Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Hijacked MSIE8, google redirect, and disabled scanners.

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Hijacked MSIE8, google redirect, and disabled scanners.

Unread postby ISAWHIM » September 9th, 2009, 5:08 pm

Since it is unclear to the admins, I will elaborate. I assume, since you failed to directly state it, that the logs which are too long for posting, should be attached. (As per the guide rules.)

HijackThis "Does not work", there is no log produced, no scan ability with that program.

I have attached a text file with the programs that "Do work", and have produced logs.
Log includes reports from:
- AntiVir_RootKit (Full report)
- Mbam (Partial log, before death of Mbam)
- RootRepeal (Drivers, Shadow SSDT, SSDT, Process)
- - (Stealth and Hidden logs are empty.)
- Win32kDiag (Full report)

Warnings: None
Errors: None

Actiity: Popups randomly (Subdued by removal of A.exe, B.exe, C.exe, MSC.exe, Monopod, and NordBull.) MSIE 8 is functionally hijacked. Google links go to random ad pages, unrelated to links. Firefox and Chrome do not seem to be hijacked this way. Scanners have all been disabled, due to partial locking of critical files. No warnings, no errors, no ability to detect, no ability to uninstall, no ability to fix with installer, no ability to delete them, no ability to open them. (Not without a hack.)

Observations: Programs disapear (Die) instantly, once they attempt to scan or access "Some file/s", (The virus/malware). The program becomes locked-out due to "Permissions" set to "Everyone", and all other permissions get stripped.

Temporary fixes/hacks: See below for details of work-arounds, which I had to do, to get the programs to run long enough to create a log file. (The other programs did not have the same results with that same hack. They were killed and locked, every time.) Again, without error or notices, they just disapear from the screen.

"AntiVir Personal" just died when it actively found a file. No info on the file it found, because it died without time to write it down.

Two suspicious files/folders have locked-out Command.exe when I tried to access them. (Command.exe function has been hacked to restore permissions, so it works again.)

C:\WINDOWS\TEMP\Google Tools\Google Tools

Both folders are hidden, and are not actual folders acording to the ATTRIB function. They are "JUNCTIONS" encased in brackets. Permissions denied for delete, and Command.exe dies if I add ADMINISTRATOR permissions to the file. (I have renamed \TEMP\ to \TEMP2\, which has resulted in keeping my system stable enough to operate and post here.)

_____ Original post below, I will not repeat myself. _____

OS: Windows XP Home
MSIE 8 (Hijacked, Java client dies on load.)
Google links (JUMP: redirected) "Actually says JUMP in URL for a moment"
HOST file (Clean)
Google Chrome (Works fine)
FireFox (Works fine)

Running programs: (They still function, just not completely.)
AntiVir Personal (Actively scanning every file READ/WRITE. Demand scan ALL, finds nothing.)
Avast (Active scanning services seem to run, main program dies.)
Win32Diag (Runs fine, have logs)
Gmer (Runs 90%, dies on some scan, not sure which one.)
dds.scr (Extracts to TEMP, runs "Find.exe", files disapear and find.exe goes dormant. No action, no reports.)
Mbam (Dies on "Full scan". Have partial log.)
RootRepeal (Scans all, but dies on "Files". Have other reports. Hidden = no results.)
SUPERAntiSpywar (Runs, only finds cookies and tracking images.)
Antivir_rootkit (Runs, only finds "SecuROM" {NULL} and two other SecuROM listings.)
AVG8 (Died on scan, will retry install if it is requested. Was actively running while infected for weeks. Scanning all files.)
TrendMicro Online (Found four files, died trying to remove them.)
TrendMicro Offline (Died while scanning.)

Prior removals:

Tried all of the suggestions in the forums, but my limited log ability does not reflect in comparison to the large logs which others are able to provide. I have played with every form of access permissions setting, attempting to let the programs live long enough to produce a log. Seems the LOG is the common killer. The programs that log as they scan, produce a partial file. The programs that wait until they finish, never log a thing, because they never finish.

Logs will not all fit in the post, I need to attach or you have to tell me which ones to post. (You might want to create a program that removes useless info. A simple javascript program can remove unwanted data.)
You do not have the required permissions to view the files attached to this post.
Banned Member
Posts: 2
Joined: September 8th, 2009, 8:48 pm
Register to Remove

Re: Hijacked MSIE8, google redirect, and disabled scanners.

Unread postby Gary R » September 10th, 2009, 8:52 am

User banned for behaviour unsuitable for this forum.
User avatar
Gary R
Posts: 21809
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

  • Similar Topics
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!

Who is online

Users browsing this forum: No registered users and 11 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware