Infected with google redirect virus

[kgauger30]

I ran Malwarebytes updated and all and it does not find anything at all. I ran another program called SpyHunter 4 and it found all kinds of things including a Google Redirect virus. My antivirus program (AVG Free) is not finding it and neither is Malwarebytes. However this other program wants to charge me $29.99 to clean it up. Idon't have that money right now. Can someone help me solve my problem? I can usually do this without help, but I don't know what to do now... I am running in Safe Mode.

I did the log thing it told me to do in the sticky. I will attach. I don't know what ANY of it means!

Attach.txt

[kgauger30]

I didn't attach the DDS file. Here it is sorry.

[kgauger30]

It would have helped if I hit attach. I'm sorry everyone. This virus has me all messed up I can't think.

DDS.txt

[CatByte]

Please run the following:

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
  
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
  

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

[kgauger30]

Thank you! I am in the middle of my first scan now. It has found 1 malware so far. It is taking forever though because I have alot of files for it to go through. I will post my logs when it is done. Thank you again for taking the time to write me.

[kgauger30]

Here are the logs. It seems to have taken care of it. Thank you so much for all of your assistance! Please let me know if you find something in the logs that i need to take care of.

~Kim

mbar-log-2013-01-20 (15-52-56).txt

mbar-log-2013-01-20 (16-50-23).txt

system-log.txt

[CatByte]

there are a couple more scans I'd like you to run just to make certain there are no leftovers, so stay with me till i give the "all clean"

please run the following:

Refer to the ComboFix User's Guide

1. Download ComboFix from the following location:
   Link
   * IMPORTANT !!! Place ComboFix.exe on your Desktop
   
2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
   You can get help on disabling your protection programs here
   
3. Double click on ComboFix.exe & follow the prompts.
   
4. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
   
5. When finished, it shall produce a log for you. Post that log in your next reply
   Note:
   Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
   ---------------------------------------------------------------------------------------------
   
6. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
   ---------------------------------------------------------------------------------------------

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

[kgauger30]

I ran that.. Here is the log

combofix.txt

[CatByte]

Please run the following:

Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
  
• Right-mouse click JRT.exe and select Run as administrator
  
• The tool will open and start scanning your system.
  
• Please be patient as this can take a while to complete.
  
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  
• Post the contents of JRT.txt into your next message
  

NEXT

Download AdwCleaner from here and save it to your desktop.

• Run AdwCleaner and select Delete
  
• Once done it will ask to reboot, allow the reboot
  
• On reboot a log will be produced, please attach the content of the log to your next reply
  

NEXT

• Please open your MalwareBytes AntiMalware Program
  
• Click the Update Tab and search for updates
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish, so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected. <-- very important
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
  
• Tick the box next to YES, I accept the Terms of Use.
  
• Click Start
  
• When asked, allow the activeX control to install
  
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  
• Click Scan
  
• Wait for the scan to finish
  
• When the scan completes, press the LIST OF THREATS FOUND button
  
• Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  
• Include the contents of this report in your next reply.
  
• Press the BACK button.
  
• Press Finish
  

[kgauger30]

Got it.. Working on it now, will report back when finished.

[kgauger30]

JRT results below. I am starting on the next step now.

JRT.txt

[kgauger30]

# AdwCleaner v2.106 - Logfile created 01/21/2013 at 09:25:53

# Updated 17/01/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Kim Lptop - KIMLPTOP-HP

# Boot Mode : Normal

# Running from : C:\Users\Kim Lptop\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted : HKCU\Software\IGearSettings

Key Deleted : HKCU\Software\InstallCore

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\Software\MetaStream

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP

Key Deleted : HKLM\Software\Viewpoint

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Google Chrome v [unable to get version]

File : C:\Users\Kim Lptop\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [3455 octets] - [21/01/2013 09:25:03]

AdwCleaner[s1].txt - [3460 octets] - [21/01/2013 09:25:53]

########## EOF - C:\AdwCleaner[s1].txt - [3520 octets] ##########

[kgauger30]

This is my Malwarebytes run

mbam-log-2013-01-21 (09-49-37).txt

[CatByte]

looking better

the ESET scan can take several hours to complete

(my apologies for the wait, for some reason I didn't get the notification of your reply?)

while you are waiting for ESET to complete, please advise how the computer is running now and if there are any outstanding issues

[kgauger30]

Yes that ESET scan is taking forever!! I thought I could go to the grocery and come back and it would be done.. Boy I was wrong. It is running great so far. Thanks for taking the time to help me out! Are these steps good to clean out if I get a virus again?

[CatByte]

Are these steps good to clean out if I get a virus again?

No, every infection is different, plus the tools are updated very frequently so they need to be removed, then downloaded again if required in the future. I have a clean up routine at the end to clean up the tools, so once we see what eset turns up, there may be a little more work to do.

[kgauger30]

It is only at 16% but it has found a virus already. It has found a win32/TrojanDownloader.tracur.V trojan

[CatByte]

don't get too concerned yet, it may already be in quarantine

[kgauger30]

Gotcha! 5 hours in and only at 23%.. ughhhhh I have alot of files I guess

[kgauger30]

Finally finished.. Found one item here is the log..

ESET.txt

[kgauger30]

Question for you. I noticed that the virus file was an apple file (surprising to me) Can this affect my iPhone? I have noticed it is running very slow as of late, and just wanted to ask..

[CatByte]

The infected file actually had nothing to do with Apple, it named itself that as it's disguise

Please run the following:

Visit ADOBE and download the latest version of Acrobat Reader (version XI)

Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Go to this site and click on "Do I have Java"
  
• It will check your current version and then offer to update to the latest version
  
• Watch for and make sure you untick the box next to whatever free program they prompt you to install during the installation, unless you want it.
  

Note: Check in Programs and Features (or Add/Remove Programs if you are an XP user) to make certain there are no old versions of Java still installed, if there are - remove them.

NEXT

Please advise how the computer is running now and if there are any outstanding issues

[kgauger30]

Ok I have updated the Acrobat Reader with no problems. However, everytime I try to do the JAVA it freezes the website and closes. Should I uninstall Java completly and reinstall?

[CatByte]

yes, please give that a try

you may need to use the Revo uninstaller

Download and install the Revo Uninstaller

• Double click the new Revo Uninstaller icon on your desktop to start the program
  
• Scroll through the listed programs and Right Click on the program you wish to uninstall (Java)
  
• From the pop out menu choose Uninstall
  
• Click Yes to the confirmation dialogue
  
• In the next window select the safe mode
  
• Click Next to start uninstalling the program
  
• Answer Yes to confirm the uninstall
  
• When the program has completed the four steps, click Next to allow the program to search for leftovers
  
• Once complete, click Next, then Finish
  
• Repeat the above steps for any other programs you wish to remove.
  

[kgauger30]

Got it! Uninstalled and reinstalled the current version. Now up to date on both.