Login 
 Search | |
| |
29-Jul-2010, 03:35 PM
#1 | |||||
| Google Redirect/Jump |
| |
30-Jul-2010, 12:58 AM
#2 | |||||
| Hello there  Welcome to the TSG Forums. My name is NeonFx. I'll be glad to help you with your computer problems. Logs can take some time to research, so please be patient with me. Please note the following:
Step 1 Download OTS to your Desktop
Code: %SYSTEMDRIVE%\*.* %systemroot%\system32\*.wt %systemroot%\system32\*.ruy %systemroot%\Fonts\*.com %systemroot%\Fonts\*.dll %systemroot%\Fonts\*.ini %systemroot%\Fonts\*.ini2 %systemroot%\system32\spool\prtprocs\w32x86\*.tmp %systemroot%\system32\Spool\prtprocs\w32x86\*.dll %systemroot%\REPAIR\*.bak1 %systemroot%\REPAIR\*.ini %systemroot%\system32\*.jpg %systemroot%\*.scr %systemroot%\*._sy %APPDATA%\Adobe\Update\*.* %ALLUSERSPROFILE%\Favorites\*.* %APPDATA%\Microsoft\*.* %PROGRAMFILES%\*.* %APPDATA%\Update\*.* %systemroot%\*. /mp /s CREATERESTOREPOINT %systemroot%\system32\*.dll /lockedfiles %systemroot%\Tasks\*.job /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\system32\user32.dll /md5 %systemroot%\system32\ws2_32.dll /md5 %systemroot%\system32\ws2help.dll /md5 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Step 2  GMER Rootkit Scanner Please download GMER from one of the following locations and save it to your desktop:
If you have trouble running GMER, please try running it in Safe Mode. To get to Safe Mode you'll need to repeatedly tap the F8 key on your keyboard as you turn your computer on until a black and white menu appears with the option. If you continue to have trouble with it, try running it without the "Files" scan checked. Again, if the results are really long, please attach them using the instructions I gave you at the end of step 1. This is to avoid having to scroll down the page too much and make the space cleaner.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
01-Aug-2010, 01:56 AM
#4 | |||||
| It looks like this file has been infected with the TDL3 rootkit: Quote:
Let's do the following: NOTE: ComboFix should NOT be used without supervision by someone trained in its use. It does a whole lot more to a system than just remove infected files. Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser. 3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you please let me know. A increasing number of infections are spreading using Autoplay and leaving it disabled is a good idea. 4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
02-Aug-2010, 05:12 PM
#8 | |||||
| Sorry for the delay I was busy over the weekend. Please do the following: 1. Close any open open programs before running the fix. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open Notepad (Start > Programs > Accessories) and copy/paste the text in the codebox below into it: Code: FCopy:: C:\Windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.3.7600.16385_none_3086c9dad36a69b3\wuauclt.exe|c:\windows\system32\wuauclt.exe C:\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe|c:\windows\system32\ctfmon.exe TDL:: C:\Windows\System32\drivers\mountmgr.sys Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
02-Aug-2010, 11:20 PM
#10 | |||||
| Great. How's the computer running? Let's do this now: STEP 1 Run OTS
Code: [Unregister Dlls] [Files/Folders - Modified Within 30 Days] NY -> 56 C:\Users\Aziz Hussain\AppData\Local\Temp\*.tmp files -> C:\Users\Aziz Hussain\AppData\Local\Temp\*.tmp [Empty Temp Folders] [EmptyFlash] [ClearAllRestorePoints] [Reboot]
Note: You may receive some errors while running the fix. Just press Ok and the fix should continue normally. If it seems to get stuck, give it some time. It's probably still working. STEP 2  Please download Malwarebytes' Anti-Malware from Here.Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly. STEP 3 Using Internet Explorer or Firefox, visit Kaspersky Online Scanner 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
The program will then begin downloading and installing and will also update the database. Please be patient as this can take quite a long time to download.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
09-Aug-2010, 02:23 PM
#14 | |||||
| Excellent. Let's cleanup. STEP 1 The following will implement some cleanup procedures as well as reset System Restore points: Click Start > Run and copy/paste the following bolded text into the Run box and click OK: (If you use Vista or 7 just paste it into the text box that appears next to your start button) ComboFix /Uninstall Note: If you have trouble and it doesn't want to uninstall using the method described above, you can rename ComboFix.exe to Uninstall.exe and double click on it to uninstall it. STEP 2 To clean up OldTimer's tools, along with a few others, do the following:
STEP 3 Remove any other tools or files we used by right-clicking on them or any folders they created, hold down the Shift key, and select "Delete" by clicking on it. This will delete the files without sending them to the RecycleBin. You can also uninstall the other programs (HijackThis or MalwareBytes if we used them) by going to Start > Control Panel > Add/Remove programs (The Control Panel is different in different versions of Windows. It will be Programs and Features in Vista and Programs > Uninstall a Program in 7) You might want to keep MalwareBytes AntiMalware though and that's fine  Make sure you update it before you run the scans in the future. All Clean Congratulations!,  , your system is now clean. Now that your system is safe we would like you to keep it that way. Take the time to follow these instructions and it will greatly reduce the risk of further infections and greatly diminish the chances of you having to visit here again.Microsoft Windows Update Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office products loopholes and fix any bugs found. Install the updates immediately if they are found. To update Windows Go to (Start) > (All) Programs > Windows Update To update Office Open up any Office program. Go to Help > Check for Updates Install WinPatrol Download it HERE You can find information about how WinPatrol works HERE and HERE Note: This program will work alongside all other security programs without conflicts. It might ask you to allow certain actions that security programs perform often, but if you tell Scotty to remember the action by checking the option, the alerts will lessen. Other Software Updates It is very important to update the other software on your computer to patch up any security issues you may have. Go HERE to scan your computer for any out of date software. In particular make sure you download the updates for Java and Adobe as these are subject to many security vulnerabilities. Setting up Automatic Updates So that it is not necessary to have to remember to update your computer regularly (something very important to securing your system), automatic updates should be configured on your computer. Microsoft has guides for XP and Vista on how to do this. See HERE for Windows 7. Read further information HERE, HERE, and HERE on how to prevent Malware infections and keep yourself clean. Please mark this thread as Solved by clicking on the button at the top of the page. Let me know if you need anything else.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
 |
| Tags |
| malware log hijackthis |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
Similar Threads | ||||
| Title | Thread Starter | Forum | Replies | Last Post |
| Infected with a Google Redirect | akpa1 | Virus & Other Malware Removal | 0 | 07-Dec-2009 01:57 PM |
| Google redirect trojan is doing my head in!!! CALLING ALL THE LEGION OF SUPER-TECHIES | Jeremiah1 | Virus & Other Malware Removal | 37 | 30-Nov-2009 03:13 PM |
| Google Redirect Tried Everything Can't Get Rid of It | ReverendRedd | Virus & Other Malware Removal | 23 | 14-Nov-2009 04:50 PM |
| Google Redirect Search | msdredz | Virus & Other Malware Removal | 0 | 02-Jun-2009 09:01 PM |
| Google, redirect, jump | bigknife | Virus & Other Malware Removal | 0 | 26-Oct-2008 08:16 PM |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 11:57 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile