Google Redirect, Random Audio Advertisements & more fun [Solved]

I did not have access to a clean PC until tonight. I will post everything when I'm done. Thank you so much for all your help.

No issues at all following these instructions or running the applications. I am home again and have access to pc again, so I can respond/follow directions a little faster now. Thank you so much for all your help so far!

You may wish to print these instructions so you will have them available. They MAY not be available to you as you complete the steps below.



Please boot back into the GParted CD, and navigate back into the main GUI screen below

[external image: Posted Image]

According to your logs, the partition that you want to delete is 10 MiB

Please select the partition of that size. Click the trash can icon to delete that partition, and then click Apply.

You should now be here confirming your actions:
[external image: Posted Image]

After clicking Accept, you should be at the following screen:
[external image: Posted Image]

[external image: Posted Image]

Under "Flags", Right-click the 282.98GiB while in GParted and select Manage Flags

In the menu that pops up, place a check mark in boot like the picture below:
[external image: Posted Image]

Now double-click the [external image: Posted Image] button.

You should receive a small pop up like this:
[external image: Posted Image]
Choose reboot and then press OK.


There is a distinct possibility you may have trouble rebooting the machine due to the issues the malware has caused. We have just told the malware it can no longer boot the machine and set the normal partition to boot. However, this may confuse things just a bit. In the even the machine does not boot properly please continue on and follow these instructions:


On reboot, start pressing the F10 key. (If you press it too early you will get the BIOS screen - reboot and try again)

You should get an 'Edit Boot Options' screen.

If it says /minint or int/min after /NOEXECUTE=OPTIN,

hit the Backspace key until that entry reads:

/NOEXECUTE=OPTIN

🖼Click to load external image (Posted Image)

then press Enter. Are you able to boot normally now?

——————————————————
Press the Windows logo key and the R key, type cmd, at the top right-click cmd.exe and choose 'Run as administrator'.

Type or copy/paste the following commands at the command prompt one at a time and press Enter:

bcdedit /enum all >log.log

exit

Press the Windows logo key and the R key and copy/paste the following into the Run box and press Enter:

%userprofile%\log.log

A text file should open. Please post the contents of that file in your next reply.

Note: Do not shut the computer down or you will need to go through the Edit Boot Options again. Just leave the machine on if you can).


If you are still unable to boot the machine even after following these instructions, do not panic please, go to a good machine and let me know.

I was able to complete everything until 'reboot'. When I press F10, it says: BOOTMGR is missing. Press Ctrl+Alt+Del to restart. Pressing this only brings me to the same error. I'm not in a huge panic. Maybe just a little one.

Try rebooting again and start pressing F10 a little sooner see if you can get to the Edit Boot Options. If not, let me know if you still have that Recovery CD we made from the other machine handy. Don't use it yet just let me know. I don't think you got the F10 in there fast enough and it actually tried to boot when we knew it would have issues.

I still get the same error. I can access the set up menu with f2 tho. I also still have the cd.

Let's go ahead and try the easy fix first (this may or may not work but let's give it a shot).

Insert the system repair disc you created into your CD or DVD drive.

Restart your computer using the computer's power button.

If prompted, press any key to start the computer from the system repair disc. (If your computer isn't configured to start from a CD or DVD, check the information that came with your computer. You might need to change your computer's BIOS settings.)

Select the recovery option in the window that comes up (it says to use recovery tools to help fix problems).

On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt


Please select the Startup Repair and see if this will complete. If it does, please try rebooting again and doing the steps for the F10 Edit Boot Menu to get that log file for me. If it won't complete, please let me know.

Windows Boot Manager ——————– identifier {bootmgr} device partition=C: path \bootmgr description Windows Boot Manager locale en-US default {current} displayorder {current} timeout 30 Windows Boot Loader ——————- identifier {current} device partition=C: path \Windows\system32\winload.exe description Windows 7 Home Premium (recovered) locale en-US recoverysequence {2c21a494-1324-11e2-a7dd-826bce51a832} recoveryenabled Yes osdevice partition=C: systemroot \Windows resumeobject {6c2b802a-1303-11e2-9d04-806e6f6e6963} Windows Boot Loader ——————- identifier {2c21a494-1324-11e2-a7dd-826bce51a832} device ramdisk=[C:]\Recovery\1ff76ed7-2c1d-11e1-8d06-da8da64154b0\Winre.wim,{2c21a495-1324-11e2-a7dd-826bce51a832} path \windows\system32\winload.exe description Windows Recovery Environment (recovered) locale osdevice ramdisk=[C:]\Recovery\1ff76ed7-2c1d-11e1-8d06-da8da64154b0\Winre.wim,{2c21a495-1324-11e2-a7dd-826bce51a832} systemroot \windows winpe Yes Resume from Hibernate ——————— identifier {6c2b802a-1303-11e2-9d04-806e6f6e6963} device partition=C: path \Windows\system32\winresume.exe description Windows 7 Home Premium (recovered) locale en-US inherit {resumeloadersettings} filedevice partition=C: filepath \hiberfil.sys debugoptionenabled No Windows Memory Tester ——————— identifier {memdiag} device partition=C: path \boot\memtest.exe description Windows Memory Diagnostic locale en-US Device options ————– identifier {2c21a495-1324-11e2-a7dd-826bce51a832} ramdisksdidevice partition=C: ramdisksdipath \Recovery\1ff76ed7-2c1d-11e1-8d06-da8da64154b0\boot.sdi

Well, if that's the entire log, I'm not seeing any remnants of the infection. Let's go ahead and try a normal reboot and see what happens.. Let me know how that goes. *Fingers Croseed*

I can login with no issues. I have no more re-directs and no crazy audio in the background. Everything is running at normal speeds again too. Does this mean I'm all clear!? You are amazing! Thank you so much for all your help!

I'm certainly VERY happy to hear the signs of infection appear to be gone but that doesn't mean we are quite done yet Just one more scan to ensure we are good and then some clean up.

And you are most welcome for the help (my colleagues get a little credit for some of the advice they gave me on this too). That's what we are here for. You deserve a lot of credit for your patience and diligence too. This has been a very stubborn one to track down and you'be done a very good job! The rest will be a piece of cake compared to what you've done so far!


This scan make take awhile depending on how many items are on the computer. You may want to run it at a time you won't be needing the machine. It should be run from IE and I'd recommend not doing anything else while it's running.


Go here to run an online scannner from ESET.

• Note: For browsers other than Internet Explorer, you will need to download and install esetsmartinstaller_enu.exe. Click on it and save the file to a convenient location. Double click on it to install and a new window will open.
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
• Copy and paste that log as a reply to this topic and also let me know how things are now.

Have you had time to run those last scans so I can make sure we are all clear?

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.