[Closed] Possible malware (Google redirects when clicked on a pag

Hi, that's the same ComboFix log

But I ran the ComboFix as you told me to…? It's a new log… or am I running the wrong ComboFix? I am using "Combo-Fix" with the script on top as you suggested. Can you please advise.

Or I didn't copy and paste the code right?

No, you did that correctly.

There was another request for you to run the MalwareBytes Program i had requested previously.

I'll give you the instructions again:

you will have to download this to another computer and transfer it via USB


Please download Malwarebytes' Anti-Malware

• Double Click mbam-setup.exe to install the application.
• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

I actually downloaded Malwarebytes from my laptop and transferred via USB to my desktop. Then I ran this program (without internet access) as is and the log is on the previous page.

I guess I'll post the Malwarebytes log again. Malwarebytes' Anti-Malware 1.39 Database version: 2421 Windows 5.1.2600 Service Pack 2 7/17/2009 4:38:45 PM mbam-log-2009-07-17 (16-38-45).txt Scan type: Quick Scan Objects scanned: 120001 Time elapsed: 5 minute(s), 24 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 3 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.106,85.255.112.128 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{32addcdc-2d4d-46cd-8497-ab87ea1020a4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.106,85.255.112.128 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{c7cb79e8-28a7-4dfc-bdff-bbd20fdc80d8}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.106,85.255.112.128 -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: c:\WINDOWS\system32\PPacker.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\user\Application Data\Adobe\Manager.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Thank-you for posting the Malwarebytes log.

what is the status now as that deleted the DNS trojan. Is your internet connection restored?

If not - run the Malwarebytes program again - sometimes it takes two or three runs to clear that infection -

then try repairing the internet connection if it is not restored as follows: (if one step does not work - move on to the next step:)

If one of the steps works - please advise and don't do the other steps

step one:

if your network icon appears on the Windows taskbar, then you can repair it by right-clicking on the icon and selecting Repair.

[external image: Posted Image]

If you have no task bar icon do this:

• Click on the Start button.
• Click on the Settings menu option.
• Click on the Control Panel option.
• When the Control Panel opens, double-click on the Network Connections icon. If your Control Panel is set to Category View, then double-click on Network and Internet Connections and then click on Network Connections at the bottom.
• You will now see a list of available network connections. Locate the connection for your Wireless or Lan adapter and right-click on it.
• click on the Repair menu option.

[external image: Posted Image]

Let the repair process perform its tasks


step two:

• Go to Start > Control Panel, and choose Network Connections.
• Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
• Click the Networking tab
• Double-click on the Internet Protocol (TCP/IP) item.
• Write down the settings in case you should need to change them back.
• Select the radio button that says "Obtain DNS servers automatically".
• Click OK twice to get out of the properties screen and restart your computer.
• If not prompted to reboot go ahead and reboot manually.

In I.E.

• Check internet options settings.
• Tools > Internet Options > Connections
• LAN settings
• Choose "automatically detect settings"
• uncheck both proxy settings boxes

In FireFox

• Click on Advanced -> Network -> Setttings…
• the No Proxy option should be selected

step three

Go to Start > Run then type: CMD into the run box

You will now see a black DOS-like screen.

Type the following at the command prompt:

IPconfig /release. (Note the space between the "g" and the slash / it needs to be there)

Hit enter Then type:

IPconfig /Renew (Note the space between the "g" and the slash / it needs to be there)

Hit enter


step four

• Go to Start > Run > type: cmd
• Press OK or Hit Enter.
• At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
• Hit Enter.
• You will get a confirmation that the flush was successful.
• Close the command box.

step five

ONLY if you connect to the internet via a router do this:

Let’s try to reset the router to its default configuration.

• This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router.
• Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
• If you don’t know the router's default password, you can look it up. HERE
• You also need to reconfigure any security settings you had in place prior to the reset.
• You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.

I still do not have access to the internet after the DNS trojan is deleted. I am currently running a second scan.

second scan reveals no new threats. Should I continue with repairing the connection?

yes please…hopefully one of the steps will resolve it

Sorry I have been dormant in this forum for the past 5 days or so. I've been mad busy with other stuff and have not been able to do the steps you have instructed. I will attempt those steps tonight and will report back to you by tomorrow morning (hopefully). Thank you for your patience and understanding.

Hi there, sorry for the really late attempt. I just tried step one on my desktop PC and it didn't work. The response I got was: "TCP/IP is not enabled for this connection. Cannot proceed".

Try this

Press Start > Run type CMD in the open run box to open a command prompt.

To reset WINSOCK entries to installation defaults, at the command prompt type: netsh winsock reset catalog (hit enter)

then to reset TCP/IP stack to installation defaults, at the command prompt type: netsh int ip reset reset.log (hit enter)

Reboot the machine.

NEXT

Go into Device Manager

Press Start > Run type devmgmt.msc into the open run box

under Network adapters. are there any devices with error codes anywhere in Device Manager?

you may be missing the drivers for your NIC

Hi there, I am finally back…. and for some reason (without me doing the winsock step), the link/act and power lights have come back on by themselves on my adapter. However do you think I should still run a scan of some sort to double-check? Also I am getting the frozen "Windows is starting up" every so often when I am about to log in to my computer, forcing me to manual reboot. It must have to do something with the behaviour of the startup of Windows. But every time I manually reboot I have to shut it down manually, power off the fan and wait for a bit and then turn out again. That's when I can start (in most cases, you never know) logging in. Thanks.