Redirect Virus Again !

[SteveinNC123]

Hello kind folks at MWB. I'm glad you are here. MWB is my primary malware fix but still have the redirect virus after many other popular fixes available haven't worked. MWB scan and others have not picked it up.

Please have a look.

Thanks a lot.

Steve in Greensboro, NC

attach.txt

dds.txt

[Elise]

Hello and

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• If TDSSKiller does not run, try renaming it.
  
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  
• Click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.

[SteveinNC123]

Thanks for your reply. I have run the TDSSKiller. Still have the problem. The txt file is attached.

TDSSKiller.2.7.32.0_24.04.2012_11.52.30_log.txt

[SteveinNC123]

Additional - As a a result of my attempt to correct this problem I did run the TDSSKiller on 4/23/12 it is attached for reference.

I also accessed C:\WINDOWS\system32\drivers\etc and deleted the thousands of entries made by Spybot S&D. The file is attached for reference.

Still have the problem with FF Google and FF Yahoo. I don't use IE.

TDSSKiller.2.7.31.0_23.04.2012_09.22.54_log.txt

hosts.txt

[SteveinNC123]

Also fyi I have removed a wireless router and a voip / ata from the loop. Did this yesterday after my attempt to repair. Your instructions to run TDSS were done after removal of these devices. Still have the problem however.

[Elise]

Hi, just for testing could you please see if you are redirected also in IE?

COMBOFIX

---------------

Please download ComboFix from one of these locations:

• 
  

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

[SteveinNC123]

Prior to running Combo fix I test IE and Opera and both have the redirect problem.

I initially ran Combofix and it went through the steps but didn't complete or make a log file ? So I ran it again. This time it did run in its entirety - looks like it deleted some stuff or did all what it was supposed to do - the txt file is attached.

Note: upon restarting my pc - in the system tray the AVG (8.5) icon was shielded / disabled as per Combofix instructions. I wanted to reactivate it as Combofix was complete. Upon opening the AVG interface from the system tray my pc went into "restart". Tried again - same thing. I went to >cp > add / remove programs > deleted the AVG program. I activated free Ad-Aware Pro I downloaded a few days ago it to try to fix the redirect problem. I have it running at this time. Hope I can go back / reinstall AVG in the future ?

I've checked out FF - still have the redirect problem

Thanks for checking this all out.

ComboFix.txt

[Elise]

Hi again,

Your version of AVG was outdated so I recommend to uninstall and update it in any case. AdAware has also antivirus components, so you shouldn't have both at a time installed as that will decrease performance and leave your computer vulnerable.

CF-SCRIPT

-------------

We need to execute a CF-script.

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

File::
c:\windows\Tasks\KRRPXYATXL.job
c:\windows\system32\mspmsnsv6.dll

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[SteveinNC123]

I saved the CFScript.txt as instructed to C: drive. I then placed the file on the desktop where the ComboFix.exe is.

I dragged the CFScript.txt into the ComboFix and did "Run". It started to run - got to the C; scan and a dialog box appeared and said "Were you trying to run CFScript ? The name CFScript appears to be incorrectly spelt ? I checked C: just to check if the ComboFix.txt was still there or if by chance a new text file was created. The CFScript.txt was there but the ComboFix.txt was missing. I replaced it with the ComboFix.txt file on the above post. I re-tried this all again.....same results. I also replaced again the original ComboFix.txt to C drive - it is there now. Both files are attached for reference.

Please advise.

CFScript.txt

ComboFix.txt

[Elise]

Download the CFScript.txt file from last post and try again to drag/drop it onto combofix.exe. See if it runs now.

[SteveinNC123]

It did run. Attached is the log.

ComboFix.txt

[Elise]

Hi, that looks good now! How is everything running?

P2P WARNING

-------------------

Going over your logs I noticed that you have BitTorrent installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  
• They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.

I would recommend that you uninstall BitTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Your version of Adobe Reader is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Adobe components and update:

• Download the latest version of Adobe Reader Version X. and save it to your desktop.
  
• Uncheck the "Free McAfee Security plan Plus" option or any other Toolbar you are offered
  
• Click the download button at the bottom.
  
• If you use Internet Explorer and do not wish to install the ActiveX element, simply click on the click here to download link on the next page.
  
• Remove all older version of Adobe Reader: Go to Add/remove and uninstall all versions of Adobe Reader, Acrobat Reader and Adobe Acrobat.
  If you are unsure of how to use Add or Remove Programs, the please see this tutorial:How To Remove An Installed Program From Your Computer
  
• Then from your desktop double-click on Adobe Reader to install the newest version.
  If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  
• When the "Adobe Setup - Welcome" window opens, click the Install > button.
  
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  

Your Adobe Reader is now up to date!

Please launch MBAM, update it and run a full scan. Post me the resulting log.

[SteveinNC123]

Upon the last post I figured I better see if things have been corrected ?

Sure enough.....all fixi now on FF, IE and Opera.

I'll remove and update as you suggested.

Thanks a lot !

Steve in North Carolina

[SteveinNC123]

MWB log attached...after last fix

mbam-log-2012-04-25 (13-06-03).txt

[Elise]

Hi Steve, I'm glad to hear that!

Lets do one last check before calling it clean.

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

1. Hold down Control and click on this link to open ESET OnlineScan in a new window.
   
2. Click the button.
   
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. 
      
   2. Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
      
   3. Double click on the
      icon on your desktop.
      
      
   4. Check "YES, I accept the Terms of Use."
      
   5. Click the Start button.
      
   6. Accept any security warnings from your browser.
      
   7. Under scan settings, check "Scan Archives" and "Remove found threats"
      
   8. Click Advanced settings and select the following:
      • Scan potentially unwanted applications
        
      • Scan for potentially unsafe applications
        
      • Enable Anti-Stealth technology

[*]ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

[*]When the scan completes, click List Threats

[*]Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

[*]Click the Back button.

[*]Click the Finish button.

[SteveinNC123]

In progress......

[Elise]

Take your time!

[SteveinNC123]

I ran the eset as you said. The txt is attached.

While running the eset --- the new version of AVG I downloaded was running too. Was not sure if it was to be off. You did not specify.

At the 88% progress bar on eset 2 infected files showed up --- also at that moment the AVG popped open with a threat too. I closed the AVG --- the eset completed also.

I looked at the AVG history / file for a record. It is attached too. It is in the vault. I can delete / empty the vault to get rid of it I believe ?

If I need to run eset with AVG off again I can do so if it is best.

EsetScan042512.txt

AVG Scan 042512.doc

[SteveinNC123]

Forgot to include this from AVG history ------ See attachment also

"4/25/2012, 11:09:09 AM";"NT AUTHORITY\SYSTEM";"General";"AVG is starting."

"4/25/2012, 11:09:11 AM";"NT AUTHORITY\SYSTEM";"General";"AVG is running."

"4/25/2012, 11:11:49 AM";"NT AUTHORITY\SYSTEM";"Update";"Update was started."

"4/25/2012, 11:13:59 AM";"NT AUTHORITY\SYSTEM";"Update";"Update completed."

"4/25/2012, 11:51:45 AM";"NT AUTHORITY\SYSTEM";"IDP";"Process rundll32.exe was detected."

"4/25/2012, 11:51:55 AM";"NT AUTHORITY\SYSTEM";"IDP";"Process rundll32.exe was added to the allowed list."

AVG Resident Shield shows Eset.txt

[SteveinNC123]

Fwiw I ran Eset again this time with AVG off. No threats was the result. No option for a log file. See screen shot attached.

EsetScanNoThreats042512.doc

[Elise]

AVG detected the files ESET was scanning, so no need to worry about that.

ALL CLEAN

--------------

Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean

Please do the following to remove the remaining programs from your PC:

• Delete the tools used during the disinfection:
  • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
    

Please read these advices, in order to prevent reinfecting your PC:

1. Install and update the following programs regularly:
   • an outbound firewall. If you are connected to the internet through a router, you are already behind a hardware firewall and as such you do not need an extra software firewall.
     A comprehensive tutorial and a list of possible firewalls can be found here.
     
   • an AntiVirus Software
     It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
     
   • an Anti-Spyware program
     Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
     SUPERAntiSpyware is another good scanner with high detection and removal rates.
     Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
     
   • Spyware Blaster
     A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
     

[*]Keep Windows (and your other Microsoft software) up to date!

I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!

[*]Keep your other software up to date as well

Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.

[*]Stay up to date!

The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.

Some more links you might find of interest:

• Miekies' prevention suggestions
  
• So How did I get infected?
  
• Microsoft - 'Security at home'
  
• Calendar of Updates: See which updates have been released.
  
• How to backup your Data with Cobian Backup:because you never know, when your harddisk might fail :wink:
  
• Commonly Used Freeware Replacements: a nice list of freeware programs in all categories, that are regarded as useful by the users of this forum.
  
• osalt: Find (free) open source alternatives to known commercial software.

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

[SteveinNC123]

All is done. I appreciate it a lot.

[Elise]

You are most welcome!

I will request this topic to be closed.

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!