All browsers hijacked - Chameleon fix doesn't work :(

[deccasg]

I seem to have a common problem and hope you guys can help me get my laptop back up and running on the internet. I tried a few self help options posted on the forum but nothing works. Chameleon won't fix the issue either.

 

I'm not sure how or when it happened but all browsers are affected. At the time of writing every attempt to use the internet fails. It won't even allow me to download anything to fix the issue, The brower just crashes or restarts. Firefox is unusable.

 

I've managed to unistall utorrent with Revo but the problem persists. I can't see any other programs that may be causing this.

 

I'm writing this from an unaffected desktop in the hope someone can help ?

 

Thanks in advance

[deccasg]

I seem to have a common problem and hope you guys can help me get my laptop back up and running on the internet. I tried a few self help options posted on the forum but nothing works. Chameleon won't fix the issue either.

 

I'm not sure how or when it happened but all browsers are affected. At the time of writing every attempt to use the internet fails. It won't even allow me to download anything to fix the issue, The brower just crashes or restarts. Firefox is unusable.

 

I've managed to unistall utorrent with Revo but the problem persists. I can't see any other programs that may be causing this.

 

I'm writing this from an unaffected desktop in the hope someone can help ?

 

Thanks in advance

[kevinf80]

Hello and welcome to Malwarebytes,

Please be aware the following P2P/Piracy Warning is a standard opening reply made here at Malwarebytes, we make no accusations but do make you aware of Forum Protocol....

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good...
 

Download the following on your good PC, transfer and run on sick PC. Let me see the logs....

 

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

• Double-click to run it. When the tool opens click Yes to disclaimer.
  (Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
• Make sure Addition.txt is checkmarked under "Optional scans"
• Press Scan button to run the tool....
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The tool will also make a log named (Addition.txt)  Please attach those logs to your reply.
  

 

Thanks,

 

Kevin.....

[deccasg]

Thanks

Addition.txt

FRST.txt

[kevinf80]

Do not see anything obvious in those logs... Run the following:

 

Farbar scanner, for use when connection or redirect issues:

Download Farbar Service Scanner from here: http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/ and run it on the computer with the issue.

Make sure the following options are checked:

• Internet Services
• Windows Firewall
• System Restore
• Security Center/Action Center
• Windows Update
• Windows Defender
  

• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.
  

 

Next,

 

Please download MiniToolBox from here:

http://www.bleepingcomputer.com/download/minitoolbox/dl/65/

Transfer to sick PC save to desktop and run it.

Checkmark the following checkboxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Installed Programs
• List Devices
• List Users, Partitions and Memory size.
• List Minidump Files
• List Restore Points
  

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.
 
Note: When using "Reset FF Proxy Settings" option Firefox should be closed.

 

Let me see those logs....

 

Thank you,

 

Kevin

[deccasg]

thanks

FSS.txt

MTB.txt

[kevinf80]

I want to run FRST from the recovery environment via a USB Flashdrive to restore the last registry backup made by the system, this can only be done via the recovery environment....

 

Please download Farbar Recovery Scan Tool from here:   
                                                                
http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

save it to a USB flash drive. Ensure to get the correct version for your system, 32 bit or 64 bit

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Also save the attached file fixlist.txt (end of reply) to the flashdrive

Plug the flash drive into the infected PC.

If you are using Windows 8 or 10 consult How to use the Windows 8 or 10 System Recovery Environment Command Prompt Here: http://www.howtogeek.com/126016/three-ways-to-access-the-windows-8-boot-options-menu/ to enter System Recovery Command prompt.
 

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type  e:\frst64 or e:\frst depending on your version. Press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Fix button just once and wait.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

When complete boot your system back to normal mode, see how it responds.... Also post the created log.

 

Thank you,

 

Kevin

 

Fixlist.txt

[deccasg]

The files are on a flash drive as instructed but I can't to get to the recovery environment command prompt.

 

I've read the guide to get to the boot options menu and can get to the advanced startup but after selecting troubleshoot the only choice I have is "UEFI Firmware Settings" ??

[kevinf80]

Are you accessing from outside of Windows? have a read here: http://www.tenforums.com/tutorials/2880-command-prompt-boot-open-windows-10-a.html

 

If you still cannot access that way maybe a "Refresh" is the better option...  http://www.tenforums.com/tutorials/4090-refresh-windows-10-a.html

[deccasg]

Apologies but I cannot even get to the option to refresh or reset my laptop no matter which tutorial I try. The options and screenshots in the help pages are not present on my system ??? I'm using Windows 8.1pro.

 

Strangely the browsers are now working but other problems persist.

 

Malwarebytes & Chameleon will not open or they just crash with a WININET.dll error ?

 

Thanks for all your help

[kevinf80]

Thanks for the update, does maybe suggest OS services may have been corrupted or even exploited.... Lets try a clean install of Malwarebytes:

 

Please download MBAM-clean and save it to your desktop.

•    Right-click on mbam-clean.exe icon and select Run as Administrator to start the tool.
•    It will ask you to reboot the machine - please do so.
•    Run the cleaner tool again, re-boot when complete. <<<---do not miss this step
  

Download & install the newset MBAM version.

Please download Malwarebytes Anti-Malware

•    Install the progam and select update.
•    Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
•    In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware.
•    Click the Scan tab, choose Threat Scan is checked and click Scan Now.
•    If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
•    Upon completion of the scan (or after the reboot), click the History tab.
•    Click Application Logs and double-click the Scan Log.
•    At the bottom click Export and choose Text file.
  

Save the file to your desktop and include its content in your next reply.

If you have lost the activation licence key information it can be located here: http://www.cleverbridge.com/342/?scope=cusecolp

 

Next,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:
https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:
https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

The log will include log details for each time MSRT has run, we only need the most recent log by date and time....
 

If successful post those logs, also give another update on any remaining issues or concerns....

 

If Malwarebytes fails just stop and post back... Also do you have access to a USB flashdrive if possible...

 

Thank you,

 

Kevin

[deccasg]

Hi Kevin,

I've downloaded the files as requested and MBAM clean (x2) worked ok.

The latest version of Malwarebytes installs but still fails to start. I get the following error :

 

C:\Windows\SYSTEM32\WININET.dll is either not designed on Windows or it contains an error

 

I have downloaded Microsoft's "Malicious Software Removal Tool" but gone no further.

 

and yes I have a USB flash drive

 

Thanks

[kevinf80]

Do you have access to another PC to create the Widows Defender Offline Tool, I give the instructions to load to a USB flash drive.  It can also be run from a CD, just change to that option in the instructions…
It can be created from the PC with issues, but a different clean PC is preferred!

Download the tool from here :- http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline and save to the Desktop.

You will have to select the correct version for your system, either 32 or 64 bit

Run the tool, Windows 7/8/10 or Vista user right click and select "Run as Administrator"

Read the instructions in the new window and select "Next"



In the new window accept the agreement:



In the new window select your USB Flash Drive, then select "Next"



In the new window ensure you Flash drive is selected, if not click on "Refresh" then select "Next"



In the new window accept the formatting alert by selecting "Next"



Files will be Downloaded:



Files will be processed and created



Flash drive will be formatted and prepared



Files will be added to the Flash Drive and the tool will be created.



The procedure is finished and the Tool created, click on "Finish" to complete.



Plug the USB into the sick PC and boot up, if it does not boot from the flash drive change the boot options as required,  Use F12 as it boots, change options...
As it boots you`ll see files being loaded and the windows splash screen, eventually the tool will run a "Quick Scan" follow the prompts and deal with what it finds.
When complete do a full scan, deal with what it finds.
When finished, remove the USB stick then press the Esc key to boot into regular windows.
Navigate to the following file:

"C:\Windows\Windows Defender Offline\Support\MPLog-MM/DD/YYYY-HH/MM/SS .txt"

Open with notepad and copy and paste it into a reply.
 

Thanks,

 

Kevin..

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!