Random Browser Redirect

[LDTate]

Try this.

Copy explorer.exe to root of c:

Get to the command prompt:

Press the Win keyboard key or click on Vista Start button.

Type cmd into the Start Search textbox.

Press Ctrl+Shift+Enter (this keyboard shortcut triggers elevation to

[ddjmagic]

I keep getting "the syntax of the command is incorrect" when trying to rename.

[LDTate]

Sorry about that the (to) shouldn't be there

type in: ren c:\windows\explorer.exe explorer.old (tap enter)

Type in: copy c:\explorer.exe C:\windows (tap enter)

[ddjmagic]

No errors from the command line it said "File copied"

[LDTate]

We shall see.

Reboot.

Run a new combofix scan and post the results

[ddjmagic]

Seemed to be a lot quicker than last time, still some IE pop ups though and explorer.exe seems to be still infected

ComboFix 10-11-18.01 - derek 11/18/2010 23:22:46.3.2 - x86 NETWORK

Microsoft

[LDTate]

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.

Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.

When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:

Double-click on the Folder Options icon.

Click on the View tab.

If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.

Click on Show Hidden Files or Folders.

Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.

Remove the checkmark from the checkbox labeled Hide extensions for known file types.

Remove the checkmark from the checkbox labeled Hide protected operating system files.

Next:

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  explorer.exe

  
  

• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

[ddjmagic]

SystemLook 04.09.10 by jpshortstuff

Log created at 00:23 on 19/11/2010 by derek

Administrator - Elevation successful

========== filefind ==========

Searching for "explorer.exe"

C:\Windows\explorer.exe --a---- 2923520 bytes [00:06 19/11/2010] [09:45 02/11/2006] 2774A3141A1FFEBA09C87463C84B2FAF

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe --a---- 2923520 bytes [08:47 02/11/2006] [09:45 02/11/2006] FD8C53FB002217F6F888BCF6F5D7084D

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe --a---- 2923520 bytes [23:50 19/10/2007] [23:50 19/10/2007] 6D06CD98D954FE87FB2DB8108793B399

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe --a---- 2923520 bytes [12:26 10/12/2008] [06:20 29/10/2008] 37440D09DEAE0B672A04DCCF7ABF06BE

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe --a---- 2923520 bytes [23:50 19/10/2007] [23:50 19/10/2007] BD06F0BF753BC704B653C3A50F89D362

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe --a---- 2923520 bytes [12:26 10/12/2008] [02:15 28/10/2008] E7156B0B74762D9DE0E66BDCDE06E5FB

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe --a---- 2927104 bytes [16:42 23/09/2008] [07:33 19/01/2008] FFA764631CB70A30065C12EF8E174F9F

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe --a---- 2927104 bytes [12:26 10/12/2008] [06:29 29/10/2008] 4F554999D7D5F05DAAEBBA7B5BA1089D

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe --a---- 2927616 bytes [12:26 10/12/2008] [03:59 30/10/2008] 50BA5850147410CDE89C523AD3BC606E

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe --a---- 2926592 bytes [13:45 24/09/2009] [06:27 11/04/2009] D07D4C3038F3578FFCE1C0237F2A1253

-= EOF =-

[LDTate]

Did you already have hidden files showing?

If not, run a new combofix now

[ddjmagic]

Hiddens files were not been shown before, heres the new log-

ComboFix 10-11-18.03 - derek 11/19/2010 0:38.4.2 - x86 NETWORK

Microsoft

[LDTate]

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

File::
C:\fun.com


Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"=""

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

[ddjmagic]

Computer pretty much the same, whatever I do , multiple IE browsers open, when they open, a file "watermark.exe" appears in task manager for a few seconds.

Latest log-

ComboFix 10-11-18.03 - derek 11/19/2010 1:42.5.2 - x86 NETWORK

Microsoft

[LDTate]

Please go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:

c:\windows\Explorermgr.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virscan.org is too busy you can try these.

http://virscan.org/

http://www.kaspersky.com/scanforvirus.html

http://www.virustotal.com/en/indexf.html

[ddjmagic]

http://virusscan.jotti.org/en/scanresult/4...7c005565a5e192f

[LDTate]

Scan this one at Jotti

c:\windows\system32\DllHostmgr.exe

It's very strange

2010-11-18 22:34 . 2010-11-19 00:23 78253 ----a-w- c:\windows\system32\DllHostmgr.exe

2010-11-18 21:27 . 2010-11-19 01:39 78253 ----a-w- c:\windows\Explorermgr.exe

[ddjmagic]

Same, nothing found - http://virusscan.jotti.org/en/scanresult/7...4a5d720115d1969

[LDTate]

I'm going to be headed to bed very soon but will check back in the morning.

You could have a W32/Ramnit infection and might now be able to cure it.

http://www.eset.eu/online-scanner

Go here to run an online scannner from ESET.

Click the green ESET Online Scanner button.

Read the End User License Agreement and check the box: YES, I accept the Terms of Use.

Click on the Start button next to it.

You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.

A new window will appear asking "Do you want to install this software?"".

Answer Yes to download and install the ActiveX controls that allows the scan to run.

Click Start.

Check Remove found threats and Scan potentially unwanted applications.

Click Scan to begin.

If offered the option to get information or buy software. Just close the window.

Wait for the scan to finish

Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt

Copy and paste that log as a reply to this topic.

[ddjmagic]

Its 6 hours into the scan and about 2/3 of the way through, its been stuck on one file on the recovery partition for about an hour.

So far it has found 27,438 infected files, all W32/Ramnit, it looks like its infected pretty much everywhere

I'll let it run a bit longer to see if it can get past that file and finish the scan.

[ddjmagic]

Scan completed - 27,349 found, 27,424 deleted.

The log is too big to post here - here's the items it was unable to delete-

C:\Windows\explorer.exe Win32/Bamital.ER trojan (unable to clean) 00000000000000000000000000000000 I

C:\Windows\explorer.old Win32/Bamital.ER trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\wininit.exe Win32/Bamital.ER trojan (unable to clean) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Bears.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Garden.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Green Bubbles.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Hand Prints.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Orange Circles.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Peacock.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Roses.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Shades of Blue.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Soft Blue.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.0.6000.16386_none_ef216b8c52ca2227\Stars.htm Win32/Ramnit.A virus (error while cleaning) 00000000000000000000000000000000 I

${Memory} multiple threats 00000000000000000000000000000000 I

[LDTate]

all W32/Ramnit

I was afraid of that.

As far as I know there's no way of removing it other than a complete Re-Format.

If you have any data you need, you can copy it to an external device and hope nothing you need is infected.

The reformat is a complete format and not just a Windows repair install.

[ddjmagic]

Yeah, pretty much the whole of program files was infected and just about every HTML file on my PC.

A few questions - Will the USB flash drive that I have been using to copy between the 2 PC's be OK?

What would be the safest way of backing up my images/music etc, that aren't infected?

Would I be able to use the recovery partition to reinstall windows?

Thanks for your help!

[LDTate]

A few questions -

Will the USB flash drive that I have been using to copy between the 2 PC's be OK?

It should be unless it was infected.

What would be the safest way of backing up my images/music etc, that aren't infected?

I don't know if they are infected or not, but I don't think so. If you have large files, etc., you might look into purchasing a external hard drive.

Would I be able to use the recovery partition to reinstall windows?

I don't know what options you will have with that but you need to reformat and start over.

[ddjmagic]

I will have a go at backing up and reformatting, thanks for the help.

[LDTate]

Sorry we we're able to clean it

You're more than welcome.

Peace be with you

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.