[Resolved] Google redirect malware, kills spybot, Malwarebytes, H

I Safe mode, the SysProt would not operate. I forgot the error, but it seemed like a process it needed to run was not runing. As I had some time, I went into the DOS Prompt from startup (wihout windows) and tried to kill the file. It would not let me delete it, but I did change the name of the .sys file. Unfortunately, I could not boot windows after that (Blue screen of death), so I had to enable the bast@rd again to open windows. So please recommend a bigger hammer. Thanks, Russ

OK lets check out your MBR before I go for the big kill

Download this tool to desktop:

http://www2.gmer.net/mbr/mbr.exe

Double click it & post the log it creates on desktop. (mbr.log)

Not much to that, it ran in about 1s, and posted the following Log info:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

Thanks,

Russ Barrow

Download Kill.pif from here

• Double click on Kill.pif to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window: 🖼Click to load external image (Posted Image)
• Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Analysis" check box.
  🖼Click to load external image (Posted Image)
• Click on the “Execute selected scripts”.
• Automatic scanning, healing and system check will be executed.
• A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
• It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
• All applications will work properly after the system restart.

When restarted

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Analysis" check box.
  🖼Click to load external image (Posted Image)
• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach both virusinfo_syscure.zip and virusinfo_syscheck.zip to your next post

To attach a file, do the following:

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on [external image: Posted Image] to insert the attachment into your post

We tried the AVZ program a couple of weeks ago, and the program got nuked by this thing. I downloaded it again, and once again, during the execute of the Healing/Quarenteen, it was terminated. I cannot run the File anymore. Thanks, Russ

Yep I know but this was a more robust version

1. Please download The Avenger2 by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All…"
• Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:

Files to delete:
c:\windows\win32k.sys:2
c:\windows\win32k.sys:1

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh Hijackthis log .

Ok, I ran the script as you had it, and the log cam back saying the files did not exist. Having attempted to delete the files in the DOS mode, this file is actually located at c:\windows\system32\win32k.sys So, I edited your script to reflect the proper location of the file. Sure enough it has deleted the file. Unfortunately, I cannot boot windows, as I get a blue screen of death during reboot. This is exactly what happened when I changed the file name in DOS. It would appear that this file is referenced as a critical windows executable and the absense of it results in a windows crash. I booted in the system recovery mode and checked for the file and it is gone (system32\win32k.sys). Now, can I replace the file with something benign of the same name to get Windows going again, or should I recover via another means. Thanks, Russ

I tried to boot in safe mode as well, and same blue screen of death. The error is: c000021a Fatal system error Initialization system process termination at location 0xc0000034 Thanks, Russ

I booted in the system recovery mode and checked for the file and it is gone (system32\win32k.sys).

Ah that was a legitimate file

If you have access to another PC running Windows XP, then we'll create a small "fix CD" to try and solve this problem.

Please download RC.ISO and save it somewhere you can find it.
Also download MagicISO and install it.

Start MagicISO. You should see a window informing you about the full version of MagicISO.
In the bottom right select Try It! and the program will open.
Click on File and then on Open and navigate to the RC.ISO file you downloaded. Select it, and click Open.

First, we'll need to add a clean version of win32k.sys to the current RC.ISO

• In the upper right pane, double click on the i386 folder.
• Right click in the upper right pane and select Add Files…
• Navigate to C:\Windows\System32 and select win32k.sys
• Then click Open to add win32k.sys to the CD image.
• Click File and select Save As…
• Name the file RCplus and save it somewhere you can find it.

Next, we'll need to burn the newly created image to a disk that we can use to fix the problem.

• Put a blank CD-R disk in your CD burner and close the tray. If an AutoPlay window opens, close it.
• Click on Tools and select Burn CD/DVD with ISO…. A window will appear.
• Click on the little folder to the right of CD/DVD Image File then navigate to the newly created RCplus.iso Image file and click Open.
• In the CD/DVD Writing Speed drop-down menu choose the 8X setting.
• Under Format make sure that Mode 1 is selected.
• And finally, click on the Burn it! button to burn RCplus.iso to disk.

Once the disk is burned, put it in the machine you want to fix and restart it.
Boot to the CD just as you would with a Windows XP disk.
At the Welcome to Setup screen, press R to enter the Recovery Console.
Choose the installation to be repaired by number (usually 1) and press Enter.
When you are asked for the Administrator password, enter the password or leave it blank (default) and press Enter.

At the C:\Windows> prompt, type the following commands pressing Enter after each one. Note the spaces in these command strings.

D:
cd i386
copy win32k.sys c:\windows\system32
exit

After putting in the third command, you should receive the message 1 file copied which will indicate that the operation succeeded.

Once you exit Recovery Console, let Windows try to load normally.

Alright, that was some scarry stuff, but I am back in business, and the Infected PC is booting again, and I am back where I started. Great instructions, I had no idea what I was doing, and you got me through it. I promise to follow you instructions to the letter from here on out. I ran the SysProt, and It still has the systemroot\win32k.sys:1 and :2 still running as hidden, and the google redirect to a random website is still there. The programs that this program nuked are still nuked. I can run the Avenger again, this time with the proper cut and paste script you had, but as mentioned before, it reported that there were no such files in the log. Thanks, and don't give up on me yet. Russ

Could you try kill.pif in safe mode - as the last one I had of these the supercharged file managed to get it

I have also had a rush of blood to the head

1. Please download The Avenger2 by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All…"
• Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:

Files to delete:
c:\windows\win32k.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply


THEN

OTS will need to be renamed to OTS.COM

To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link.

Download OTS to your Desktop

• Close ALL OTHER PROGRAMS.
• Double-click on OTS.exe to start the program.
• Check the box that says Scan All Users
• Under Additional Scans check the following:
  • File - Lop Check
  • File - Purity Scan
  • Evnt - EvtViewer (last 10)
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post.

To attach a file, do the following:

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on [external image: Posted Image] to insert the attachment into your post

Here is the results of the newest avenger:

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "c:\windows\win32k.sys" not found!
Deletion of file "c:\windows\win32k.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

I could not rename or delete the existing OTS.EXE since it still says I do not have permission. So, I downloaded the file again and saved it to the desktop as OTS1.EXE and executed it as you suggested. It crashed, same as the first time. Now it is dead and cannot be restarted. Thanks, Russ

OK I have finally found some additional information on this little beastie and I am currently working on a BFU script - however that may take a while so I will use Avenger / OTM with the extra information I have found. This is a busy fix so please be sure you are happy before commencing.


1. Please download The Avenger2 by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All…"
• Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:

Drivers to delete:
win32k.sys:2
win32k.sys:1

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply

WARNING these fixes are designed for this user only and may cause damage if run on an uninfected machine

Download and run ERUNT http://www.larshederer.homepage.t-online.de/erunt/


Start ERUNT, confirm the Welcome message.

Type in the name of a restore folder where the backed up registry
files should be saved, or click "…" to browse your computer's drives
and select a folder. You can also simply leave the default, which is a
folder named ERDNT inside your Windows folder, the advantage being
that you have access to this folder from the Windows Recovery Console
in case Windows does not boot anymore.


Next, select the backup options:

- System registry:

- Current user registy: .

- Other open user registries:

Click "OK" and wait until the backup process is complete. (Note that
depending on your system configuration this may take some time, and
that the first bar is NOT a progress bar, just an indicator that the
program is still running.) The ERDNT program for later restoration of
the registry is automatically copied to the restore folder.

WARNING these fixes are designed for this user only and may cause damage if run on an uninfected machine

REGISTRY FIX

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B035261-40F9-11D1-AAEC-00805FC1270E}\InProcServer32]
@="%System%\netcfgx.dll"

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_{79007602-0CDB-4405-9DBF-1257BB3226ED}]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_{79007602-0CDB-4405-9DBF-1257BB3226ED}]

Next you will need to create the repair registry fix to do that copy and paste ALL of the above in the quote box to a notepad file. Ensure there is no space above the REGEDIT4.
Then in notepad go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.reg
This will create a fix.reg file on your desktop [external image: Posted Image]

To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.

THEN

Please download the OTM by OldTimer.

• Save it to your desktop.
• Please double-click OTM.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Files
  %Documents and Settings%\All Users\Documents\gifnoc.xtx
  @%System%\netcfgx.dll:Zone.Identifier
   :Commands
  [purity]
  [emptytemp]

• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.