[Closed] Search engine jumps to unwanted site

I got the following when exiting the web iexplore.exe-Application error The instruction at "0x0034aa484 referenced memory at 0x03222188" The memory could not be read. Click on OK to terminate program the same then occurred with 0x7c9100c8 0x03220010

Hi tax-bill,

Don't worry about that error for now, lets get you totally clean first, then we'll address it.

I would like you to run a couple more scans to make sure we have eradicated everything.

Please do this:


Download Malwarebytes' Anti-Malware and save to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to:
  
  Update Malwarebytes' Anti-Malware
  Launch Malwarebytes' Anti-Malware
  
• Then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform Quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked and click Remove Selected.<–very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


NEXT

I would like you to do an online scan

Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

In your next response I need

• MBAM log
• Kaspersky log

Also, please advise how your computer is running now

I ran the malaware and got the log below. However when I tried to run Kaspersky. I was not prompted to install and didn't click run - it just ran. I had disabled the virusscan on the computer - was this correct? It downloaded for about 15 minutes, I left it downloading for a couple of minutes to return to find the following message Update has failed to start. Close the Kaspersky online scanner 7.00 window and open it again to instal the program ……. ………..(Error: invalide file signature) After I close the window I got McAfee notice Virus protection it might be out of date. Windows does not detect any antivirus program. - I had by this time enabled the McAfee virusscan but had not restarted my computer. Malwarebytes' Anti-Malware 1.33 Database version: 1749 Windows 5.1.2600 Service Pack 3 11/02/2009 14:44:28 mbam-log-2009-02-11 (14-44-28).txt Scan type: Quick Scan Objects scanned: 59483 Time elapsed: 3 minute(s), 21 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Hi tax-bill,

Lets do this instead:

Please click here to download AVP Tool by Kaspersky.

• Save it to your desktop.
• Reboot your computer into SafeMode.
  

  You can do this by restarting your computer and continually tapping the F8 key until a menu appears.
  Use your up arrow key to highlight SafeMode then hit enter.

• Double click the setup file to run it.
• Click Next to continue.
• It will by default install it to your desktop folder. Click Next.
• Hit OK at the prompt for scanning in Safe Mode.
• It will then open a box. There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.

• System Memory
• Startup Objects
• Disk Boot Sectors.
• My Computer.
• Also any other drives (Removable that you may have)

• Then click on Scan at the top right hand Corner.
• It will automatically Neutralize any objects found.
• If some objects are left unneutralized then click the button that says Neutralize all
• If it says it cannot be Neutralized then choose the delete option when prompted.
• After that is done click on the reports button at the bottom and save it to file, name it Kas.
• Save it to your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.
  
  

  Note: This tool will self uninstall when you close it so please save the log before closing it.

I havn't run Kaspersky yet as when I downloaded to my desktop I got the message Internet explorer script error Line 53 char 3 Error object required Code 0 URC http:/ftp.kaspersky.com/dev builds/AVP tool/ Do you want to continue runing scripts on this page

Yes, Please run the tool….it is safe to run…..

Scan —- Scanned: 224609 Detected: 7 Untreated: 0 Start time: 13/02/2009 19:33:44 Duration: 04:24:15 Finish time: 13/02/2009 23:57:59 Detected ——– Status Object —— —— deleted: Trojan program Backdoor.Win32.TDSS.asz File: C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSbrsr.dll.vir deleted: Trojan program Backdoor.Win32.TDSS.blh File: C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSoiqh.dll.vir deleted: Trojan program Rootkit.Win32.TDSS.dbg File: C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSxfum.dll.vir deleted: Trojan program Backdoor.Win32.TDSS.bkw File: C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\TDSSmqlt.sys.vir deleted: Trojan program Trojan.Java.ClassLoader.as File: D:\Documents and Settings\Bill\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-43a3a395-51d8024c.zip/BnnnnBaa.class deleted: Trojan program Trojan.Java.ClassLoader.as File: D:\Documents and Settings\Bill\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-43a3a395-51d8024c.zip/VaannnaaBaa.class deleted: Trojan program Trojan.Java.ClassLoader.as File: D:\Documents and Settings\Bill\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-43a3a395-51d8024c.zip/Bnnnnn.class Events —— Time Name Status Reason —- —- —— —— Statistics ———- Object Scanned Detected Untreated Deleted Moved to Quarantine Archives Packed files Password protected Corrupted —— ——- ——– ——— ——- ——————- ——– ———— —————— ——— Settings ——– Parameter Value ——— —– Security Level Recommended Action Prompt for action when the scan is complete Run mode Manually File types Scan all files Scan only new and changed files No Scan archives All Scan embedded OLE objects All Skip if object is larger than No Skip if scan takes longer than No Parse email formats No Scan password-protected archives No Enable iChecker technology No Enable iSwift technology No Show detected threats on "Detected" tab Yes Rootkits search Yes Deep rootkits search No Use heuristic analyzer Yes Quarantine ———- Status Object Size Added —— —— —- —– Backup —— Status Object Size —— —— —-

Hi tax-bill,

Just a little more work to do….hopefully AVP got rid of the last of the infection, but we need to make sure, so stay with me.

Please download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a number of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

• Post the contents of GMER.txt in your next reply.

IMPORTANT - please advise how your computer is running now and any outstanding issues you may be having.

Hi tax-bill, How are you getting on. If the instructions are unclear or you are having other issues with your machine, please advise. Thanks CB

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log