Tom's Guide | Tom's Hardware | Tom's Games

Computing.Net > Forums > Security and Virus > Google redirect virus

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Google redirect virus

Reply to Message Icon

Name: strychnine
Date: May 21, 2009 at 14:15:26 Pacific
OS: Windows XP
Subcategory: Viruses
Comment:

I searched Google to see if I could fix this myself without having to post about it but I haven't had any luck with Malwarebytes, Ad-aware, Spybot S&D, AVG or Housecall. I was going to post my Hijack This log to try to save some time but it said not to post it until someone told me to....

Here's what my last Malwarebytes log said..

Malwarebytes' Anti-Malware 1.36
Database version: 2017
Windows 5.1.2600 Service Pack 2

5/21/2009 5:06:39 PM
mbam-log-2009-05-21 (17-06-39).txt

Scan type: Quick Scan
Objects scanned: 88363
Time elapsed: 8 minute(s), 41 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 0
Registry Values Infected: 4
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 18

Memory Processes Infected:
c:\program Files\ThunMail\testabd.exe (Spyware.OnlineGamer) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\autochk.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svc (Spyware.OnlineGamer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Spyware.OnlineGamer) -> Data: c:\progra~1\thunmail\testabd.dll -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\ThunMail (Spyware.OnlineGamer) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\ThunMail\testabd.dll (Spyware.OnlineGamer) -> Quarantined and deleted successfully.
C:\Program Files\ThunMail\testabd.exe (Spyware.OnlineGamer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\autochk.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Owner\protect.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Guest\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Stephney\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Guest\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Stephney\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Guest\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Stephney\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Guest\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Owner\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Stephney\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> Delete on reboot.



Sponsored Link
Ads by Google

Response Number 1
Name: jdk (by neoark)
Date: May 21, 2009 at 14:35:54 Pacific
Reply:

Hi,
Can you please post your AVZ log:

1) To create the logfile, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.

2) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.

3) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.
Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as Administrator

You should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.

begin
ExecuteStdScr(3);
RebootWindows(true);
end.

Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called virusinfo_syscure.zip inside. Upload that file to rapidshare.com and paste the link here.

Image Tutorial

--------------------------------------------
To Private Message me Click Here


0

Response Number 2
Name: strychnine
Date: May 21, 2009 at 14:57:53 Pacific
Reply:

Thanks for the fast reply.

http://rapidshare.com/files/2357468...


0

Response Number 3
Name: jdk (by neoark)
Date: May 21, 2009 at 15:19:27 Pacific
Reply:

I believe it might be caused by ask toolbar you can run this script in AVZ:


begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 DelBHO('{201f27d4-3704-41d6-89c1-aa35e39143ed}');
 QuarantineFile('C:\Program Files\AskBarDis\bar\bin\askBar.dll','');
 QuarantineFile('C:\Program Files\AskBarDis\bar\bin\AskService.exe','');
 DeleteService('ASKService');
 StopService('ASKService');
 QuarantineFile('c:\program files\askbardis\bar\bin\askservice.exe','');
 TerminateProcessByName('c:\program files\askbardis\bar\bin\askservice.exe');
 DeleteFile('c:\program files\askbardis\bar\bin\askservice.exe');
 DeleteFile('C:\Program Files\AskBarDis\bar\bin\AskService.exe');
 DeleteFile('C:\Program Files\AskBarDis\bar\bin\askBar.dll');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(14);
ExecuteRepair(15);
BC_Activate;
RebootWindows(true);
end.

Your computer will reboot after reboot check and see if you still get redirected.

--------------------------------------------
To Private Message me Click Here


0

Response Number 4
Name: strychnine
Date: May 21, 2009 at 15:26:18 Pacific
Reply:

I'll do that, but I didn't get that toolbar until I changed my firewall to Zone Alarm and it installed the Zone Alarm spyblocker toolbar which has the Ask.com search.

I was having the redirecting a day or two before that.


0

Response Number 5
Name: strychnine
Date: May 21, 2009 at 15:35:49 Pacific
Reply:

I also forgot to mention that the toolbar is only installed on Firefox and not Internet Explorer. I can't even use IE but for only a few minutes before I get the error screen and it closes it after it sends a report.

I should of mentioned that I have a slow start up. After the wallpaper comes up it takes a few minutes for the icons and start menu to pop up. During this time the computer PF and CPU usage is very low like the computer isn't trying to do anything, it's just delayed. Sometimes it won't even load at all and going to run new task and entering explorer.exe does nothing. I thought this was all part of the google redirecting trojan/virus.

Should I post a Hijack This log?


0

Related Posts

See More



Response Number 6
Name: jdk (by neoark)
Date: May 21, 2009 at 15:36:50 Pacific
Reply:

After you run that follow:

Attach a Combofix log, please review and follow these instructions carefully.

Download it here -> http://download.bleepingcomputer.co...

Before Saving it to Desktop, please rename it to something like 123.exe to stop malware from disabling it.

Now, please make sure no other programs are running, close all other windows and pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) until after the scanning and removal process has taken place.

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan. Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal.

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please attach it to your next post.

--------------------------------------------
To Private Message me Click Here


0

Response Number 7
Name: strychnine
Date: May 21, 2009 at 15:48:11 Pacific
Reply:

I'm running Norton and I did exactly what that link said to disable it. It even shows the red X over the ballon or whatever you want to call it showing it's disabled, and when I put the mouse over it, it says disabled but Combofix is still giving me the alert that it's not.


0

Response Number 8
Name: jdk (by neoark)
Date: May 21, 2009 at 15:52:27 Pacific
Reply:

Look at this to disable Norton Firewall: http://service1.symantec.com/SUPPOR... Disable that aswell.

--------------------------------------------
To Private Message me Click Here


0

Response Number 9
Name: strychnine
Date: May 21, 2009 at 18:30:35 Pacific
Reply:

http://rapidshare.com/files/2357974...


0

Response Number 10
Name: jdk (by neoark)
Date: May 21, 2009 at 18:55:55 Pacific
Reply:

Run this script in AVZ your computer will reboot:


begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
QuarantineFile('c:\windows\system32\1041a.exe','');
DeleteFile('c:\windows\system32\1041a.exe');
QuarantineFile('c:\windows\Internet Logs\xDB1.tmp','');
DeleteFile('c:\windows\Internet Logs\xDB1.tmp');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(2);
ExecuteRepair(3);
ExecuteRepair(4);
BC_Activate;
RebootWindows(true);
end.

After reboot follow:

1) Run this script in AVZ:


begin
CreateQurantineArchive('c:\quarantine.zip');
end.

2) A file called quarantine.zip should be created in C:\. Then please zip up C:\qoobox\quarantine and upload both it and C:\quarantine.zip to a filehost such as http://rapidshare.com/ Then, Private Message me the Download link to the uploaded file.

3) Lastly, uninstall Combofix by: pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) > Start > run > type combofix /u > ok. Or Start > run > type 123 /u > ok.

4) Install and run full scan with SuperAntiSpyware. Attach full scan log, Fix what it detects.

--------------------------------------------
To Private Message me Click Here


0

Response Number 11
Name: strychnine
Date: May 21, 2009 at 20:14:30 Pacific
Reply:

After I used that scanner it didn't give me an option to save it and I also can't find where it keeps a logs of the scans, but here is a screenshot of what it found. I know it doesn't show the whole thing, but if you need the rest of it I'll type it out. Besides those 2 things it only found cookies.

http://img194.imageshack.us/img194/...


0

Response Number 12
Name: jdk (by neoark)
Date: May 21, 2009 at 20:23:09 Pacific
Reply:

Download and run Kaspersky AVP tool:

http://devbuilds.kaspersky-labs.com...

Once you download and start the tool select all the objects/places to be scanned and hit Scan. Fix what it detects and at the end of the scan post screen shot/log of detected items that is fixed and which it could not fix.

--------------------------------------------
To Private Message me Click Here


0

Response Number 13
Name: strychnine
Date: May 22, 2009 at 16:19:25 Pacific
Reply:

http://img190.imageshack.us/img190/...

None of them could be disinfected, but said all were deleted.


0

Response Number 14
Name: jdk (by neoark)
Date: May 22, 2009 at 16:38:40 Pacific
Reply:

Still getting google redirected?

--------------------------------------------
To Private Message me Click Here


0

Response Number 15
Name: strychnine
Date: May 22, 2009 at 18:54:27 Pacific
Reply:

No. It seems to be fixed. Thanks for the help.

Only thing I can say now is that whenever I open Firefox I get a pop up ad that I started getting with the redirecting problem.


0

Sponsored Link
Ads by Google
Reply to Message Icon



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links
Ads by Google


Results for: Google redirect virus
Google Redirect Virus www.computing.net/answers/security/google-redirect-virus/23426.html

Google Redirect Virus--help! www.computing.net/answers/security/google-redirect-virushelp/23496.html

Google Redirect Virus www.computing.net/answers/security/google-redirect-virus/23500.html