Hello everybody!
As many other here, I have a hijacking problem: by searching via Google I will be redirected to other sites. The problem occures not just with IE, but also with Firefox and Opera. The redirection is not the only symptom: I can't access some internetsites; can't download updates etc.
I've just checked my system with Hijack This; here is the log:
Logfile of Trend Micro HijackThis v2.0.4https://www.google.com/accounts/ServiceLogi…tmpl=googlemail http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab http://axis.udm.net/activex/AMC.cab http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab http://www.izhneftemash.ru/foto/image.aspx…w=450&h=320
Many thanks for your help or advise on this problem.
Hi Mimino, welcome to the forum.
To make cleaning this machine easier
Please do not uninstall/install any programs unless asked to Please do not run any scans other than those requested Please follow all instructions in the order posted All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked. Do not attach any logs/reports, etc.. unless specifically requested to do so. If you have problems with or do not understand the instructions, Please ask before continuing. Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.
Open
hijackthis , do a system scan only and checkmark these lines, if present
O17 - O17 - HKLM\System\CCS\Services\Tcpip\..\{89B3BBA4-9F78-4EE6-9BD6-9871B4029C23}: NameServer = 93.188.163.185,93.188.166.185
Close
ALL other windows/browsers and click
Fix Checked . Answer
Yes if prompted. Close HJT.
Next
Download
OTL to your Desktop
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. Click on Minimal Output at the top Download the following file scan.txt to your Desktop . Click here to download it . You may need to right click on it and select "Save" Double click inside the Custom Scan box at the bottom A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel" Click the OK button and navigate to the file scan.txt which we just saved to your desktop Select scan.txt and click Open. Writing will now appear under the Custom Scan box Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long. When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt . These are saved in the same location as OTL. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic Next
Go
HERE to get a randomly named copy of GMER. Scroll down to the
Download section and click
Download EXE . Save it to your desktop.
Before scanning with GMER, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan. Double click on the file you downloaded. If asked to allow gmer.sys driver to load, please consent . If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO . [external image: Posted Image] Click the image to enlarge it In the right panel, you will see several boxes that have been checked. Uncheck the following … IAT/EAT Drives/Partition other than Systemdrive (typically C:\) Show All (don't miss this one ) Then click the Scan button & wait for it to finish. Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post. Save it where you can easily find it, such as your desktop, and post it in your next reply. **Caution** If GMER will not run in normal windows, please run it in Saffe Mode
Please post back with
Please describe all symptoms you are experiencing.
Thanks
Hello oldman960!
Thank you so much for answering me!
As you said, I scanned the scan.txt with OLT, but instead of two notepad files it opened just one - OTL.Txt. Here it is:
OTL logfile created on: 27.09.2010 18:58:40 - Run 2========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== http://www.google.com/search?q={searchTerm…tf8&oe;=utf8 https://www.google.com/accounts/ServiceLogi…tmpl=googlemail ========== FireFox ========== http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=" http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0)http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)http://axis.udm.net/activex/AMC.cab (Reg Error: Key error.)http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)http://www.izhneftemash.ru/foto/image.aspx…w=450&h;=320 ========== Files/Folders - Created Within 30 Days ========== ========== Files - Modified Within 30 Days ========== ========== Files Created - No Company Name ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > < %systemroot%\Fonts\*.com > < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > < %systemroot%\Fonts\*.ini2 > < %systemroot%\Fonts\*.exe > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.jpg > < %systemroot%\*.png > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\System32\config\*.sav > < %PROGRAMFILES%\bak. /s > < %systemroot%\system32\bak. /s > < %ALLUSERSPROFILE%\Start Menu\*.lnk /x > < %systemroot%\system32\config\systemprofile\*.dat /x > < %systemroot%\*.config > < %systemroot%\system32\*.db > < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x > < %USERPROFILE%\Desktop\*.exe > < %PROGRAMFILES%\Common Files\*.* > < %systemroot%\*.src > < %systemroot%\install\*.* > < %systemroot%\system32\DLL\*.* > < %systemroot%\system32\HelpFiles\*.* > < %systemroot%\system32\rundll\*.* > < %systemroot%\winn32\*.* > < %systemroot%\Java\*.* > < %systemroot%\system32\test\*.* > < %systemroot%\system32\Rundll32\*.* > < %systemroot%\AppPatch\Custom\*.* > < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x > < %PROGRAMFILES%\PC-Doctor\Downloads\*.* > < %PROGRAMFILES%\Internet Explorer\*.tmp > < %PROGRAMFILES%\Internet Explorer\*.dat > < %USERPROFILE%\My Documents\*.exe > < %USERPROFILE%\*.exe > < %systemroot%\ADDINS\*.* > < %systemroot%\assembly\*.bak2 > < %systemroot%\Config\*.* > < %systemroot%\REPAIR\*.bak2 > < %systemroot%\SECURITY\Database\*.sdb /x > < %systemroot%\SYSTEM\*.bak2 > < %systemroot%\Web\*.bak2 > < %systemroot%\Driver Cache\*.* > < %PROGRAMFILES%\Mozilla Firefox\0*.exe > < %ProgramFiles%\Microsoft Common\*.* > < %ProgramFiles%\TinyProxy. > < %USERPROFILE%\Favorites\*.url /x > < %systemroot%\system32\*.bk > < %systemroot%\*.te > < %systemroot%\system32\system32\*.* > < %ALLUSERSPROFILE%\*.dat /x > < %systemroot%\system32\drivers\*.rmv > < dir /b "%systemroot%\system32\*.exe" | find /i " " /c > < dir /b "%systemroot%\*.exe" | find /i " " /c > < %PROGRAMFILES%\Microsoft\*.* > < %systemroot%\System32\Wbem\proquota.exe > < %PROGRAMFILES%\Mozilla Firefox\*.dat > < %USERPROFILE%\Cookies\*.txt /x > < %SystemRoot%\system32\fonts\*.* > < %systemroot%\system32\winlog\*.* > < %systemroot%\system32\Language\*.* > < %systemroot%\system32\Settings\*.* > < %systemroot%\system32\*.quo > < %SYSTEMROOT%\AppPatch\*.exe > < %SYSTEMROOT%\inf\*.exe > < %SYSTEMROOT%\Installer\*.exe > < %systemroot%\system32\config\*.bak2 > < %systemroot%\system32\Computers\*.* > < %SystemRoot%\system32\Sound\*.* > < %SystemRoot%\system32\SpecialImg\*.* > < %SystemRoot%\system32\code\*.* > < %SystemRoot%\system32\draft\*.* > < %SystemRoot%\system32\MSSSys\*.* > < %ProgramFiles%\Javascript\*.* > < %systemroot%\pchealth\helpctr\System\*.exe /s > < %systemroot%\Web\*.exe > < %systemroot%\system32\msn\*.* > < %systemroot%\system32\*.tro > < %AppData%\Microsoft\Installer\msupdates\*.* > < %ProgramFiles%\Messenger\*.exe > < %systemroot%\system32\systhem32\*.* > < %systemroot%\system\*.exe > < %USERPROFILE%\Templates\*.tmp > < %SYSTEMDRIVE%\explorexxx.exe\*.* > < %Windir%\Installer\*.tmp > < %systemroot%\System32\*.xco > < %ProgramFiles%\system32\*.* > < %systemroot%\System32\windos\*.* > < %SystemRoot%\system32\sandbox\*.* > < %SystemRoot%\system32\*.amo > < %SystemRoot%\system32\Windows Live\*.* > < %ProgramFiles%\logs\*.* > < %ProgramFiles%\Bifrost\*.* > < %SystemRoot%\system32\*.goo > < %systemroot%\system32\IME\*.* > < %systemroot%\BackUp\*.* > < %systemroot%\system32\*.ico > < %systemroot%\system\*.dat > < %systemroot%\system\*.exe > < %AppData%\Macromedia\Common\*.* > < %SYSTEMDRIVE%\dir\*.* /s > < %systemroot%\system32\ras\*.exe > < %SYSTEMDRIVE%\MFILES\*.* > < %SYSTEMDRIVE%\mDNSRespon.exe\*.* > < %systemroot%\system32\services\*.* > < %systemroot%\Spooler\*.* > < %ProgramFiles%\system32\*.* > < %systemroot%\system32\Setup\*.dll /x > < %systemroot%\system32\*.mine > < %SYSTEMDRIVE%\cleansweep.exe\*.* > < %systemroot%\system32\ras\*.dll > < %systemroot%\system32\ras\*.drv > < %systemroot%\*.iq > < %systemroot%\system32\XP\*.* > < %SYSTEMDRIVE%\Extracted\*.* > < %systemroot%\system32\windows\*.* > < %systemroot%\logs\*.* > < %SYSTEMDRIVE%\Win.Msi\*.* > < %systemroot%\regedit\*.* > < %systemroot%\system32\skype\*.* > < %AppData%\Adobe\dlluplwin25\*.* > < %UserProfile%\*.dat > < %UserProfile%\*.dll > < %systemroot%\system32\*.sxo > < %SYSTEMDRIVE%\Gazma\*.* /s > < %systemroot%\system32\spynet\*.* > < %systemroot%\system32\System\*.* > < %appdata%\Microsoft\Windows\*.* > < %systemroot%\system32\WinDir\*.* > < %systemroot%\_\*.* > < %systemroot%\system32\windows32\*.* > < %ProgramFiles%\win\*.* > < %AppData%\Microsoft\CD Burning\*.* > < %systemroot%\*.cab > < %systemroot%\K.Backup\*.* > < %ProgramFiles%\Massenger\*.* > < %systemroot%\System32\*.doc > < %systemroot%\Office12\*.* > < %systemroot%\System32\Rundl32.exe\*.* > < %ProgramFiles%\yahoo.net\*.* > < %systemroot%\system32\*.igo > < %systemroot%\*.rew > < %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe > < %USERPROFILE%\.COMMgr\*.* > < %USERPROFILE%\Desktop\*.bat > < %PROGRAMFILES%\Common Files\Real\visualizations\*.* > < %PROGRAMFILES%\Internet Explorer\*.Jmp > < %PROGRAMFILES%\Windows NT\system\*.dll > < %systemroot%\system32\*.ext > < %systemroot%\system32\Com\*.cfg > < %systemroot%\system32\btz\*.* > < %systemroot%\system32\EMP\*.* > < %systemroot%\system32\expo\*.* > < %systemroot%\system32\inet2\*.* > < %systemroot%\system32\xrem\*.* > < %ProgramFiles%\Microsoft\*.* > < %systemroot%\usgwmt\*.* > < %ProgramFiles%\B\*.* > < %SYSTEMDRIVE%\lspp\*.* > < %systemroot%\Kral\*.* > < %SYSTEMDRIVE%\windowsdvd.exe\*.* > < %systemroot%\system32\*.ipo > < %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* > < %systemroot%\system32\*.mof > < %systemroot%\*.atm > < %systemroot%\system32\svhost\*.* > < %ProgramFiles%\system32\*.* > < %ProgramFiles%\Docmentt\*.* > < %systemroot%\Help\*.vbs > < %ProgramFiles%\Windows WinSxs\*.* /s > < %ProgramFiles%\Outlook Express\IDT\*.* /s > < %ProgramFiles%\Microsoft Office\365\*.* /s > < %ProgramFiles%\Windows Live\*.* > < %systemroot%\system32\win32\*.* > < %SYSTEMDRIVE%\RECYCLER\*.* > < %systemroot%\Fresh1\*.* > < %ProgramFiles%\Kekj\*.* /s > < %systemroot%\GDU\*.* > < %systemroot%\KA\*.* > < %systemroot%\R\*.* > < %systemroot%\system32\*.fyo > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
I first read your answer today early in the morning. I was a bit in a harry so I did - by mistake - the scanning with OLT first without putting the
scan.txt inside of the
Custom Scan box . And the programme gave that
Extras.Txt . After that I put
scan.txt in the
Custom Scan box and did the scanning again, and after that I got the second file -
OTL.Txt
Here is the Extras.Txt, I got in the morning:
OTL Extras logfile created on: 27.09.2010 05:38:43 - Run 1========== Extra Registry (SafeList) ========== ========== File Associations ========== ========== Shell Spawning ========== ========== Security Center Settings ========== ========== System Restore Settings ========== ========== Firewall Settings ========== ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== ========== HKEY_CURRENT_USER Uninstall List ========== ========== Last 10 Event Log Errors ========== http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
May I use this Extras.Txt in the further process?
Thank you again for your help!!!
Hi Mimino,Do not run the tools again.
Hi oldman960!
I've just tried to run GMER. The scanning itself was actually OK, but I could't save the file (it seems to be rather big). So I'm going to repeat the whole thing again.
After that I'll look for those logs from Combofix and TDSKiller.
Thank you!
Hi oldman960!
The scanning with GMER runs without problem; no warnings while checking. There is one problem though - I can't save the log file (too big, I guess).
Good news: I can open the internetsites, which I couldn't open before (e.g. uploads from Microsoft and Symantec). No redirecting so far.
I'll look for the Combofix and TDSKiller logs later today.
Thank you!
Hi Mimino,
Did you uncheck the boxes as instructed?
Post the combofix log and the TDSKiller log. They will give us a starting point.
Hi oldman960!IAT / EAT and Show all were unchecked.two TDS Killer logs . They seem quite identicall, but I place them both here:Log Nr. 1 :Log Nr. 2 :Norton Power Eraser - should I try it ?
Hi Mimino,
I have a question: my Norton Antivirus offers a kind of special antivirus programm Norton Power Eraser - should I try it ?
Please do not use it while we are cleaning this machine.
From Symantec
there is a risk that it can select some legitimate programs for removal. You should use this tool very carefully, and only after you have exhausted other options.
http://security.symantec.com/nbrt/npe.asp?lcid=4105
TDSKiller found and replaced an infected driver. It seemed have worked because the second TDSKiller log is clean.
Don't worry about GMER for the moment.
Please download
MBR.exe and save it to your
desktop
Double click on the
MBR.exe file to run it.
A log will be produced,
MBR.log on your desktop.
Please open this log in Notepad and post its contents in your next reply.
Please post back with
How is the computer? Any problems?
Thanks
Hi oldman960!MBR.exe and started it, but there was nothing after it, just a little black window appeared for a sec. - there was something written on it, but I couldn't read. No MBR log files either.TDS Killer found something, but it didn't solve my redirection problem and the connection to some webpages was also only partly possible - only with Opera in turbo regime. This is why I came to the forum.
Hi
It looks like mbr.exe ran correctly. The log will be located in the same place you ran it from. I asked you to download it to your desktop so the log should be on the desktop. However if you downloaded it to a different location then the log would be found there.
Hi oldman960!
OK, I managed to start MBR.exe - after unpacking…
Here is the log:
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
Thanks!
Hi Mimino,
Thanks, that looks ok.
You have old outdated vulnerable java installed.
Go to Start > Control Panel > Add/Remove programs and uninstall
2SE Runtime Environment 5.0
Do not uninstall
Java™ 6 Update 14
Still in Control panel.
Locate the Java icon (it looks like a coffee cup) double click it to open it click the Update tab Click update now
After the java is updated, reboot your computer if not prompted to.
Next
Double click on
OTL.exe Under the Custom Scans/Fixes Do Not copy the word CODE please note the fix starts with the : :Services
:Files
ipconfig /flushdns /c
:Commands
[emptytemp]
[Reboot]
Then click the
Run Fix button at the top
Let the program run unhindered Please save the resulting log to be posted in your next reply. Next
Download and save to your desktop
Malwarebytes Anti-Malware
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan ", then click Scan . The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked , and click Remove Selected . When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. *Note It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please post back with
Thanks
Hi oldman960!All processes killed< ipconfig /flushdns /c > full regime : 6 viruses were found.Malwarebytes' Anti-Malware 1.46
Hi Mimino,
The last delections were in some System Restore points. Those will be cleaned up when we remove the tools.
One more scan to do.
*Note It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please go to
Kaspersky website and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings . Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save buttonSpyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan . Once the scan is complete, it will display the results. Click on View Scan Report . You will see a list of infected items there. Click on Save Report As …. Change the Files of type to Text file (.txt) Set the Save In to Desktop click the Save button. Please post this log in your next reply. Next
Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output Minimal Output UNCheck the boxes beside LOP Check and Purity Check .Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window,
OTL.Txt ( no
Extras.Txt this time. )
Please post back with
Any problems?
Thanks
![[external image: Posted Image]](http://i582.photobucket.com/albums/ss269/Cat_Byte/GMER/gmer_screen2-1.gif){kind=link}