« previous next »
Pages: [1] 2 3   Go Down

Author Topic: Another person with a the Google redirect malware.  (Read 14106 times)

0 Members and 1 Guest are viewing this topic.

CGriswald309B

  • Guest
Another person with a the Google redirect malware.
« on: July 29, 2011, 02:26:36 AM »
Ok, I ran the Avast Boot-time Scan and it found about 7 files. Then, I did a Malaware scan. It found nothing. I logged onto the internet, searched for something and was re-directed.

I have attached the Malaware report and the OTL report.

Many, many, many thanks in advance,
Brent


Logged

CGriswald309B

  • Guest
Re: Another person with a the Google redirect malware.
« Reply #1 on: July 29, 2011, 03:31:54 AM »
Oops. I forgot to include the:

 %SYSTEMDRIVE%\*.exe
/md5start
volsnap.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
CREATERESTOREPOINT

I ran the OTL scan again (including the stuff above) and here are the logs.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Another person with a the Google redirect malware.
« Reply #2 on: July 29, 2011, 07:58:27 PM »
Here we go this should clear it

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    Quote
    :OTL
    IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = B9 7E 9B 04 F1 54 5B 42 8D E1 45 58 DF 49 9C F9 [binary data]
    IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = B9 7E 9B 04 F1 54 5B 42 8D E1 45 58 DF 49 9C F9 [binary data]
    IE - HKU\S-1-5-21-2682475495-1044099580-1074880462-1005\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = B9 7E 9B 04 F1 54 5B 42 8D E1 45 58 DF 49 9C F9 [binary data]
    [2011/07/25 20:37:50 | 000,000,092 | ---- | M] () -- C:\Windows\System32\1520631473


    :Files
    ipconfig /flushdns /c
    :Reg
    [HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main]
    "XMLHTTP_UUID_Default"=-
    [HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main]
    "XMLHTTP_UUID_Default"=-
    [HKU\S-1-5-21\SOFTWARE\Microsoft\Internet Explorer\Main]
    "XMLHTTP_UUID_Default"=-

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Logged

CGriswald309B

  • Guest
Re: Another person with a the Google redirect malware.
« Reply #3 on: July 29, 2011, 10:31:52 PM »
First and foremost, thanks for your help! OK, I did what you said and all was going well until I ran the Quick Scan. I got a blue screen and then I had to restart the computer (I chose the normal option). I did the quick scan the second time. I have attached the log as it exceeded the maximum allowed length. I went ahead and did a search and was once again redirected.  :(
Logged

CGriswald309B

  • Guest
Re: Another person with a the Google redirect malware.
« Reply #4 on: July 29, 2011, 10:46:56 PM »
Also, now it is redirecting me even when I am not using the Google search engine. For example, I was checking out my yahoo email account. I clicked on a link and it sent me to some strange site.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Another person with a the Google redirect malware.
« Reply #5 on: July 29, 2011, 11:29:43 PM »
OK lets now investigate the drivers

Download ComboFix from one of these locations:


Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • Double click on ComboFix.exe & follow the prompts.
When finished, it shall produce a log for you.  Please include the C:\ComboFix.txt in your next reply.
Logged

CGriswald309B

  • Guest
Re: Another person with a the Google redirect malware.
« Reply #6 on: July 30, 2011, 12:10:38 AM »
The computer froze up and I couldn't acess the internet. Also, a little box that read PEV.exe has stopped working popped up. The computer restarted itself and it is now Preparing Log Report. I have to leave but I will post the ComboFix log when I return.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Another person with a the Google redirect malware.
« Reply #7 on: July 30, 2011, 12:16:47 AM »
OK when it runs ensure that Avast does not sandbox anything
Logged

CGriswald309B

  • Guest
Re: Another person with a the Google redirect malware.
« Reply #8 on: July 30, 2011, 02:47:54 AM »
Now I can't open any programs at all. It keeps saying:Illegal operation attempted on a registry key that has been marked for deletion. It says that for every single program. :( I'm typing this from my phone...I'll try to get to another computer to paste the log. Sigh.
Logged

CGriswald309B

  • Guest
Re: Another person with a the Google redirect malware.
« Reply #9 on: July 30, 2011, 02:57:04 AM »
So I restarted the computer and everything is fine (as far as opening the programs). Haha. Ok, here is the log report.
Logged

CGriswald309B

  • Guest
Re: Another person with a the Google redirect malware.
« Reply #10 on: July 30, 2011, 04:45:01 AM »
One more post before I go out for the night (I promise to check back later or tomorrow morning). I don't seem to be getting redirected.   :D
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Another person with a the Google redirect malware.
« Reply #11 on: July 30, 2011, 01:11:08 PM »
The infection was within firefox, and I always have problems with that area - too much gobbledegook in there to make a realistic assessment

Let me know if the redirects really have gone and there are no other problems outstanding
Logged

CGriswald309B

  • Guest
Re: Another person with a the Google redirect malware.
« Reply #12 on: July 30, 2011, 04:56:13 PM »
Well, so far the redirects haven't popped up. I'll be sure to post back if they reappear. Once again, many, many thanks!
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Another person with a the Google redirect malware.
« Reply #13 on: July 30, 2011, 07:09:15 PM »
Let me know when you are happy and I will remove my tools
Logged

CGriswald309B

  • Guest
Re: Another person with a the Google redirect malware.
« Reply #14 on: July 30, 2011, 07:56:54 PM »
Well, I had been using the internet all morning and performed at least 30 or 40 searches when I clicked on a link and got redirected. I've since made about 10 more and nothing. Not sure what to do...
Logged
Pages: [1] 2 3   Go Up
« previous next »