Another Google Redirect Problem

[ash303]

Hey guys, I'm having a problem with Google redirecting me to random sites. I've searched the forums and it seems like each cased it dealt with individually, so here I am asking for some help. Just let me know what I need to run and what logs you need and I'll get em. Thanks in advance.

-ash

[RPMcMurphy]

Hello ash and welcome to Malwarebytes. Please follow these guidelines while we work on your PC:

[*]Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I

[ash303]

Thanks for getting back to me, here are the logs you requested.

DDS (Ver_10-03-17.01) - NTFSx86

Run by Office 2 at 10:03:16.68 on Thu 07/29/2010

Internet Explorer: 8.0.6001.18928 BrowserJavaVersion: 1.6.0_12

Microsoft

Attach.txt

GMER.txt

[RPMcMurphy]

ash,

I see you ran ComboFix back on July 1. Is this a new problem, or an ongoing issue? For future reference, Combofix is an excellent, but very powerful tool that is not intended for unsupervised use. When used incorrectly or under the wrong circumstances it can result in damage to your Operating System and data loss.

You are infected with a Rootkit. I recommend that you limit your online activity until we have your system clean and change all your passwords from a different, clean computer.

Download Combofix from either of the links below, and save it to your desktop.

Link 1

Link 2

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt.
  

Please include the following in your next post:

• ComboFix log
  

[ash303]

Yeah this is kind of an ongoing issue. Someone told me about combofix and how to run it, but they stopped responding after that.

log.txt

[RPMcMurphy]

ash,

Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above http://

http://forums.malwarebytes.org/index.php?showtopic=58704
Collect::
c:\users\Office 2\AppData\Local\Wzahonoce.dat
c:\users\Office 2\AppData\Local\Fjipurihiki.bin
c:\windows\system32\config\systemprofile\AppData\Local\unamatum.dll
c:\windows\system32\config\systemprofile\AppData\Local\Fjipurihiki.bin
c:\windows\system32\config\systemprofile\AppData\Local\Wzahonoce.dat
Driver::
zvkuhlne
DDS::
uInternet Settings,ProxyOverride = *.local

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:

• ComboFix log
  

[ash303]

Sorry for the delay, I was unavailable yesterday. Here is the log you requested.

ComboFix 10-07-30.04 - Office 2 07/31/2010 9:14.2.2 - x86

Microsoft

[RPMcMurphy]

ash,

How is your computer running now? Please do these next:

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Java 6 Update 12 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. If it does not, let me know.

Once the install is complete...

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

• On the General tab, under Temporary Internet Files, click the Settings button.
  
• Next, click on the Delete Files button
  
• There are two options in the window to clear the cache - Leave BOTH Checked
  
  • Applications and Applets
    
  • Trace and Log Files
    

  [*]Click OK on Delete Temporary Files Window

Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

• Click OK to leave the Temporary Files Window
  
• Click OK to leave the Java Control Panel.
  

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

• Click the Update tab
  
• Click Check for Updates
  
• If an update is found, it will download and install the latest version.
  
• The program will close to update and reopen.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
  
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
  

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.

Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
  
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • 
    
  • Spyware, adware, dialers, and other riskware
    
  • Archives
    
  • E-mail databases
    

  [*]Click on My Computer under the green Scan bar to the left to start the scan.

  [*]Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.

  [*]Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.

  [*]Click View report... at the bottom.

  [*] Click the Save report... button.

  [*] Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

• MBAM log
  
• Kaspersky log
  

[ash303]

Sorry for the delay. Here is the information you requested.

KasReport.txt

mbam_log_2010_07_31__12_41_02_.txt

[RPMcMurphy]

ash,

Those look good. All we have left to do are another security update and some important cleanup:

Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

Go HERE to scan for any other out of date and/or vulnerable applications on your computer and follow the instructions given for updating them.

Uninstall ComboFix

• Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
  Combofix /Uninstall
  

Delete the following tools along with any other logs you saved from our work:

• DDS
  
• GMER
  

Download TFC to your desktop

• Close any open windows.
  
• Double click the TFC icon to run the program
  
• TFC will close all open programs itself in order to run,
  
• Click the Start button to begin the process.
  
• Allow TFC to run uninterrupted.
  
• The program should not take long to finish it's job
  
• Once its finished it should automatically reboot your machine,
  
• if it doesn't, manually reboot to ensure a complete clean
  

Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

• Restart any anti-malware programs that we disabled while we were cleaning your machine.
  
• Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
  
• Consider running in a limited user account. See this post for more information.
  
• Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
  

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

[ash303]

Thank you very much for you help and your time. Everything is up to date and taken care of as per your instructions. Thread is ready to be closed.

Thanks again!

-ash

[RPMcMurphy]

You're welcome, ash. Take care.