Google Redirect, Random Audio Advertisements & more fun [Solved]

I'm still working on this. I am having issues booting from the CD. Just updating so the thread isn't closed. Thank you!

2 questions: 1. What happens when you try to boot from the CD? 2. How patient are you? (I'm very patient and quite happy to continue to try and find the bugger that's causing your trouble. I'm sure we will find it if we work hard enough at it. The question is really how much time YOU want to put into finding it and what is on the computer? You very likely have what is called a MBR infection from the symptoms you have. It means the Master Boot Records that the computer needs to use to actually boot up have likely been modified by malware. That's why it's so tough to identify. It's not just a file that's sitting out there waiting to be found and removed. It's actually a file that's used at the time your system is being booted up, and it's created to be notoriously hard to find and will require a bit of manipulation to fix back once we identify it. It can be done however.) If this is just a machine that is used mainly for surfing the internet, it may be easier to reformat the machine and you will be ensured of fixing the problem. If however, you have lots of critical files, especially ones you may not have backed up anywhere else and lots of other data on the machine, a reformat may not be practical for you. Or, if you are like me, at this point you may just want to prove a point to that little file and you will be determined to find and eradicate it no matter how long it takes The choice is certainly yours but I wanted to make sure you were aware of what we are probably dealing with, and that this could be a long process. I am here to assist you for as long as you want in fixing this and I will continue to do so to the best of my abilities. I just wanted to let you know that from what I'm seeing - this one may take us awhile as it's obviously VERY stubborn. I will keep this thread open for you for as long as we need to. Don't worry about that.

The issue was that nothing happened when I tried to boot from disk. I had a lot of trouble getting to the menu. I finally got it this morning though (and I didn't do anything special to get there. I am determined!). The log is attached. I don't know if any of it will make sense or if this it what it was supposed to look like. I'd prefer not to format the HD, but if it's not the end of the world if that ends up being my only option.

Was the recovery disk you are using made from this machine or from the known clean machine? (And no….the report doesn't look like what I was expecting. )

I was expecting something that made a little more sense from that report! I made the disk from a clean PC.

Hang tight - I had posted some other instructions - but don't go through those yet. Give me a minute. Those FRST64.txt files may be what I need. Give me a little while longer to look them over. I'll be back to you shortly. I'm looking at them now. On the surface they don't look like much - but in a different editor they may be what I need.

OK, this still did not show me what I need to see unfortunately. (Although it DID look a lot better in a special editor) I can see that you were having a lot of troubles with getting it running. We need to try a different approach to gather the info we need to see.

We'll use a CD that we will make bootable. We also need a USB flashdrive that has some space on it. We will not be changing any of the data on the usb device just using it for a file.

• Save these files to your Desktop
  
  • Download Latest Puppy Linux ISO (i.e.: lupu-528.iso)
  • Download BurnCDCC ISO Burning Software
• Open BurnCDCC and Extract All files to to it's own folder
• Double Click BurnCDCC
• Click Browse and navigate to the Puppy Linux ISO file you just downloaded
• click on it and click Open
• IMPORTANT: Adjust the speed bar to CD: 4x DVD: 1x
• Click Start
• Your CD Burner Tray will open automatically
• Insert a blank CD and close the tray
• Click OK

The CD should eject when finished.

Download and save pldumpit.exe to your USB device.

To use the CD

• Leave the usb device attached to the computer
• Insert the CD and restart the computer
• When the computer first starts please press the key indicated on the screen to enter the bios or setup.
• Make the necessary changes to make the CD first in the boot order
• Save the changes and exit the bios/setup
• Your computer will restart and boot from the Puppy Linux Live CD

You can save these instructions to a notepad on your usb device. Once you have mounted the drives you should be able view them by clicking on them.

• Set your language, time. etc preferences and continue
• Click the Mount Icon located at the top left of your desktop (should be 3rd from the left top row)
• A Window will open, click mount for each drive listed
• if you have a USB Flash Drive connected it's usually automatically mounted upon boot, but click the "usbdrv" tab and make sure it is mounted.

In the lower left you will see some icons with a green light on them. Click on the one that represents your usb device.

• locate pldumpit.exe
• right click it and select rename
• please remove only the .exe from the file path
• click rename
• click on pldumpit
• a window will open please hit enter when told to to close the window
• there should now be a file named mbr.zip in the list of files
• close all windows
• click menu
• highlight shutdown
• click reboot
• use the arrow key to select Do not save
• hit enter
• remove the CD before the computer restarts and allow the computer to boot

Please attach MBR.zip to your next reply.

I really appreciate how patient you've been with me and for all your help! I tried the FRST tool again last night, before seeing your message. Instead of running from the command line, I right clicked on it and ran as administrator in the notepad open box. That worked better and saved a file you can actually read. There are several drive partitions listed - I don't think there have always been that many, though. I'm going to follow the next set of instructions when I'm off work later. Thank you again!

Before you do the other instructions give me a little time to look over this log. This is what I was expecting :). I'll be back to you later this evening.

I believe I have the information I need at this point. I'm just getting a confirmation on a fix from my colleagues (since we've had so much trouble running tools with this infection) and I should be back to you shortly. I do believe we just might have this under control in short order

Do you by any chance still have a log call FRST.txt on your desktop from the first time you ran the tool? If not, can you please delete the FRST logs you produced and rerun the tool and look for a log called FRST.txt and post that for me? Don't rename it to FRST64.txt as I had mentioned in my other post.

I'd also like you to run this tool:

• Download RogueKiller and save it on your desktop.
  
  NOTE: If using IE8 or better Smartscreen Filter will need to be disabled
  
• Quit all programs
• Start RogueKiller.exe.
• Wait until Prescan has finished …
• Click on Scan

[external image: Posted Image]

• Wait for the end of the scan.
• The report has been created on the desktop.
• Click on the Delete button.

[external image: Posted Image]

• The report has been created on the desktop.

• Next click on the ShortcutsFix
  [external image: Posted Image]
• The report has been created on the desktop.

Please post: All RKreport.txt text files located on your desktop.

I ran the frst tool again and attached the new log. This is what it has saved, not renamed. I downloaded the roguekiller, but when I attempt to run it, I can an error that it is not a valid win32 application. There's no option to continue.

OK let's go ahead and at least get the first part of what we will use for the fix started. If all goes well, I will be able to do my double check from the screen shot that you will need to give me from here and we will be on our way. The source of the problem has been identified and it's now a matter of neutralizing it.

1. Preferably from a clean computer, please download the following: gparted-live-0.10.0-3.iso (115 MB)

When you have the .ISO file downloaded, you need to create a bootable disk or flash drive with it, using a clean PC to do that. The .ISO file is a disk image. It should NOT be burned as a regular file. You need a program like BurnAware Free or ImgBurn that can burn an .ISO image. I think a CD is best as there is no way anything can write on it after it is made, but the USB may be more convenient and easier.


2. Now, please boot off of the newly created GParted CD. See How to Set BIOS to Boot from CDROM for information on how to boot from the CD.

You should arrive to the following screen:
[external image: Posted Image]
Press the ENTER key

[external image: Posted Image]
By default, "do not touch keymap" is highlighted. Leave this setting alone and press the ENTER key.

[external image: Posted Image]
Next, choose your language and press the ENTER key. English is the default setting [33]

[external image: Posted Image]
Once again, at this prompt, press the ENTER key.

You will now be taken to the main GUI screen below
[external image: Posted Image]

Please take a picture of this screen (camera or phone pictures will work just fine), and post it here for me to see. It is very important that you complete this step.

Were you able to complete the last steps?