Google Redirect

Hi petersaxton,

You will need to a little work this time. Please read through these instructions so you are familar with what you need to do.

Right click on MBRCheck.exe and select "Run as Administrator" to run it,

• When the tool finishes it's scan it will present you with something similar to this on the screen
  
  

  Size Device Name MBR Status
  ——————————————–
  465 GB \\.\PhysicalDrive0 Windows Vista MBR code detected
  SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
  465 GB \\.\PhysicalDrive1 Known-bad MBR code detected (Whistler / Black Internet)!
  SHA1: CB9391A348A4F8AD6FC6EA596AEDB9C336710CA7
  
  Found non-standard or infected MBR.
  Enter 'Y' and hit ENTER for more options, or 'N' to exit:

• Locate the PhysicalDrive that contains this line
  
  Known-bad MBR code detected (Whistler / Black Internet)!
• Make note of the PhysicalDrive number, it will be either a 0 or a 1

• type in Y and press Enter when asked if you wish to see more options
• Type in 1 to "Dump the MBR of a physical disk to file" and press Enter
• Type in the number you noted earlier to select your disk and press Enter
• Type in dump.txt as the file name and press Enter
• Type in -1 to exit and press Enter.

The file will be quite large so you will need to zip it before you can attach it. To zip the file

• Right-click on the file dump.txt.
• Select: Send To -> Compressed (zipped) Folder
• The newly zipped file dump.zip should be on your desktop.

To attach a file, do the following:

• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, (it should be here C:\Users\Peter\Desktop\dump.zip) then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on the icon with the green + sign to insert the attachment into your post

Please attach dump.zip to your next reply.

Thanks

I'm running the Kaspersky scan It's been 9 hours and the progress is 37% but so far it's found 6 threats 6 infected objects and 8 suspicious objects

Hi petersaxton, Thanks for the update, it can take a while but it's worth it. When the scan is completed, please post the results then follow the instructions in the reply right above your last post. Thanks

It's been 14.5 hours and the progress is 50% but so far it's found 6 threats 11 infected objects and 16 suspicious objects The scan should finish in the morning in UK time! I'll post the results and then follow the instructions.

Hi peter saxton, Thanks for the update. Sometimes depending on the type of data being scanned, the last part can go quite quickly.

72% now after 23 hours but all the rest should be data files now but RAID 1 copies as well

——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Saturday, September 11, 2010 Operating system: Microsoft Windows Vista Ultimate Edition, 32-bit Service Pack 2 (build 6002) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Thursday, September 09, 2010 18:43:35 Records in database: 4209147 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ H:\ I:\ J:\ K:\ Z:\ Scan statistics: Objects scanned: 1338178 Threats found: 8 Infected objects found: 28 Suspicious objects found: 45 Scan duration: 35:01:49 File name / Threat / Threats count C:\FilesCopiedToBuffalo\Installation Files\mirc\mirc612.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 1 C:\FilesCopiedToBuffalo\Installation Files\mirc\mirc614.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 1 C:\FilesCopiedToBuffalo\Installation Files\mirc\mirc616.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 C:\FilesCopiedToBuffalo\_Business\Not Clients\Agent backup\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 C:\FilesCopiedToBuffalo\_Business\Not Clients\Agent backup\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 C:\FilesCopiedToBuffalo\_Business\Not Clients\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 C:\FilesCopiedToBuffalo\_Business\Not Clients\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 C:\FilesCopiedToBuffalo\_Business\Not Clients\Peter backup.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1 C:\FilesCopiedToBuffalo\_Business\Not Clients\Peter.pst.mbkp Suspicious: Trojan-Spy.HTML.Fraud.gen 5 C:\Users\Peter\Desktop\MBRCheck_MBR_Backup_09-09-10_12-27-38.bak Infected: Trojan-Clicker.Win32.Wistler.a 1 D:\Backup\Installation Files\mirc\mirc612.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 1 D:\Backup\Installation Files\mirc\mirc614.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 1 D:\Backup\Installation Files\mirc\mirc616.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 D:\Backup\_Business\Not Clients\Agent backup\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 D:\Backup\_Business\Not Clients\Agent backup\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\Backup\_Business\Not Clients\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 D:\Backup\_Business\Not Clients\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\Backup\_Business\Not Clients\Peter backup.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\Backup\_Business\Not Clients\Peter.pst.mbkp Suspicious: Trojan-Spy.HTML.Fraud.gen 5 D:\Backup4All\BackupToD\C\Users\Peter\Documents\Installation Files\mirc\mirc612.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 1 D:\Backup4All\BackupToD\C\Users\Peter\Documents\Installation Files\mirc\mirc614.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 1 D:\Backup4All\BackupToD\C\Users\Peter\Documents\Installation Files\mirc\mirc616.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 D:\Backup4All\BackupToD\C\Users\Peter\Documents\_Business\Not Clients\Agent backup\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 D:\Backup4All\BackupToD\C\Users\Peter\Documents\_Business\Not Clients\Agent backup\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\Backup4All\BackupToD\C\Users\Peter\Documents\_Business\Not Clients\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 D:\Backup4All\BackupToD\C\Users\Peter\Documents\_Business\Not Clients\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\Backup4All\BackupToD\C\Users\Peter\Documents\_Business\Not Clients\Peter backup.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\Backup4All\BackupToD\C\Users\Peter\Documents\_Business\Not Clients\Peter.pst.mbkp Suspicious: Trojan-Spy.HTML.Fraud.gen 5 D:\From K\Goodsync Backup\aBUSINESS\Not Clients\Agent backup\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 D:\From K\Goodsync Backup\aBUSINESS\Not Clients\Agent backup\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\From K\Goodsync Backup\aBUSINESS\Not Clients\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 D:\From K\Goodsync Backup\aBUSINESS\Not Clients\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\From K\Goodsync Backup\aBUSINESS\Not Clients\Peter backup.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1 D:\From K\Goodsync Backup\aBUSINESS\Not Clients\Peter.pst.mbkp Suspicious: Trojan-Spy.HTML.Fraud.gen 5 D:\From K\Goodsync Backup\Downloads\mirc635.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1 D:\From K\Goodsync Backup\Installation Files\mirc\mirc612.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 1 D:\From K\Goodsync Backup\Installation Files\mirc\mirc614.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 1 D:\From K\Goodsync Backup\Installation Files\mirc\mirc616.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 D:\From K\Goodsync Backup\_gsdata_\_saved_\aBUSINESS\Not Clients\Peter backup.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2 D:\From K\Goodsync Backup\_gsdata_\_saved_\Installation Files\Advanced Internet Tool\aitmdi_aur.exe Infected: not-a-virus:AdWare.Win32.Aureate 1 Z:\Installation Files\mirc\mirc612.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 1 Z:\Installation Files\mirc\mirc614.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 1 Z:\Installation Files\mirc\mirc616.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 Z:\_Business\Not Clients\Agent backup\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 Z:\_Business\Not Clients\Agent backup\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 Z:\_Business\Not Clients\Agent Data\0000A021.DAT Infected: Email-Worm.Win32.BadtransII 1 Z:\_Business\Not Clients\Agent Data\0000A801.DAT Suspicious: Trojan-Spy.HTML.Fraud.gen 1 Z:\_Business\Not Clients\Peter backup.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1 Z:\_Business\Not Clients\Peter.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2 Z:\_Business\Not Clients\Peter.pst.mbkp Suspicious: Trojan-Spy.HTML.Fraud.gen 5 Z:\_Business\Not Clients\Peter.bak Suspicious: Trojan-Spy.HTML.Fraud.gen 1 Selected area has been scanned.

scan finished so i uploaded the report and ran MBRCheck and did a dump of the relevant drive - see attached📎dump.zip

looking through the log the only file I care about is on this line Z:\_Business\Not Clients\Peter.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2 That's my Outlook file! What's likely to happen to that?

Hi petersaxton,

re Kaspersky:

All these files mirc612.exe, mirc614.exe, mirc616.exe are related to a legitamate Internet Relay Chat program, mIRC. Kaspersky just only flagged them as "riskware". They are fine as long as you knowingly installed the program.

The .dat files, 0000A021.DAT and 0000A801.DAT look to belong to Forté Agent. This program keeps information about newsgroups you have subscribed to and emails. These files are like a database that can be read by the program. There isn't anyway for me to tell you which part was flagged by Kaspersky. You could go through the files on Z:\ drive and remove anything unimportant and compact the file with Forte Agent. You could then submit just those files to Kaspersky and see if the detection is still there. Once it's clean you could then make a new backup replacing the one on D:\ I know nothing about how this program works so you will need to consult your Help files.

The ones on the C:\ drive appear to be files you have sent to another location and the ones on D:\ drive look to be your backup copies. All I can suggest is doing the same thing or if the files on C:\ are not important delete them.

Yes the .pst is your Outlook mail folder. Again it's similar to a large data base in which everything is kept in one file. When viewed in Outlook, the data will be displayed as individual messages. The only way to clean these is to go through the messages and delete anything unimportant or unsolicited. Empty the Deleted Items folder and compact. The detections are usually in messages with attachments for both Outlook and Forte Agent.

You can delete this file from your desktop

C:\Users\Peter\Desktop\MBRCheck_MBR_Backup_09-09-10_12-27-38.bak

MBRCheck. The problem that MBRcheck reported is the infection you had wrote an MBR to your D:\ drive. This drive does not have an OS on it making rather difficult to remove/replace it without risking the data on the drive. Since this drive doesn't have an OS the drive is not bootable and that MBR will not be executed so it poses no threat. Should you ever install an OS on that drive, a new MBR will be created overwriting the existing one. Again there is no threat from the MBR currently there.

Any other problems? If not we'll clean up the tools after you post back.

Thanks

“All these files mirc612.exe, mirc614.exe, mirc616.exe are related to a legitamate Internet Relay Chat program, mIRC. Kaspersky just only flagged them as "riskware". They are fine as long as you knowingly installed the program.” I did install the program sometime in the past but I don’t use it now. “The .dat files, 0000A021.DAT and 0000A801.DAT look to belong to Forté Agent. This program keeps information about newsgroups you have subscribed to and emails. These files are like a database that can be read by the program. There isn't anyway for me to tell you which part was flagged by Kaspersky.” I don’t keep anything important on these files so I’m happy to lose them. “You could go through the files on Z:\ drive and remove anything unimportant and compact the file with Forte Agent. You could then submit just those files to Kaspersky and see if the detection is still there. Once it's clean you could then make a new backup replacing the one on D:\ I know nothing about how this program works so you will need to consult your Help files. Except for Z:\_Business\Not Clients\Peter.pst all the other files are unimportant “The ones on the C:\ drive appear to be files you have sent to another location and the ones on D:\ drive look to be your backup copies. All I can suggest is doing the same thing or if the files on C:\ are not important delete them.” I’m happy to delete “Yes the .pst is your Outlook mail folder. Again it's similar to a large data base in which everything is kept in one file. When viewed in Outlook, the data will be displayed as individual messages. The only way to clean these is to go through the messages and delete anything unimportant or unsolicited. Empty the Deleted Items folder and compact. The detections are usually in messages with attachments for both Outlook and Forte Agent.” The Outlook pst file is very important to me. I've emptied the deleted items folder and done a compact. I did a search on the warning message and I got something similar from a scan: <<>> Do you know how they got the information on the subject line? It would be great if I could get to that level of detail. I delete most unsolicited mails. I've recently got a program that would save emails as pdf's and I could then delete the emails in Outlook. My Outlook data file is about 5 Gb's. If I saved all attachments and saved emails to pdf's then I could delete the emails in Outlook and have a very small pst file. I suppose I really need something to automate this process because otherwise it could take a long time. “You can delete this file from your desktop C:\Users\Peter\Desktop\MBRCheck_MBR_Backup_09-09-10_12-27-38.bak “ Done “MBRCheck. The problem that MBRcheck reported is the infection you had wrote an MBR to your D:\ drive. This drive does not have an OS on it making rather difficult to remove/replace it without risking the data on the drive. Since this drive doesn't have an OS the drive is not bootable and that MBR will not be executed so it poses no threat. Should you ever install an OS on that drive, a new MBR will be created overwriting the existing one. Again there is no threat from the MBR currently there.” I don’t have any important data on this drive. It only consists of old backups plus this system information folder that I can’t access. I now use the Z drive for my important data. How can I clean up the D drive? “Any other problems? If not we'll clean up the tools after you post back.” Great

Hi petersaxton,

“All these files mirc612.exe, mirc614.exe, mirc616.exe are related to a legitamate Internet Relay Chat program, mIRC. Kaspersky just only flagged them as "riskware". They are fine as long as you knowingly installed the program.”

I did install the program sometime in the past but I don’t use it now.

You can uninstall it then.

“The .dat files, 0000A021.DAT and 0000A801.DAT look to belong to Forté Agent. This program keeps information about newsgroups you have subscribed to and emails. These files are like a database that can be read by the program. There isn't anyway for me to tell you which part was flagged by Kaspersky.”

I don’t keep anything important on these files so I’m happy to lose them.

Check the help file for the program for the best way to remove the contents of the .dat files or the entire file itself.

“You could go through the files on Z:\ drive and remove anything unimportant and compact the file with Forte Agent. You could then submit just those files to Kaspersky and see if the detection is still there. Once it's clean you could then make a new backup replacing the one on D:\ I know nothing about how this program works so you will need to consult your Help files.

Except for Z:\_Business\Not Clients\Peter.pst all the other files are unimportant

Remove the backup folders from C:\ and D:\ if they are not required.

Do you know how they got the information on the subject line?

It would be great if I could get to that level of detail.

At one time Kaspersky and other AVs did report a little more detail. However people would either use a tool or attempt a manual deletion of the flagged item from outside of the mail client. Since the client stores everything in what can be viewed as a single large file this would lead to a corruption of that file resulting in the lose of everything.

I don’t have any important data on this drive. It only consists of old backups plus this system information folder that I can’t access. I now use the Z drive for my important data.

By default on Vista only the "System" has access to the folder. This is to keep people from deleting files in that folder and breaking the "chain" which would cause SR not to work. You can clean out that folder by

• Click Start
• Right click on My Computer and click Properties
• Click on the System Protection
• Uncheck the D:\ drive and click Turn System Restore Off

that will keep System Restore from monitoring that drive and will remove all the files.

We will be reseting all of your Sytem Restore points during the tools clean up so there isn't any reason to do the above. The process we will be using will clean out all the old restore points and create a new one on all drives.

I don’t have any important data on this drive. It only consists of old backups plus this system information folder that I can’t access. I now use the Z drive for my important data.

How can I clean up the D drive?

Keep in mind the D:\ drive poses no threat. Since you don't have anything on the D:\ that is important, the safest way to clean the D:\ is to reformat it. This will remove all data from that drive. The MBR would need to be replaced by either installing an OS on that drive or an alternate method. Any alternate method would involve the risk of replacing the wrong MBR making the computer unbootable. My advice would be to leave it as it is. If some day you decide to reinstall Windows, reformat that drive and install Windows on it.


We'll clean up the tools.

From your desktop, please delete, if present

• any notepads/logs that we created
• MBRCheck
• TDSKiller

Next

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep MBAM updated and use it regularly.


*We'll reset your restore points

• Click on the Start button to open your Start Menu.
• Click on the Control Panel menu option.
• Click on the System and Maintenance menu option.
• Click on the System menu option.
• Click on System Protection in the left-hand task list.
• Create the manual restore point you should click on the Create button. When you press this button a prompt will appear asking you to provide a title for this manual restore point.
• Type in a title for the manual restore point and press the Create button.
• Close the System window after you have been advised that the procedure has been successfully completed.
  
• Next, go to Start > Run (it may be start > accesories > run) and type in cleanmgr
• Select the More options tab
• Choose the option to clean up system restore and Ok it

This will remove all restore points except the most recent one.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall.

It looks like you are using a Norton suite so you should be covered with the addition of MBAM.

You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE


-Check this site out to check for out of date programs
Secunia Personal Software Inspector (PSI) 1.0


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

We'll keep this thread open for a couple of days.

Take care

Thanks I've taken all your advice regarding which software to use. I've deleted all the files except the pst files. I'll have to go through the emails and see what I can delete and which attachments I can save. That will take a long time. The good news is that I am not having any problems with redirects. I really appreciate the time you have spent helping me. You have been fantastic. Thank you

Hi petersaxton, You're more than welcome. Take care.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.