[Resolved] My browser is being hijacked - Help please

Sir, Am using a Laptop with XP SP3 with AVG protection. My browser (IE v6) loads correctly (with Google as home page) and reports a Google search with no visible errors. However, whenever I click on a link, my target gets hijacked and I end up on various – legitimate looking, but nusiance – advertising sites. If instead of clicking on a link I copy and paste the target URL into the IE address box, then I arrive at the correct site. I assume there is a rogue hook into my browser which is intercepting my requests. Spyware Doctor reported a Sasfis trojan – and allegedly dealt with it. I have tried to run a variety of other anti-malware programs, including Panda, Sypbot S&D, AdAware, SpyHunter, Stinger etc – but most fail because they insist on performing a Smart Update and this request is also hijacked. I note that my System Restore is no longer creating a SR Point on booting. I ran HJT (after transferring the latest version across from my server); this stalled prematurely with a warning – see attachment 01.The associated HJT log (as far as it got) is attached as a text file 02 etc I have stepped through your advice on your Infections Removal pages, disabled my broadband connection, created a Restore Point, backed up the registry using ERUNT, disabled emulator drivers with Defogger. I have disabled AVG, PCT, AdAware, Windows Defender, Windows Firewall and WinPatrol. I ran DDS.scr and attach the two text files 03 Attach.txt and 04 DDS.txt I ran GMER and attach the generated report 05 GMER.txt I would be very grateful for anyone’s advice. I’m reasonably competent and experienced in XP and it’s workings. I am trying to avoid a re-install of XP etc as I suspect I might need a re-format to kill this malware and it would take many hours to re-install all my programs. I have however made a full backup of my hard disc – tho’ realise this copy will also likely harbour the malware. Many thanks Philip

[external image: Posted Image]


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.



Please do not delete anything unless instructed to.


We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  [external image: Posted Image]
• When the scan is complete, click OK, then Show Results to view the results.
• [external image: Posted Image]
• Then click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste". .

Dear LDT Thank you for your help. I have gone thru' your script carefully - and I think my laptop is back to its normal well-behaved self. Certainly my broswer is no longer being intercepted. There was a curious 12-hr period after this during which the hard disc was thrashing almost continuously. I was disconnected from my network and telephone line, and could find nothing in the Task Manager which might be responsible. Perhaps yet again Bill Gates was up to something in XP which he's too ashamed of to let me know. I have now re-instated all my security stuff. May I now run defogger and re-instate any CD emulation? Here is my Malware log: ————————————————————— Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 3995 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 16/04/2010 13:35:58 mbam-log-2010-04-16 (13-35-58).txt Scan type: Quick scan Objects scanned: 111950 Time elapsed: 4 minute(s), 37 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 3 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.163.217,93.188.166.55 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1e319b18-af8d-4550-b82d-fe29fb31fb5f}\NameServer (Trojan.DNSChanger) -> Data: 93.188.163.217,93.188.166.55 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{e9ddb67c-9c3d-4d1d-9618-c8e316c6340f}\NameServer (Trojan.DNSChanger) -> Data: 93.188.163.217,93.188.166.55 -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ————————————————————— Many thanks Philip

If you used DeFogger
You must remember to re-enable your Emulation drivers once we are finished, double click DeFogger to run the tool.

• The application window will appear
• Click the Re-enable button to re-enable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Dear LDT Just a note of thanks to yourself (and ? your team) for the brilliant, clear assistance given. While the web has encouraged some spectacularly ubpleasant behaviour from presumably spectacularly unpleasant humans, it has also fostered incredible links between strangers willing to give their time and expertise. Any ideas about how to get a million tons of Icelandic volcanic ash out of my server? Again, Many thanks Philip

Any ideas about how to get a million tons of Icelandic volcanic ash out of my server?

Blow it out and then put a condom over it.

Great job

You're more than welcome.
Glad we were able to help

Peace be with you

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.