc4d634\n --> FOUND

[ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-21-3101609260-623253318-1740216395-1000\$83006d5385235180a874b95eefc4d634\n --> FOUND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$83006d5385235180a874b95eefc4d634\@ --> FOUND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-3101609260-623253318-1740216395-1000\$83006d5385235180a874b95eefc4d634\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$83006d5385235180a874b95eefc4d634\U --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-3101609260-623253318-1740216395-1000\$83006d5385235180a874b95eefc4d634\U --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$83006d5385235180a874b95eefc4d634\L --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-3101609260-623253318-1740216395-1000\$83006d5385235180a874b95eefc4d634\L --> FOUND

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Reboot the machine.

Re run HitmanPro, no fixing anything, just a scan and attach log.

Re run RogueKiller - no fix just a scan. Attach log.

We need to sort out some of your services, and your firewall may be broken, but I want to make sure the malware is gone first.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Locaj · Sep 14, 2012

Thank you for your quick reply!

I cant find:

[STARTUP][BLACKLIST DLL] ctfmon.lnk @Locaj : C:\Windows\System32\rundll32.exe|C:\Users\Locaj\AppData\Local\Temp\wgsdgsdgdsgsd.exe,FQ10 -> FOUND

Probably MBAM removed after I ran RougeKiller during initial process.
After I did Registry tab RK crashed.
I ran several times (hence [8])and found no files at all in Files tab.

After restart done reports.
Please see attached

I have to admit I have been playing with services.

Thank you for your help

/e Just in case attached early rk logs

Kestrel13! · Sep 14, 2012

Keygens and cracks and other illegal software is a great way to invite in infection!

Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these 3 detections:

[TASK][PREVRUN] ParetoLogic Registration.job : C:\Windows\System32\rundll32.exe -> FOUND

[TASK][PREVRUN] ParetoLogic Registration : C:\Windows\System32\rundll32.exe -> FOUND

[TASK][PREVRUN] ProgramDataUpdater : C:\Windows\System32\rundll32.exe -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[9].txt
Attach RKreport[9].txt to your next message. (How to attach)
Do not reboot your computer yet.

Delete the below unless you know what they are for

C:\ProgramData\dsgsdgdsgdsgw.pad
C:\Windows\SysWOW64\9B13A86D.plf

Delete this folder too - C:\ProgramData\ParetoLogic

Now this next part takes a long time, so go away and do something else whilst it runs.

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)

Now select the Start Repairs tab.

The click the Start button.

Create a System Restore point if prompted.

On the next screen, click the Unselect All button to first deselect all repairs.

Now select the following repair options:

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Proxy Settings

Repair Windows Updates

Set Windows Services To Default Startup

Now on the lower right side check the box to Restart/Shutdown System When Finished

Then make sure the Restart System radio button is enabled.

Shutdown any other programs that you are running now before continuing.

Now click the Start button.

Be patient while the tool repairs the selected items.

It should reboot automatically when finished.

After reboot, check to see if your firewall is working.

Now go to start > type in services.msc and hit ENTER.
Scroll down to the Background Intelligent Transfer Service if it shows and let me know its status and start up type please.

Locaj · Sep 15, 2012

Thank you again for your help and time.

Set Msconfig to normal start.
Did RK and removed 3 entries.
After that my system had reboot (I know why and its not dangerous, its mouse driver fault razerhid.exe) so system was restarted =-/

Deleted 2 files and folder, ran Windows repair with options you said.
After restart tried to locate Background Intelligent Transfer svc but I don't have that for some reason (please see attached screen).
From what I read its quite important service, Is there way to get it back?

RK log is 15 as after my post yesterday I ran RK several times but only scanned, didn't take any actions.
Firewall is working fine now.

So only problem now is missing one service (does that happen often?).

Thank you

Kestrel13! · Sep 15, 2012

Download bits.zip to your desktop. Unzip it and extract the BITS.reg

Now please click Start, and type regedit into the search box.

You should see a regedit.exe and icon appear in the Programs area of the Start Menu.

Right click on regedit.exe and select Run As Administrator

Then in the Registry Editor menu click File and select Import.

Navigate to the BITS.reg file saved to your Desktop and double click it. Allow it to be added to the registry.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Locaj · Sep 16, 2012

Thank for this service. Its on the list now and working fine.
Please see attached MGlogs.

Thank you so much.

Kestrel13! · Sep 16, 2012

You are most welcome. Everything else running nicely?

Locaj · Sep 16, 2012

Everything is great!

Thank you for your help.

Many, many thanks

Kestrel13! · Sep 16, 2012

Safe surfing!

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Redirecting/opening new tabs - logs included

Locaj Private E-2

Attached Files:

RKreport[1].txt

mbam-log-2012-09-13 (20-45-42).txt

TDSSKiller.2.8.8.0_13.09.2012_20.49.34_log.txt

HitmanPro_20120913_2100.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Locaj Private E-2

Attached Files:

RKreport[8].txt

HitmanPro_20120914_2105.log

MGlogs.zip

RKreport[2].txt

RKreport[3].txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Locaj Private E-2

Attached Files:

RKreport[15].txt

backgr.png

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Locaj Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Locaj Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member