Trojans + Google Hijacked

AGator · Feb 22, 2009

As of yesterday, my machine got swarmed with trojans. McAfee detected some (vundo, vundo.gen.y), super-anti-spyware found others (seneka), and spybot found more. I followed the whole Readme+Run instructions but the problem is actually worse now--google searches are often hijacked to sites that include: the cow survey, internet security, some porn-youtube variant, among others.
Vundofix found nothing, but super-antispyware still detects seneka.

Thanks for your help!

AGator · Feb 22, 2009

And here's the MGTools log...

Thanks again...

TimW · Feb 23, 2009

Did you install this:
C:\COMSOL33

Please use windows explorer to find and delete:
c:\windows\system32\XRZKRLAI.DLL

Then use add/remove programs to uninstall:
Viewpoint Media Player

Your MBAM log indicates that you did not fix what it found.

Are these redirects happening with FF or IE or both?

AGator · Feb 23, 2009

I installed Comsol; it's a physics modeling program. I deleted Viewpoint Media Player, but when I went to delete that .dll file, I got an error that it couldn't be deleted, "access is denied." Should I try to do that in safe mode?

The redirects are only happening in Firefox, but when I test IE (by doing an arbitrary google search and clicking through some results) at about the 7th or 8th one, IE gives an error message that it has to close, crashes, and has subsequent error messages saying the memory at '0x02b50479' called memory at '0x02c021ec' that couldn't be read. I don't know if that's a separate problem; I don't use IE regularly.

I may have printed the MBAM log before fixing things; should I run it again?

Thanks so much.

AGator · Feb 23, 2009

Hi, sorry to reply again, I know I'm not supposed to do that--I found that the XRZKRLAI.DLL file was tied to spoolsv.exe, and my printer isn't even connected, so I stopped the spoolsv process, and then I was able to delete the .dll file.

After that, I ran MBAM and Super AntiSpyware and Hijack This again, and all three found nothing suspicious, so I restarted the computer, but google searches are still hijacked.

TimW · Feb 23, 2009

Please follow the instructions here:
Using GooRedFix

AGator · Feb 23, 2009

I ran the diagnostic, and it found a file, so I fixed it, deleted all my temporary internet files and cookies, and restarted. It seems to be working fine now! Thank you. I'm attaching my logfile.

TimW · Feb 24, 2009

Yep....that would do it.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Trojans + Google Hijacked

AGator Private E-2

Attached Files:

SAS.log

MAM.txt

combofix.txt

AGator Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

AGator Private E-2

AGator Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

AGator Private E-2

Attached Files:

GooredLog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member