All my browsers being redirected

[Stokkers]

Hope someone can help.

It started with Google a few days ago, but seems to have affected all my browsers now. I have purchased Malwarebytes and Avira and downloaded HJT. My log on the latter is below

Ken

hijackthis.log

[kahdah]

Hello Stokkers

Welcome to Malwarebytes.

=====================

• Download OTL to your desktop.
  
• Double click on OTL to run it.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Under the Standard Registry box change it to All.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
    

====================

Please download Rootkit Unhooker and save it to your desktop.

• Double-click RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan
  
• Check Drivers, Stealth Code, Files, and Code Hooks
  
• Uncheck the rest, then click OK
  
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  
• Wait till the scanner has finished then go File > Save Report
  
• Save the report somewhere you can find it, typically your desktop. Click Close
  
• Copy the entire contents of the report and paste it in your next reply.
  

Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

[Stokkers]

Hello Stokkers

Welcome to Malwarebytes.

=====================

• Download OTL to your desktop.
  
• Double click on OTL to run it.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Under the Standard Registry box change it to All.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
    

====================

Please download Rootkit Unhooker and save it to your desktop.

• Double-click RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan
  
• Check Drivers, Stealth Code, Files, and Code Hooks
  
• Uncheck the rest, then click OK
  
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  
• Wait till the scanner has finished then go File > Save Report
  
• Save the report somewhere you can find it, typically your desktop. Click Close
  
• Copy the entire contents of the report and paste it in your next reply.
  

Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

Hi Kahdah

Have logged the OTL - attached, but am wondering how long the Rku should take. It seems to have been scanning for a long time, but nothing seems to be happening.

OTL.Txt

[kahdah]

It shouldn't take too long no ,more than 10 minutes I would say it may take longer.

Is it still running?

[Stokkers]

It shouldn't take too long no ,more than 10 minutes I would say it may take longer.

Is it still running?

Can't tell, so I just stopped it and checked out the report. There is a load of stuff in there that I have saved and attached to this post. Hope there's enough in there for you.Report.txt

[kahdah]

The log was incomplete but let's try the following.

Please download and run MBR.exe by GMER:

http://www2.gmer.net/mbr/mbr.exe

It will produce a log, mbr.txt in the same directory as the program. Please copy/paste that log here.

[Stokkers]

The log was incomplete but let's try the following.

Please download and run MBR.exe by GMER:

http://www2.gmer.net/mbr/mbr.exe

It will produce a log, mbr.txt in the same directory as the program. Please copy/paste that log here.

Doesn't seem to be a lot in there, but here it is.

mbr.log

[kahdah]

Yes that is normal it only checks the mbr of the disk.

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

[Stokkers]

Yes that is normal it only checks the mbr of the disk.

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

Having been battling with this for a couple of days and getting a little late this side of the Atlantic, I think I shall download Combofix and continue tomorrow.

Thanks for your help.

[Stokkers]

Have run Combofix and it found an infected file and I believe created a log, but it has been frozen for ages with the following message:

'Rebooting windows . . . Please wait

2. was unexpected at this time.'

Now what?????

[kahdah]

Please manually shut the system off then back on again and let it finish the process.

Post the log when completed.

[Stokkers]

Please manually shut the system off then back on again and let it finish the process.

Post the log when completed.

Thanks. Was wondering if you were going to be around today and dare I switch off. Just switched back on again.

[Stokkers]

At last! Here's the Log File. The Combofix window has shut down, so when can I get my firewall etc back up again?

ComboFix.txt

[kahdah]

You can switch it on now.

One or more of the identified infections was a Rootkit TDL3

If this computer was ever used for on-line banking, I suggest you do the following immediately:

1. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

2. Change ALL your on-line passwords for email, for banks, financial accounts, PayPal, eBay, on-line companies, any on-line forums or groups you belong to.

Not saying anything has been compromised but I wanted to alert you of the dangers associated with his infection.

Update Run Malwarebytes

Please update\run Malwarebytes' Anti-Malware.

Double Click the Malwarebytes Anti-Malware icon to run the application.

• Click on the update tab then click on Check for updates.
  
• If an update is found, it will download and install the latest version.
  
• Once the update has loaded, go to the Scanner tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.

=====

* Go here to run an online scannner from ESET.

• Note: You will need to use Internet explorer for this scan
  
• Tick the box next to YES, I accept the Terms of Use.
  
• Click Start
  
• When asked, allow the activex control to install
  
• Click Start
  
• Check next options: Remove found threats and Scan unwanted applications.
  
• Click Scan
  
• Wait for the scan to finish
  
• Use notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt
  
• Copy and paste that log as a reply to this topic
  

[Stokkers]

Wow! Looks like I have a lot of work still to do, as I have mobility problems, I do all my banking and a lot of shopping online, so looks like I am going to be busy over the next day or too.

Thank you for all your work and I shall certainly send you a donation via PayPal once I have sorted them out.

[kahdah]

No problem we are not done yet

Go ahead with those scans please and post the logs when done.

[LDTate]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!