Web redirector/AVG update blocked

hugh90 · Jun 4, 2009

Hi guys, was recommended to post here by guys on the AVG free forum. I had already undertaken their reommended removal instructions to no avail, which involved updating everything and then -

Running AVG scan.
Run Malware Bytes Scan.
Run Spybot S&D scan.

Repeated above in safe mode.

Have now performed the initial steps outlined by you guys. Please see the attached logs.

Symtoms -

When using internet explorer and Firefox search engine results are redirected maybe 1 time out of every 5 to spam/scareware type sites. This happens on multiple search engines (have tried google and yahoo).

When I try to update my AVG free 8.5 software using the interface the update hangs forever, with no error message.

I am occassionally seeing "Connection interupted" type messages in browsers.

Other steps performed -

Have verified it's not my ADSL router, by switching it out with another.

Have also verified that other machines on my network don't have the same problem.

Any help would be great as I've been struggling with this one for a few days now!

TimW · Jun 6, 2009

Lets just start by having you use windows explorer to find and delete:
c:\windows\system32\2435038701.dat

Reboot and run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

hugh90 · Jun 8, 2009

Hi, many thanks for helping out - I know you guys are swamped at the moment.

Deleted the file you requested. New logs attached.

TimW · Jun 9, 2009

I am not seeing anything that might be related, though we can remove a few things and see it that helps. I assume that you have cleaned out your internet temp files and cleared the cache in FF.

Now download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop
* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\Documents and Settings\Hugh\Local Settings\Application Data\zHttzuBwWhfXJe
C:\Documents and Settings\Hugh\Local Settings\temp\h2r177.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\h2r17a.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\pil185.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\pil188.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\PLUGTMP
C:\Documents and Settings\Hugh\Local Settings\temp\plugtmp-1
C:\Documents and Settings\Hugh\Local Settings\temp\plugtmp-2
C:\Documents and Settings\Hugh\Local Settings\temp\plugtmp-3
C:\Documents and Settings\Hugh\Local Settings\temp\ptm186.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\ptm189.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\r2h176.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\r2h179.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\svc1i.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\t15187.tmp
C:\Documents and Settings\Hugh\Local Settings\temp\t1518a.tmp

Folders to delete:
C:\Documents and Settings\Hugh\Local Settings\Application Data\zHttzuBwWhfXJe
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
-
Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

hugh90 · Jun 9, 2009

Ok, here's the actions I took -

* Ran avenger as per your instructions, but there was a couple of issues in the resulting log, see attachment "avenger.txt".
* So then I modified the quote you gave to try and address these issues and ran avenger again. See "new quote.txt" for the new commands I gave to avenger.
* "avenger2.txt" attachment contains the results of this second run.
* I then ran CCleaner as per your instructions. However, I wasn't sure exactly what you meant by temp files so I selected both Internet Explorer -> Temporary Internet Files and System -> Temporary Files. Hope that's ok.
* I also had a look in Local Settings\temp myself and deleted a few other left overs ending in .tmp.
* I then manually updated AVG and ran a full scan. Nothing found.
* Updated Malware Bytes and ran a full scan. Nothing found.
(I did these two steps because I haven't for a few days and was hoping the updated versions would solve the problem)
* Final step was to run the GetLogs.bat, the results of which are attached.

The problem remains the same as before.

Only other thing I noticed is that as I was typing this up I still had the Local Settings\temp folder open and a couple of new files had appeared which aren't in the logs. Might just be innocent firefox related stuff but thought I'd mention it in case it's useful -

~DF1160.tmp (16KB)
etilqs_hoBmRpA1ldgFQXsTYkXd (0KB and greyed out/hidden)

Many thanks for your continued help

hugh90 · Jun 9, 2009

Ok, I apologise for the bump but the two files mentioned in my last post disappeared as soon as I closed firefox. When I open firefox again the files reappear.

Similarly, if I open internet explorer I get about 8 .tmp files that appear that also disappear as soon as IE is closed.

My guess is that this is normal browser behaviour, but just providing the info in case it's relevant.

Cheers.

TimW · Jun 9, 2009

Ru this:
Using Google Redirects.

hugh90 · Jun 10, 2009

Attached GooredLog from running option 1 only.

TimW · Jun 12, 2009

Now run the second option.

hugh90 · Jun 12, 2009

No effect from running the second option...

Thanks for your continued efforts, any other advice would be greatly welcomed before I reinstall windows.

hugh90 · Jun 12, 2009

I know you're all busy etc., but its fairly clear to me that I have something that is pretty new and undetected by most, if not all, anti-virus software etc.

I would expect pros in this industry to be jumping all over something like this, but no, it's fairly quiet and more pcs are probably getting compromised every minute...

It might be more effective imo if your advice threads basically just said - REFORMAT NOW, otherwise you're just encouraging infected systems to remain for days or weeks online while your volunteers try and solve the problem. Is that really the most effective way of dealing with this shit??

TimW · Jun 16, 2009

I apologize for the delay.....my isp took a 5 day dump.

We are finding new rootkits that are difficult to remove.....please run this>
RootRepeal

When scan has completed there will be a list of files generated.Some will be ok(legitimate files) but the bulk will be related to the Rootkit and it's hidden payload of files. Attach that log please.

hugh90 · Jun 17, 2009

Good to see you back, Tim!

Three logs attached - "rootkit repealer" was obtained from running the Scan from the "Report" tab. When the process had finished there was an error window open with the text in the "error log.txt" showing. Note that I had firefox running during the scan - the first time when I did a file scan only I didn't and that is also attached as "files.txt". However I also had an identical error window and error text that time as well.

My E: drive is a USB external hard-drive, and I suspect that the problems with the files on there are false positives - I have had some corrupt mp3s on there for a while.

hugh90 · Jun 17, 2009

Apologies for bumping but there's been a bit of a development. Not sure how but AVG seems to have updated itself recently (rather than hanging like it usually does). The virus DB is now version 270.12.76.2183 and it is reporting detection of a Win32/Patched virus when I do almost anything internet related. Makes sense as the infected file appears to be system32/ws2_32.dll which is some kind of socket library.

This might also explain why it is able to redirect searches from multiple search engines etc.

I quick online scan of the file at www.virustotal.com also gets the following hits -

BitDefender 7.2 2009.06.17 Trojan.Patched.EM
GData 19 2009.06.17 Trojan.Patched.EM
McAfee-GW-Edition 6.7.6 2009.06.17 Virus.Win32.FileInfector.gen!90 (suspicious)
Sophos 4.42.0 2009.06.17 Mal/WSHack-A

Now since this is a system file and there may still be other rootkit stuff at play I've not taken any action, but hopefully this might help in some way for figuring out the next steps.

Cheers!

TimW · Jun 19, 2009

You are right in that you do not want to just remove the system files. You have three options at this point:

1) go to start / run / type: sfc /scannow and have your xp cd handy. Run it twice.

2) if that fails to help, see if you can do a system restore to a point before this all occcured.

3) if that is not an option, then try doing a repair installation.

What we are aiming at is to restore the clean copy of the system files back to your computer. So let me know the outcome of this.

hugh90 · Jun 22, 2009

Looking good for now - ran the sfc /scannow twice as you suggested and am now no longer seeing the redirect issues. AVG is also updating fine and not reporting the stuff it was before.

Many thanks for your help, Tim

TimW · Jun 23, 2009

Good to know. If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Web redirector/AVG update blocked

hugh90 Private E-2

Attached Files:

ComboFix.txt

mbam-log-2009-06-04 (12-05-14).txt

MGlogs.zip

SUPERAntiSpyware Scan Log - 06-04-2009 - 14-06-04.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hugh90 Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hugh90 Private E-2

Attached Files:

avenger.txt

new quote.txt

avenger 2.txt

MGlogs.zip

hugh90 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hugh90 Private E-2

Attached Files:

GooredLog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hugh90 Private E-2

hugh90 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hugh90 Private E-2

Attached Files:

rootkit repealer.txt

error log.txt

files.txt

hugh90 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

hugh90 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member