Help with Google Re-directs

adrianna · May 14, 2010

Hi--I'm having problems removing some sort of virus that causes my google searches to be re-directed to random sites. I can only access the intended website after going back and clicking it a second time. Malwararebytes removed a few things, but I'm stilling having this problem with the internet searches. Can someone pleeease help me with this?

Thanks in advance!

Maniac · May 14, 2010

Hello adrianna! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.

Please follow these instructions:

http://forums.malwarebytes.org/index.php?showtopic=9573

adrianna · May 15, 2010

Hello adrianna! Welcome to MalwareBytes' Anti-Malware Forums!
My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:
The process of cleaning your system may take some time, so please be patient.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Please follow these instructions:
http://forums.malwarebytes.org/index.php?showtopic=9573

Hi Borislav--Thanks for assisting me with this issue, I am most appreciative!

I'm now ready to run DDS, can you please tell me how to disable "script blocker"?

Thanks!

Adrianna

Maniac · May 15, 2010

Skip this step with script blocker.

adrianna · May 17, 2010

I ran Avira and it removed 2 viruses, but the re-directs continued. I've attached the MBAM log and after several attempts, I finally got GMER to run on my computer. However, I wasnt able to run DDS...Please let me know what I should do next.

Thanks in advance!

Adrianna

mbam_log_2010_05_14__19_05_27_.zip

Maniac · May 19, 2010

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Open Tools -> Options -> Main tab
- Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

adrianna · May 20, 2010

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **
Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.
Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.
Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.
Please download ComboFix from
Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
If you are using Firefox, make sure that your download settings are as follows:
Open Tools -> Options -> Main tab
Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:
[*]It is important you rename Combofix during the download, but not after.
[*]Please do not rename Combofix to other names, but only to the one indicated.
[*]Close any open browsers.
[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
-----------------------------------------------------------

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.
[*]When finished, it will produce a report for you.
[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

I have completed the Combofix scan and posted the log. How does is it look?

Thanks again for helping me with this!

Adrianna

combofix_log.txt

Maniac · May 20, 2010

Looks bad, but don't worry

Step 1:

First of all, you should not have more than one anti-virus program installed as they will conflict and cause problems. You have two so you need to uninstall one of them. Of the two, I would recommend keeping Avira Antivir , so please uninstall McAfee software .

Step 2:

Open Notepad and copy and paste the text in the code box below into it:

http://forums.malwarebytes.org/index.php?showtopic=50623

KillAll::

Collect::[8]
c:\program files\Common Files\jabydege.exe
c:\program files\Common Files\lolomepidy.sys
c:\program files\Common Files\jynim.scr
c:\program files\Common Files\byjukakivu.scr
c:\program files\Common Files\cudysylira.bat
c:\program files\Common Files\wequgave.dl
c:\program files\Common Files\pihytedit.lib
c:\program files\Common Files\piwo.dl
c:\program files\Common Files\otor.dll
c:\program files\Common Files\efypib.pif
c:\program files\Common Files\ubovegywe.reg
c:\program files\Common Files\avuje.inf
c:\program files\Common Files\inutysyp.dll
c:\program files\Common Files\akyjowiki.bat
c:\program files\Common Files\uhecapaqy.lib
c:\windows\system32\gomukamu.exe
c:\windows\system32\yibulura.exe
c:\windows\system32\zejazogi.exe
c:\windows\Tasks.\hdfrezmf.job

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>

TDL::
C:\WINDOWS\system32\drivers\atapi.sys

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

adrianna · May 20, 2010

Looks bad, but don't worry
Step 1:
First of all, you should not have more than one anti-virus program installed as they will conflict and cause problems. You have two so you need to uninstall one of them. Of the two, I would recommend keeping Avira Antivir , so please uninstall McAfee software .
Step 2:
Open Notepad and copy and paste the text in the code box below into it:
http://forums.malwarebytes.org/index.php?showtopic=50623

KillAll::

Collect::[8]
c:\program files\Common Files\jabydege.exe
c:\program files\Common Files\lolomepidy.sys
c:\program files\Common Files\jynim.scr
c:\program files\Common Files\byjukakivu.scr
c:\program files\Common Files\cudysylira.bat
c:\program files\Common Files\wequgave.dl
c:\program files\Common Files\pihytedit.lib
c:\program files\Common Files\piwo.dl
c:\program files\Common Files\otor.dll
c:\program files\Common Files\efypib.pif
c:\program files\Common Files\ubovegywe.reg
c:\program files\Common Files\avuje.inf
c:\program files\Common Files\inutysyp.dll
c:\program files\Common Files\akyjowiki.bat
c:\program files\Common Files\uhecapaqy.lib
c:\windows\system32\gomukamu.exe
c:\windows\system32\yibulura.exe
c:\windows\system32\zejazogi.exe
c:\windows\Tasks.\hdfrezmf.job

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>

TDL::
C:\WINDOWS\system32\drivers\atapi.sys
Save the file to your desktop and name it CFScript.txt
Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.
This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.
Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

Hey there!

Here's the log...hope it looks better!

Thanks!

Adrianna

ComboFix.txt

Maniac · May 20, 2010

Perfect!

Please visit this website: Submit Malware Sample
Against the inscription: "Link to topic where this file was requested:", insert links pointing to this topic in our forum.
Against the inscription: "Browse to the file you want to submit:", click on the Choose... button.
Navigate to the following file: C:\Qoobox\Quarantine\[8]-Submit_date_time.zip (date_time will be replaced with the date and time when this file was created)
Against the inscription: "Leave any comments, further information about this file, or contact information:" should be written as follows:
Sent at the request of Borislav.
Once you're ready, click the Send File button.

Let me know how are things now.

adrianna · May 20, 2010

Perfect!
Please visit this website: Submit Malware Sample
Against the inscription: "Link to topic where this file was requested:", insert links pointing to this topic in our forum.
Against the inscription: "Browse to the file you want to submit:", click on the Choose... button.
Navigate to the following file: C:\Qoobox\Quarantine\[8]-Submit_date_time.zip (date_time will be replaced with the date and time when this file was created)
Against the inscription: "Leave any comments, further information about this file, or contact information:" should be written as follows:
Once you're ready, click the Send File button.
Let me know how are things now.

File has been sent, as requested. Also, I'm not getting the re-directs anymore & my internet seems to run faster!...does this mean my pc is clean?

Maniac · May 20, 2010

One last log please:

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.

Please go here then click on:
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install.
Now click on Advanced Settings and select the following:

- Remove found threats
- Scan archives
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology

[*]Now click on:

[*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.

[*]When completed the Online Scan will begin automatically.

[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.

[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!

[*]Now click on:

[*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.

[*]Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

adrianna · May 20, 2010

One last log please:
ESET Online Scanner
Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.
Please go here then click on:
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install.
Now click on Advanced Settings and select the following:
Remove found threats
Scan archives
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
[*]Now click on:
[*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
[*]When completed the Online Scan will begin automatically.
[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
[*]Now click on:
[*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
[*]Copy and paste that log as a reply to this topic.
Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Ok, here's the ESET log...

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=7.00.6000.17023 (vista_gdr.100222-0012)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=9c82ff6ee3d73d44a4c37eb6df03c9e8

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2010-05-20 09:57:43

# local_time=2010-05-20 04:57:43 (-0600, Central Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1797 16775141 100 93 0 32533760 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=91431

# found=0

# cleaned=0

# scan_time=5198

Maniac · May 21, 2010

Good work!

Last steps:

Step 1:

* Go to start > run and copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Step 2:

Please manually delete DDS, GMER and TDSSKiller.

Step 3:

Some final steps:

http://miekiemoes.blogspot.com/2008/02/how...nt-malware.html

Safe surfing!

adrianna · May 24, 2010

Good work!
Last steps:
Step 1:
* Go to start > run and copy and paste next command in the field:
ComboFix /uninstall
Make sure there's a space between Combofix and /
Then hit enter.
This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.
Step 2:
Please manually delete DDS, GMER and TDSSKiller.
Step 3:
Some final steps:
http://miekiemoes.blogspot.com/2008/02/how...nt-malware.html
Safe surfing!

Hi there!

Back from a long weekend & excited to find out my pc is clean! Thanks for all your help Borislav! I followed your final steps...just one last thing, should I remove defogger too?

Adrianna

Maniac · May 24, 2010

Please re-enable and then manually delete it:

To enable CD Emulation programs using DeFogger please perform these steps:

Please download DeFogger to your desktop.
Once downloaded, double-click on the DeFogger icon to start the tool.
The application window will now appear. You should now click on the Enable button to enable your CD Emulation drivers
When it prompts you whether or not you want to continue, please click on the Yes button to continue
When the program has completed you will see a Finished! message. Click on the OK button to exit the program.
If CD Emulation programs are present and have been enabled, DeFogger will now ask you to reboot the machine. Please allow it to do so by clicking on the OK button.

Help with Google Re-directs

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information