Hijacked Search results and browser shutting

scipilot · March 25, 2009

Really do appreciate your help guys, I have had a search result hijack for ages now, tried all the usual and even lost

Fatdcuk · March 25, 2009

Hi ya,

I need you to run a couple of tools for me and post back all logs

1)STEP 01

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

2)Please download GooredFix and save it to your Desktop.

http://jpshortstuff.247fixes.com/GooredFix.exe

Select "2. Fix Goored" by typing 2 and pressing Enter.

Make sure all instances of Firefox are closed at this point.

Type y at the prompt and press Enter again.

A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: If you receive a message saying that GooredFix needs your system to be restarted, please close all applications and reboot your system. Please also allow any registry changes that may be prompted by any of your security programs.

scipilot · March 25, 2009

Hi and thanks for your help.

1st problem I have is trying to read the how to use instructions for combofix, clicking the link you added above 'how-to-use-combofix' closers my broswer, tried copying the url into AOL and that completly shuts AOL down.

Fatdcuk · March 25, 2009

Ok go with the GooredFix first

scipilot · March 25, 2009

Done, see report below:

GooredFix v1.92 by jpshortstuff

Log created at 23:01 on 25/03/2009 running Option #2 (Compaq_Administrator)

Firefox version 3.0.7 (en-GB)

=====Goored Deletions=====

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]

"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]

"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]

"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]

"{1d5287d1-8a92-0001-1f31-1cec198018d8}"="C:\Program Files\AVG\AVG8\ToolbarFF"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]

"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG8\Firefox"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]

"{20a82645-c095-46ed-80e3-08825760534b}"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\"

Fatdcuk · March 25, 2009

Lets try again with Combofix run but this time use InternetExplorer as browser and not the AOL browser.

scipilot · March 25, 2009

Tried again using I.E still closes the browser.

Thanks.

scipilot · March 26, 2009

Got in via another PC, will post report when done as requested.

scipilot · March 26, 2009

OK, got the instructions from another PC, followed then:

- closed all anti virus programmes and windows firewall

- downloaded ComboFix to my desktop

- closed all windows and double clicked ComboFix

- Clicked Run

I now get this message ' Errors encountered while performing the operation Look at the information window for more details. If I click OK there is just a small box with ComboFix written above a row of green lines.

Reboot is needed to clear it.

Fatdcuk · March 26, 2009

Ok something definetly not letting me unpack my toolkit on your pc but hey i love a challenge

Time to bring is some powerful tools and see if we can crack it!

1) Download the following tool and only use as directed!

http://rootrepeal.googlepages.com/

Install RootRepeal and select *Report* scan only.Next place tick in all box's except for SSDT report.Next press scan and then save the log generated.

Please Copy and Paste the output log generated in a reply post.

2nd report log needed-

Download and install Autoruns.

http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx

When you first run it it will generate an extensive listing and the word "Ready" will appear in the bottom left of the sofware GUI.

At this point goto options and place check(tick) against verify coded signatures and hide Microsoft & windows entries.Next press F5 button to refresh.

Once Ready status by software is gained then goto File option.Select "Export as" and save output file as Autoruns.txt

Can you please then copy and paste the contents of that text file into your next reply for analysis.

scipilot · March 26, 2009

OK, stuck on the 1st hurdle again downloaded rootrepeal but see no *Report* option etc, see image.

1) Download the following tool and only use as directed!

http://rootrepeal.googlepages.com/

Install RootRepeal and select *Report* scan only.Next place tick in all box's except for SSDT report.Next press scan and then save the log generated.

Fatdcuk · March 26, 2009

Hi you need to extract rootrepeal and then run rootrepeal.exe

scipilot · March 26, 2009

you need to extract rootrepeal and then run rootrepeal.exe

Sorry having a dumb blonde day, not seeing your screen and can't see how to extract

Fatdcuk · March 26, 2009

No worries.

Download and save file from link to your desktop.

Next right click on file and select extract(Winrar) and then confirm(OK).

This will create new folder on desktop that has been decompressed from the downloaded file.Go into that folder and click on Rootrepeal .exe to run it .

scipilot · March 26, 2009

OK, figured that out by searching your forum

Now I see this when double clicking the extraced rootrepeal file. (got any headache tablets) ?

scipilot · March 26, 2009

OK, I went throught the process again, this time I clicked the 'OK' button and cleared the box above, clicked' Reports' then SCAN then selected as you have in your image.

POP PC switched off and rebooted back to my desktop

scipilot · March 26, 2009

Right I took the bit between the teeth are retried, See log below

ROOTREPEAL © AD, 2007-2008

==================================================

Scan Time: 2009/03/26 20:10

Program Version: Version 1.2.3.0

Windows Version: Windows XP Media Center Edition SP3

==================================================

Drivers

-------------------

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xF2C9E000 Size: 98304 File Visible: No

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF7AF2000 Size: 8192 File Visible: No

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xB9B65000 Size: 45056 File Visible: No

Status: -

Hidden/Locked Files

-------------------

Path: C:\Documents and Settings\All Users\Application Data\AOL\storage\server.lock

Status: Allocation size mismatch (API: 8, Raw: 0)

Path: C:\Documents and Settings\Compaq_Administrator\Local Settings\Apps\2.0\CL0Z8EA0.Y16\320N6JQ6.BXA\manifests\clickonce_bootstrap.exe.cdf-ms