What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Google hijacked by directrdr.com - AVG, Malwarebytes and Ad

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Filename: taskeng.exe Status: Scan finished. 0 out of 20 scanners reported malware. Scan taken on: Mon 18 May 2009 20:57:35 (CET) Permalink Filename: taskhost.exe Status: Scan finished. 0 out of 21 scanners reported malware. Scan taken on: Thu 2 Jul 2009 12:21:58 (CET) Permalink
Post #17
Lets try an online scan then.

http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is ticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.
Post #20
OK Here are the ESET Results: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.7100.0 (winmain_win7rc.090421-1700) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=4035f829b0f5dd4083f68eba25059660 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2009-12-05 02:42:22 # local_time=2009-12-05 02:42:22 (+0000, GMT Standard Time) # country="United Kingdom" # lang=9 # osver=6.1.7100 NT # compatibility_mode=512 16777215 100 0 609509 609509 0 0 # compatibility_mode=769 16775165 100 98 5577 196259662 30986 0 # compatibility_mode=1024 16777215 100 0 2773673 2773673 0 0 # compatibility_mode=5893 16776573 100 94 46460 19601765 0 0 # compatibility_mode=8192 67108863 100 0 3737 3737 0 0 # scanned=67938 # found=1 # cleaned=1 # scan_time=2435 C:\Windows\System32\Process.exe Win32/PrcView application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
Post #22
Yeah, just did a google search for ebay, chose ebay and it redirected me to some shopping site that wasnt ebay. Am I downloading Firefox to see if it is IE that is causing the problem?
Post #23

Yeah, just did a google search for ebay, chose ebay and it redirected me to some shopping site that wasnt ebay.

Am I downloading Firefox to see if it is IE that is causing the problem?

Good idea. We're seeing alot of issues with IE8
Post #24
Firefox seems to be working alright, but that doesnt take away the fact that I still have something on my computer. I like and am used to IE, and I like IE8.
Post #25
  • Download DDS and save it to your desktop from
    Here
    here or
    here.
    • Disable any script blocking protection (How to Disable your Security Programs)
    • Double click DDS icon to run the tool (may take up to 3 minutes to run)
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
  • We Need to check for Rootkits with RootRepeal
    • Download RootRepeal from one of the following locations and save it to your desktop.
    • Open [external image: Posted Image] on your desktop.
    • Click the [external image: Posted Image] tab.
    • Click the [external image: Posted Image] button.
    • In the Select Scan dialog, check
      [external image: Posted Image]
    • Push Ok
    • Check the box for your main system drive (Usually C:), and press Ok.
    • Allow RootRepeal to run a scan of your system. This may take some time.
    • Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt.
  • Copy/paste the log (that you've previously saved to your desktop) from RootRepeal onto your post.

  • Copy/paste the DDS.txt log (that you've previously saved to your desktop) onto your post.

  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

  • Complete your post by pressing the [external image: Posted Image]button below.
Post #26
OK, DDS says it is not compatible with my operating system And Root Repeal gives me loads of error messages and this log: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/12/05 03:10 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP0 ================================================== SSDT ——————- SYSENTER/INT2E Hooked [0x81c43230]! ==EOF==
Post #27
Disaster Using Firefox I have just been browsing a site I go on to search for jobs, and directrdr.com has just popped up. So, this isnt pigeon holed to Internet Explorer.
Post #28
Sorry for the multipost, but I have just downloaded the DDS from the second link which you gave, and its worked!? The results are: DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 3:36:39.43 on 05/12/2009 Internet Explorer: 8.0.7100.0 Microsoft Windows 7 Ultimate 6.1.7100.0.1252.44.1033.18.1014.389 [GMT 0:00] SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\System32\igfxpers.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Spybot - Search & Destroy\SDWinSec.exe C:\Windows\system32\igfxext.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\DllHost.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\system32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\explorer.exe c:\program files\windows defender\MpCmdRun.exe C:\Users\Darren\Desktop\dds.scr C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uSearch Bar = Preserve BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [avast!] "c:\program files\alwil software\avast4\ashDisp.exe" mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\micros~1\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\micros~1\office12\REFIEBAR.DLL DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: {83B1BF49-29FC-4DC6-B2F6-2B099007339D} = 193.36.79.100 193.36.79.101 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\microsoft office\office12\GrooveSystemServices.dll Notify: igfxcui - igfxdev.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\microsoft office\office12\GrooveShellExtensions.dll Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - c:\users\darren\appdata\roaming\mozilla\firefox\profiles\62v0gvcn.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/ FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-12-2 114768] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-4-22 48128] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-12-2 20560] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-12-2 53328] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-12-2 138680] R2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\drivers\KMDFMEMIO.sys [2009-7-20 13312] R2 SBSDWSCService;SBSD Security Center Service;c:\spybot - search & destroy\SDWinSec.exe [2009-7-20 1153368] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-4-22 14336] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-9-28 315392] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-9-16 133104] S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-12-2 254040] S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-12-2 352920] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-4-22 229888] =============== Created Last 30 ================ 2009-12-05 01:59:31 0 d—–w- c:\program files\ESET 2009-12-05 01:36:58 0 d—–w- C:\HJT 2009-12-05 00:51:35 0 d-s—w- C:\ComboFix 2009-12-05 00:43:41 168373622 —-a-w- c:\windows\MEMORY.DMP 2009-12-05 00:18:55 98816 —-a-w- c:\windows\sed.exe 2009-12-05 00:18:55 77312 —-a-w- c:\windows\MBR.exe 2009-12-05 00:18:55 260608 —-a-w- c:\windows\PEV.exe 2009-12-05 00:18:55 161792 —-a-w- c:\windows\SWREG.exe 2009-12-04 22:21:34 0 d—–w- C:\HiDownload 2009-12-02 23:44:07 256 —-a-w- c:\windows\system32\pool.bin 2009-12-02 23:41:40 0 d—–w- c:\program files\Research In Motion 2009-12-02 23:40:39 27136 —-a-w- c:\windows\system32\drivers\RimSerial.sys 2009-12-02 15:55:25 53328 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2009-12-02 15:55:25 499712 —-a-w- c:\windows\system32\MSVCP71.dll 2009-12-02 15:55:25 1060864 —-a-w- c:\windows\system32\MFC71.dll 2009-12-02 01:31:29 0 d—–w- c:\windows\pss 2009-12-01 02:13:45 93360 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2009-11-30 18:42:07 1778 —-a-w- c:\windows\system32\tmp.reg 2009-11-30 18:41:14 78336 —-a-w- c:\windows\system32\Agent.OMZ.Fix.exe 2009-11-30 18:41:12 80384 —-a-w- c:\windows\system32\o4Patch.exe 2009-11-30 18:41:10 82944 —-a-w- c:\windows\system32\IEDFix.C.exe 2009-11-30 18:41:09 82432 —-a-w- c:\windows\system32\404Fix.exe 2009-11-30 18:41:07 87552 —-a-w- c:\windows\system32\VACFix.exe 2009-11-30 18:41:07 82944 —-a-w- c:\windows\system32\IEDFix.exe 2009-11-30 18:41:05 75776 —-a-w- c:\windows\system32\WS2Fix.exe 2009-11-30 18:41:05 289144 —-a-w- c:\windows\system32\VCCLSID.exe 2009-11-30 18:41:03 51200 —-a-w- c:\windows\system32\dumphive.exe 2009-11-30 18:41:03 288417 —-a-w- c:\windows\system32\SrchSTS.exe 2009-11-28 02:50:46 0 d—–w- c:\program files\SUPERAntiSpyware 2009-11-28 02:13:22 0 d—–w- c:\users\darren\appdata\roaming\Samsung 2009-11-28 01:43:19 0 d—–w- c:\program files\Trend Micro 2009-11-28 01:38:25 348160 —-a-w- c:\windows\system32\msvcr71.dll 2009-11-28 01:34:33 0 d—–w- c:\windows\system32\Samsung_USB_Drivers 2009-11-28 01:33:49 766 —-a-w- c:\windows\system32\Uninstall.ico 2009-11-28 01:33:35 5632 —-a-w- c:\windows\system32\drivers\StarOpen.sys 2009-11-26 11:54:08 16384 ——w- c:\windows\system32\Ikeext.etl 2009-11-26 11:41:58 0 d—–w- C:\AVG9 2009-11-25 00:12:40 0 d—–w- c:\programdata\VirginMedia 2009-11-24 11:24:08 0 d—–w- c:\users\darren\appdata\roaming\Malwarebytes 2009-11-24 11:23:56 0 d—–w- c:\programdata\Malwarebytes 2009-11-22 23:12:47 65536 –sha-w- c:\users\darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TM.blf 2009-11-22 23:12:47 524288 –sha-w- c:\users\darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000002.regtrans-ms 2009-11-22 23:12:47 524288 –sha-w- c:\users\darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000001.regtrans-ms 2009-11-22 14:22:18 0 d—–w- c:\programdata\Lavasoft 2009-11-15 22:33:55 0 d—–w- c:\programdata\Research In Motion 2009-11-15 22:13:00 0 d—–w- c:\users\darren\appdata\roaming\Research In Motion 2009-11-15 22:09:50 0 d—–w- c:\program files\common files\Research In Motion 2009-11-15 22:09:49 0 d—–w- C:\BlackBerry ==================== Find3M ==================== 2009-12-01 14:36:03 21584 —-a-w- c:\windows\system32\drivers\atapi.sys 2009-11-02 20:42:06 195456 ——w- c:\windows\system32\MpSigStub.exe 2009-09-28 09:22:00 364544 —-a-w- c:\windows\system32\yk62x86.dll 2009-04-22 09:01:08 31548 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2009-04-22 09:01:08 31548 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2009-04-22 09:01:08 291294 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2009-04-22 09:01:08 291294 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2009-04-22 08:14:13 174 –sha-w- c:\program files\desktop.ini 2009-04-22 04:38:41 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2009-04-22 04:38:41 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2009-04-22 04:38:39 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2009-04-22 04:38:39 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2009-03-27 04:24:20 9633792 –sha-r- c:\windows\fonts\StaticCache.dat 2009-09-02 00:02:03 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\cookies\index.dat 2009-09-02 00:02:03 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\history\history.ie5\index.dat 2009-09-02 00:02:03 32768 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\temporary internet files\content.ie5\index.dat 2009-09-01 20:11:05 245760 –sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2009-07-21 17:21:27 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2009-04-22 05:19:40 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7100.0_none_624b25e9a4cb0444\WinMail.exe ============= FINISH: 3:40:22.04 ===============

Attachments:

Post #29
1. Please download The Avenger by Swandog46 to your Desktop.
http://swandog46.geekstogo.com/avenger.zip
Click on Avenger.zip to open the file
Extract avenger.exe to your desktop

Now, start The Avenger program by clicking on its icon on your desktop.

Copy/paste the below into the Input Script Here and select Execute

Files to delete:
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\VACFix.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\WS2Fix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\SrchSTS.exe

press the green traffic light and confirm a reboot


Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

Please copy/paste the content of c:\avenger.txt into your reply.


Also please describe how your computer behaves at the moment.
Post #30
Thank you Tate for the above, I have ran the avenger and the resulting log is as follows:

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\system32\Agent.OMZ.Fix.exe" deleted successfully.
File "c:\windows\system32\o4Patch.exe" deleted successfully.
File "c:\windows\system32\IEDFix.C.exe" deleted successfully.
File "c:\windows\system32\404Fix.exe" deleted successfully.
File "c:\windows\system32\VACFix.exe" deleted successfully.
File "c:\windows\system32\IEDFix.exe" deleted successfully.
File "c:\windows\system32\WS2Fix.exe" deleted successfully.
File "c:\windows\system32\VCCLSID.exe" deleted successfully.
File "c:\windows\system32\dumphive.exe" deleted successfully.
File "c:\windows\system32\SrchSTS.exe" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Touch wood my computer is behaving well at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI