Google redirect virus

May 21, 2009 at 14:15:26
Specs: Windows XP
I searched Google to see if I could fix this myself without having to post about it but I haven't had any luck with Malwarebytes, Ad-aware, Spybot S&D, AVG or Housecall. I was going to post my Hijack This log to try to save some time but it said not to post it until someone told me to....

Here's what my last Malwarebytes log said..

Malwarebytes' Anti-Malware 1.36
Database version: 2017
Windows 5.1.2600 Service Pack 2

5/21/2009 5:06:39 PM
mbam-log-2009-05-21 (17-06-39).txt

Scan type: Quick Scan
Objects scanned: 88363
Time elapsed: 8 minute(s), 41 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 0
Registry Values Infected: 4
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 18

Memory Processes Infected:
c:\program Files\ThunMail\testabd.exe (Spyware.OnlineGamer) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\autochk.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svc (Spyware.OnlineGamer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Spyware.OnlineGamer) -> Data: c:\progra~1\thunmail\testabd.dll -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\ThunMail (Spyware.OnlineGamer) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\ThunMail\testabd.dll (Spyware.OnlineGamer) -> Quarantined and deleted successfully.
C:\Program Files\ThunMail\testabd.exe (Spyware.OnlineGamer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\autochk.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Owner\protect.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Guest\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Stephney\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Guest\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Stephney\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Guest\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Stephney\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Guest\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Owner\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Stephney\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> Delete on reboot.


See More: Google redirect virus

Report •


#1
May 21, 2009 at 14:35:54
Hi,
Can you please post your AVZ log:

1) To create the logfile, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.

2) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.

3) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.
Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as Administrator

You should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.

begin
ExecuteStdScr(3);
RebootWindows(true);
end.

Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called virusinfo_syscure.zip inside. Upload that file to rapidshare.com and paste the link here.

Image Tutorial

--------------------------------------------
To Private Message me Click Here


Report •

#2
May 21, 2009 at 14:57:53
Thanks for the fast reply.

http://rapidshare.com/files/2357468...


Report •

#3
May 21, 2009 at 15:19:27
I believe it might be caused by ask toolbar you can run this script in AVZ:


begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 DelBHO('{201f27d4-3704-41d6-89c1-aa35e39143ed}');
 QuarantineFile('C:\Program Files\AskBarDis\bar\bin\askBar.dll','');
 QuarantineFile('C:\Program Files\AskBarDis\bar\bin\AskService.exe','');
 DeleteService('ASKService');
 StopService('ASKService');
 QuarantineFile('c:\program files\askbardis\bar\bin\askservice.exe','');
 TerminateProcessByName('c:\program files\askbardis\bar\bin\askservice.exe');
 DeleteFile('c:\program files\askbardis\bar\bin\askservice.exe');
 DeleteFile('C:\Program Files\AskBarDis\bar\bin\AskService.exe');
 DeleteFile('C:\Program Files\AskBarDis\bar\bin\askBar.dll');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(14);
ExecuteRepair(15);
BC_Activate;
RebootWindows(true);
end.

Your computer will reboot after reboot check and see if you still get redirected.

--------------------------------------------
To Private Message me Click Here


Report •

Related Solutions

#4
May 21, 2009 at 15:26:18
I'll do that, but I didn't get that toolbar until I changed my firewall to Zone Alarm and it installed the Zone Alarm spyblocker toolbar which has the Ask.com search.

I was having the redirecting a day or two before that.


Report •

#5
May 21, 2009 at 15:35:49
I also forgot to mention that the toolbar is only installed on Firefox and not Internet Explorer. I can't even use IE but for only a few minutes before I get the error screen and it closes it after it sends a report.

I should of mentioned that I have a slow start up. After the wallpaper comes up it takes a few minutes for the icons and start menu to pop up. During this time the computer PF and CPU usage is very low like the computer isn't trying to do anything, it's just delayed. Sometimes it won't even load at all and going to run new task and entering explorer.exe does nothing. I thought this was all part of the google redirecting trojan/virus.

Should I post a Hijack This log?


Report •

#6
May 21, 2009 at 15:36:50
After you run that follow:

Attach a Combofix log, please review and follow these instructions carefully.

Download it here -> http://download.bleepingcomputer.co...

Before Saving it to Desktop, please rename it to something like 123.exe to stop malware from disabling it.

Now, please make sure no other programs are running, close all other windows and pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) until after the scanning and removal process has taken place.

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan. Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal.

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please attach it to your next post.

--------------------------------------------
To Private Message me Click Here


Report •

#7
May 21, 2009 at 15:48:11
I'm running Norton and I did exactly what that link said to disable it. It even shows the red X over the ballon or whatever you want to call it showing it's disabled, and when I put the mouse over it, it says disabled but Combofix is still giving me the alert that it's not.

Report •

#8
May 21, 2009 at 15:52:27
Look at this to disable Norton Firewall: http://service1.symantec.com/SUPPOR... Disable that aswell.

--------------------------------------------
To Private Message me Click Here


Report •

#9
Report •

#10
May 21, 2009 at 18:55:55
Run this script in AVZ your computer will reboot:


begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
QuarantineFile('c:\windows\system32\1041a.exe','');
DeleteFile('c:\windows\system32\1041a.exe');
QuarantineFile('c:\windows\Internet Logs\xDB1.tmp','');
DeleteFile('c:\windows\Internet Logs\xDB1.tmp');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(2);
ExecuteRepair(3);
ExecuteRepair(4);
BC_Activate;
RebootWindows(true);
end.

After reboot follow:

1) Run this script in AVZ:


begin
CreateQurantineArchive('c:\quarantine.zip');
end.

2) A file called quarantine.zip should be created in C:\. Then please zip up C:\qoobox\quarantine and upload both it and C:\quarantine.zip to a filehost such as http://rapidshare.com/ Then, Private Message me the Download link to the uploaded file.

3) Lastly, uninstall Combofix by: pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) > Start > run > type combofix /u > ok. Or Start > run > type 123 /u > ok.

4) Install and run full scan with SuperAntiSpyware. Attach full scan log, Fix what it detects.

--------------------------------------------
To Private Message me Click Here


Report •

#11
May 21, 2009 at 20:14:30
After I used that scanner it didn't give me an option to save it and I also can't find where it keeps a logs of the scans, but here is a screenshot of what it found. I know it doesn't show the whole thing, but if you need the rest of it I'll type it out. Besides those 2 things it only found cookies.

http://img194.imageshack.us/img194/...


Report •

#12
May 21, 2009 at 20:23:09
Download and run Kaspersky AVP tool:

http://devbuilds.kaspersky-labs.com...

Once you download and start the tool select all the objects/places to be scanned and hit Scan. Fix what it detects and at the end of the scan post screen shot/log of detected items that is fixed and which it could not fix.

--------------------------------------------
To Private Message me Click Here


Report •

#13
May 22, 2009 at 16:19:25
http://img190.imageshack.us/img190/...

None of them could be disinfected, but said all were deleted.


Report •

#14
May 22, 2009 at 16:38:40
Still getting google redirected?

--------------------------------------------
To Private Message me Click Here


Report •

#15
May 22, 2009 at 18:54:27
No. It seems to be fixed. Thanks for the help.

Only thing I can say now is that whenever I open Firefox I get a pop up ad that I started getting with the redirecting problem.


Report •


Ask Question