Search/Broswer Redirect

akilshaw904 · Oct 31, 2010

Hi, so earlier this week I my browsers started redirecting for seemingly no reason. I immediately downloaded Malwarebytes and SpybotSearch and Destroy and ran tests. Tons of infections were found, simply because I hadn't done a scan in awhile, but the problem persisted. So after browing a bit, i saw that a program called Combofix, fixed the same problem for someone else. So i downloaded and ran combofix, it ran fine, then requested a restart. It began its scan and it said that i should take no more then 10 min but could take longer, so i left it for about and hour and cam back to find that nothing had happened. I assumed it had frozen and so powered it down. after restarting and trying to run it again, these were my results. I double click combofix and when the screen comes up asking if i agree with the EULA i click yes, then it just sits there. I left it for a good 30 min and nothing happened. I also cannot open anything else while its running.

Any ideas?

Thank you very much

chaslang · Oct 31, 2010

Welcome to Major Geeks!

Please read ALL of this message including the notes before doing anything. While following the READ & RUN ME instructions below, I suggest that you skip the scan with ComboFix since you already know it has problems running for you.

First download TDSSKiller from Kaspersky to your directly onto your Desktop

Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7 do not double click on it but rather, right click and select Run As Administrartor. )

Allow the application to run if prompted by Windows or any security programs you have installed

It will start the scan and run rather quickly and will notify you of whether anything is found or not.

Follow the instructions to delete/quarantine if asks you what to do when if finds something.

Whether an infection is found or not, a log file should be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )

Now please follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide

and attach the requested logs when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****

Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

akilshaw904 · Nov 2, 2010

Awesome, thank you for your reply. Although i had already run Malwarebytes and SpybotSeachandDestroy I reran all the tests that were recommended and I came up with the following logs.

I did some tests of my own and after running uninstalling, deleting a few registry entries relating to it, i managed to get Chrome back in working order without the google redirect. However after testing to see if it was something in the startup i restarted my computer, and the problem recurred. I also have a suspicious file in C:\Program Files\Microsoft called watermark.exe which is at the moment undeletable because it is in use. Another thing i noticed is that one svchost sometimes uses a suspiciously large amount of cpu, but then after about 5 secs goes back to utilizing a more regular amount.

Thanks again

akilshaw904 · Nov 2, 2010

Here is the last log file.

chaslang · Nov 5, 2010

Your TDDSkiller and MGtools logs are incomplete. Did you have a problem running them.

akilshaw904 said: ↑

However after testing to see if it was something in the startup i restarted my computer, and the problem recurred. I also have a suspicious file in C:\Program Files\Microsoft called watermark.exe which is at the moment undeletable because it is in use. Another thing i noticed is that one svchost sometimes uses a suspiciously large amount of cpu, but then after about 5 secs goes back to utilizing a more regular amount.
Click to expand...

Ah this is info that would have showed in MGtools if it had finished running. Sorry to give you some possible bad news. You have the latest for of a Ramnit infection. See the below info.

Ramnit infections have really become quit nasty and dangerous. We could attempt to remove it, and we have had some success in the past, but recently it has become even more trouble to remove. It is really safer to just bite the bullet and do a clean reinstall.

The problem is that the damage caused by this infection really makes a PC unreliable/untrustworthy. PE file infectors like Ramnit, Virut,.... etc can infect all executable files (DLL, EXE, SCR....and many more and also HTML). These infections can open back doors that truly may compromise your computer and your security. These backdoors could allow a remote attacker to access and instruct the infected computer to download and execute more malicious files.

In many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus or by other scanning tools. Also when disinfection is attempted, the files often become corrupted and the system may become unstable or irrepairable. The longer Ramnit remains on a computer, the more files it may infect and/or corrupt so the degree of infection can vary.

Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies the Ramnit worm using a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are a major source of system infection.

So all the above being said, and please do take serious note of the warnings, do you really wish to attempt cleaning even though the stability and security of your be cannot be guaranteed? And also note that we could spend a lot of time trying to fix it and still fail due to the number of files that have been infected. What would you like to do?
Click to expand...

akilshaw904 · Nov 5, 2010

Alright, I will reinstall in the next few days.

Thank you very much for you help

chaslang · Nov 6, 2010

You're welcome. After you reinstall, be sure to work thru the below.

How to Protect yourself from malware!

Log in or Sign up

Search/Broswer Redirect

akilshaw904 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

akilshaw904 Private E-2

Attached Files:

mbam-log-2010-11-01 (17-59-54).txt

SUPERAntiSpyware Scan Log - 11-01-2010 - 16-10-31.log

RRlog.txt

MGlogs.zip

akilshaw904 Private E-2

Attached Files:

TDSSKiller.2.4.5.1_01.11.2010_21.18.09_log.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

akilshaw904 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member