[Closed] Possible malware (Google redirects when clicked on a pag

Hi,

Please do the following:

Open Notepad

Click Start >Run type notepad into the run box click OK
Click Format and make certain that Word Wrap is NOT checked.

Copy the text inside of the code box, press Ctrl+C (or right click on the highlighted section and choose 'copy')

Now paste the copied text into the open notepad. press CTRL+V (or right click and choose 'paste')

Note: There must be NO blank lines in front of the pasted text, but ensure that there is a blank line at the end of the text, otherwise the registry merge will not work.

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"NameServer"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{32ADDCDC-2D4D-46CD-8497-AB87EA1020A4}]
"NameServer"=-

Now go to File > and click Save As,
From the drop down menu at the top of the box choose Desktop as the location to save this file.
Go down to the File Name box and type in fixme.reg as the file name, then choose All Files as the save as file type.
Then click the save button.
Once you have clicked the save button, close Notepad.

You should now see a file on your desktop that looks like this:

[external image: Posted Image]

Locate the fixme.reg icon on your desktop and double click it, an information box will pop up asking if you want to merge the information in the file into the registry, click YES.

Once the file has run, the information will have merged with your registry so you can delete fixme.reg from your desktop as you won't be needing it any more.

Please run this reg Fix.

Then flush your DNS

• Go to Start > Run > type: cmd
• Press OK or Hit Enter.
• At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
• Hit Enter.
• You will get a confirmation that the flush was successful.
• Close the command box.

Next:

Please reset IE

• Go to Start > Control Panel, and choose Network Connections.
• Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
• Click the Networking tab
• Double-click on the Internet Protocol (TCP/IP) item.
• Write down the settings in case you should need to change them back.
• Select the radio button that says "Obtain DNS servers automatically".
• Click OK twice to get out of the properties screen and restart your computer.
• If not prompted to reboot go ahead and reboot manually.

In I.E.

• Check internet options settings.
• Tools > Internet Options > Connections
• LAN settings
• Choose "automatically detect settings"
• uncheck both proxy settings boxes

In FireFox

• Click on Advanced -> Network -> Setttings…
• the No Proxy option should be selected

NEXT

Check after to see if you can access the internet to download and run this program: If not, again try to burn it to CD and run it in safe mode.

Download Combofix from either of the links below. You must rename it before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  
• Tools->Options->Main tab
• Set to "Always ask me where to Save the files".

Link 1
Link 2

During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]
——————————————————————–

• It is important you rename Combofix during the download, but not after.
• Please do not rename Combofix to other names, but only to the one indicated.

———————————————————–

• Double click on Combo-Fix.exe & follow the prompts.
  
  • When finished, it will produce a report for you.
  • Please post the "C:\Combo-Fix.txt" for further review.
  **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**
  
  

  ———————————————————–

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  ———————————————————–

When I was doing the flush the DNS and then reboot, I checked that it was same Internet Protocol IP TCIP settings from the first time you asked me to flush the DNS. But when I rebooted manually (there were no messages telling me to restart) I'm getting a really LONG "Windows is shutting down" message. It seems as if it's frozen and not moving. It's been at least 2 minutes that this message is still here and I am not getting any response STILL. Your help please? Thank you.

Still not shutting down………..

Hi, give it a hard reboot (hold down the power button for as long as you need to to shut down) wait a few minutes, then power back up…see if it will boot up into normal mode. If not boot into safe mode with networking and see if you can connect.

Hi, give it a hard reboot (hold down the power button for as long as you need to to shut down)

wait a few minutes, then power back up…see if it will boot up into normal mode. If not boot into safe mode with networking and see if you can connect.

I have a problem connecting to the internet in normal mode: it doesn't connect (since I have a Linksys wireless adapter there is no Power OR Link/Act lights showing up), nor can I find the internet connections box on the lower right hand side. I have a Linksys Monitor box that manages connections, it opens when I clicked it but I cannot click on the tabs that have "connect" and "profiles" ( the preset connection networks that one saves for easy use).

Hi,

Please do the following:

Open Notepad

Click Start >Run type notepad into the run box click OK
Click Format and make certain that Word Wrap is NOT checked.

Copy the text inside of the code box, press Ctrl+C (or right click on the highlighted section and choose 'copy')

Now paste the copied text into the open notepad. press CTRL+V (or right click and choose 'paste')

Note: There must be NO blank lines in front of the pasted text, but ensure that there is a blank line at the end of the text, otherwise the registry merge will not work.

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"NameServer"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{32ADDCDC-2D4D-46CD-8497-AB87EA1020A4}]
"NameServer"=-

Now go to File > and click Save As,
From the drop down menu at the top of the box choose Desktop as the location to save this file.
Go down to the File Name box and type in fixme.reg as the file name, then choose All Files as the save as file type.
Then click the save button.
Once you have clicked the save button, close Notepad.

You should now see a file on your desktop that looks like this:

[external image: Posted Image]

Locate the fixme.reg icon on your desktop and double click it, an information box will pop up asking if you want to merge the information in the file into the registry, click YES.

Once the file has run, the information will have merged with your registry so you can delete fixme.reg from your desktop as you won't be needing it any more.

Please run this reg Fix.

Then flush your DNS

• Go to Start > Run > type: cmd
• Press OK or Hit Enter.
• At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
• Hit Enter.
• You will get a confirmation that the flush was successful.
• Close the command box.

Next:

Please reset IE

• Go to Start > Control Panel, and choose Network Connections.
• Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
• Click the Networking tab
• Double-click on the Internet Protocol (TCP/IP) item.
• Write down the settings in case you should need to change them back.
• Select the radio button that says "Obtain DNS servers automatically".
• Click OK twice to get out of the properties screen and restart your computer.
• If not prompted to reboot go ahead and reboot manually.

In I.E.

• Check internet options settings.
• Tools > Internet Options > Connections
• LAN settings
• Choose "automatically detect settings"
• uncheck both proxy settings boxes

In FireFox

• Click on Advanced -> Network -> Setttings…
• the No Proxy option should be selected

NEXT

Check after to see if you can access the internet to download and run this program: If not, again try to burn it to CD and run it in safe mode.

Download Combofix from either of the links below. You must rename it before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  
• Tools->Options->Main tab
• Set to "Always ask me where to Save the files".

Link 1
Link 2

During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]
——————————————————————–

• It is important you rename Combofix during the download, but not after.
• Please do not rename Combofix to other names, but only to the one indicated.

———————————————————–

• Double click on Combo-Fix.exe & follow the prompts.
  
  • When finished, it will produce a report for you.
  • Please post the "C:\Combo-Fix.txt" for further review.
  **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**
  
  

  ———————————————————–

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  ———————————————————–

Since I use Vista and Firefox on my laptop. I do not have the option to rename the file during download, I only have the option to either open or download it. The file is automatically saved in to my "Downloads" folder in Vista. What should I do here?

If you are using Firefox, make sure that your download settings are as follows: * Tools->Options->Main tab * Set to "Always ask me where to Save the files".

I have a problem connecting to the internet in normal mode: it doesn't connect (since I have a Linksys wireless adapter there is no Power OR Link/Act lights showing up), nor can I find the internet connections box on the lower right hand side. I have a Linksys Monitor box that manages connections, it opens when I clicked it but I cannot click on the tabs that have "connect" and "profiles" ( the preset connection networks that one saves for easy use).

Hi,

Try this

Start, Programs\Accessories and right click on Command Prompt, select "Run as Administrator" to open a command prompt.

In the command prompt window that opens, type type the following commands:

netsh winsock reset catalog (hit enter)

netsh int ipv4 reset reset.log (hit enter)

netsh int ipv6 reset reset.log (hit enter)

Reboot the machine.


If this doesn't get the connection back, please start a new thread in out Internet forum - the expert tech's there are much better at connection issues that I am. Once you are back connected, come back here and we can continue to clean the machine.


Link to this topic so they can see what has been going on and the steps we've already tried.

I take it you couldn't get ComboFix to run from disk?

Hi,

Try this

Start, Programs\Accessories and right click on Command Prompt, select "Run as Administrator" to open a command prompt.

In the command prompt window that opens, type type the following commands:

netsh winsock reset catalog (hit enter)

netsh int ipv4 reset reset.log (hit enter)

netsh int ipv6 reset reset.log (hit enter)

Reboot the machine.


If this doesn't get the connection back, please start a new thread in out Internet forum - the expert tech's there are much better at connection issues that I am. Once you are back connected, come back here and we can continue to clean the machine.


Link to this topic so they can see what has been going on and the steps we've already tried.

I take it you couldn't get ComboFix to run from disk?

I am able to run ComboFix to run from a CD but in safe mode only. However I could not find a way to disable AVG Free 8.0 before running ComboFix since it does not have the Control Centre as mentioned in the "How to Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs" article. Is there a manual way of doing this..? A task manager process name perhaps?

you could try uninstalling then reinstalling AVG once we're done… running CF may clean up the connection issue as it's likely malware interfering> If you don't see avg in the process list of task manager when you go into safe mode, run CF - it should be OK

Hi,

Try this

Start, Programs\Accessories and right click on Command Prompt, select "Run as Administrator" to open a command prompt.

In the command prompt window that opens, type type the following commands:

netsh winsock reset catalog (hit enter)

netsh int ipv4 reset reset.log (hit enter)

netsh int ipv6 reset reset.log (hit enter)

Reboot the machine.


If this doesn't get the connection back, please start a new thread in out Internet forum - the expert tech's there are much better at connection issues that I am. Once you are back connected, come back here and we can continue to clean the machine.


Link to this topic so they can see what has been going on and the steps we've already tried.

I take it you couldn't get ComboFix to run from disk?

I have a problem while typing the command netsh int ipv4 reset reset.log. The response I got was "The following command was not found: int ipv4 reset reset.log". Aack I'm stuck! :(.

Ok…reboot, try running ComboFix in safe mode (please don't quote my posts…just add reply - with the screen resolution I have it's hard on my eyes - cheers)

you could try uninstalling then reinstalling AVG once we're done… running CF may clean up the connection issue as it's likely malware interfering>

If you don't see avg in the process list of task manager when you go into safe mode, run CF - it should be OK

I tried uninstalling AVG too but I got an error on that– "Uninstall failed". It then says:

Local machine: installation failed
Installation:
Error: Action failed for registry key HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Windows: creating registry….
Error 0x80070005

My only option was to close.

Sorry for the quotes. Just trying to be cooperative and elaborative as much as I can.