Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Google search results links hijacked

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Google search results links hijacked

Unread postby deltalima » December 7th, 2010, 9:02 am

Hi jlaureni,

Please run Combofix again as follows -

**Ensure you have disabled ALL anti-virus, anti-malware and firewall programs so they do not interfere with ComboFix.**

  • Double-click ComboFix.exe to start Combofix (If you get a User Account Control warning, click Allow)
  • If you get a message from ComboFix that a rootkit is detected and it needs to reboot the computer, allow it to do so.
  • Wait for scan to complete. It can take tens of minutes.
  • Do not run any programs or do anything to interfere with ConboFix as it is running.
  • Once finished, a log should open. If not, the log can be located at C:\ComboFix.txt

Please include the ComboFix log (C:\ComboFix.txt) in your next reply.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK
Advertisement
Register to Remove

Re: Google search results links hijacked

Unread postby jlaureni » December 7th, 2010, 10:13 am

Hi deltalima,

Here is the result from ComboFix:

ComboFix 10-12-04.02 - Sonia 12/07/2010 8:22.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1013.472 [GMT -5:00]
Running from: c:\users\Sonia\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\explorer.exe

.
((((((((((((((((((((((((( Files Created from 2010-11-07 to 2010-12-07 )))))))))))))))))))))))))))))))
.

2010-12-07 13:42 . 2010-12-07 13:42 -------- d-----w- c:\users\Joe\AppData\Local\temp
2010-12-07 13:42 . 2010-12-07 13:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-07 10:22 . 2010-12-07 10:22 -------- d-----w- c:\program files\Delicious Add-on for Internet Explorer
2010-12-06 13:56 . 2006-11-02 09:45 95744 ----a-w- C:\wininit.exe
2010-12-05 22:52 . 2010-12-07 13:43 -------- d-----w- c:\users\Sonia\AppData\Local\temp
2010-12-03 10:19 . 2010-12-03 10:19 -------- d-----w- C:\MGADiagToolOutput
2010-12-03 10:01 . 2010-12-06 13:11 -------- d-----w- C:\Malware
2010-12-01 06:31 . 2010-12-01 06:31 388096 ----a-r- c:\users\Sonia\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-11-29 11:52 . 2010-11-29 11:52 -------- d-----w- c:\programdata\Office Genuine Advantage
2010-11-29 11:51 . 2010-11-29 11:51 -------- d-----w- c:\users\Sonia\Office Genuine Advantage
2010-11-28 15:17 . 2010-11-28 15:17 -------- d-----w- c:\program files\Trend Micro
2010-11-25 12:44 . 2010-11-25 13:21 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-11-25 12:44 . 2010-11-25 12:44 -------- d-----w- c:\program files\Hitman Pro 3.5
2010-11-25 12:43 . 2010-11-25 12:43 -------- d-----w- c:\programdata\Hitman Pro
2010-11-24 06:32 . 2010-12-03 10:11 -------- d-----w- c:\program files\Fiddler2
2010-11-23 02:39 . 2010-11-23 02:39 -------- d-----w- c:\users\Sonia\AppData\Roaming\Malwarebytes
2010-11-23 02:37 . 2010-11-23 02:37 -------- d-----w- c:\programdata\Malwarebytes
2010-11-23 02:37 . 2010-12-05 19:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-22 00:33 . 2010-11-22 00:33 -------- d-----w- c:\users\Joe\AppData\Roaming\Verizon
2010-11-21 23:53 . 2010-12-05 19:34 -------- d-----w- c:\programdata\STOPzilla!
2010-11-17 08:57 . 2010-09-04 19:09 24376 ----a-w- c:\program files\Mozilla Firefox\components\Scriptff.dll
2010-11-17 08:57 . 2010-09-04 19:09 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-11-17 08:56 . 2010-09-04 19:09 95600 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-11-17 08:56 . 2010-09-04 19:09 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2010-11-17 08:56 . 2010-09-04 19:09 64304 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
2010-11-17 08:56 . 2010-09-04 19:09 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys
2010-11-17 08:56 . 2010-09-04 19:09 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2010-11-17 08:56 . 2010-09-04 19:09 386712 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2010-11-17 08:56 . 2010-09-04 19:09 312904 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2010-11-17 08:56 . 2010-09-04 19:09 164808 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2010-11-17 08:56 . 2010-09-04 19:09 152992 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-11-17 08:56 . 2010-11-17 09:01 -------- d-----w- c:\program files\Common Files\Mcafee
2010-11-17 08:55 . 2010-11-17 09:01 -------- d-----w- c:\program files\McAfee
2010-11-17 08:28 . 2010-11-18 01:07 -------- d-----w- c:\programdata\McAfee
2010-11-17 08:22 . 2010-11-17 08:22 -------- d-----w- c:\users\Sonia\AppData\Roaming\Verizon
2010-11-17 08:22 . 2010-11-17 08:22 -------- d-----w- c:\programdata\Radialpoint
2010-11-17 08:22 . 2010-11-17 08:22 -------- d-----w- c:\programdata\Verizon
2010-11-17 08:22 . 2010-11-17 08:22 -------- d-----w- c:\program files\Verizon
2010-11-16 21:47 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{071AF54F-DAE8-4C9C-9B0A-2C45FE224306}\mpengine.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-07 11:48 . 2008-12-10 22:59 2923520 ----a-w- c:\windows\explorer.exe
2010-12-07 11:48 . 2008-09-15 22:41 95744 ----a-w- c:\windows\system32\wininit.exe
2010-10-19 15:41 . 2009-10-03 11:59 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-09-10 16:37 . 2010-10-14 12:52 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-09-04 19:09 . 2010-11-17 08:57 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{930f1200-f5f1-4870-bac6-e233ec8e7023}]
2008-09-12 01:43 1780248 ----a-w- c:\program files\Softonic_English\tbSoft.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-29 02:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{930f1200-f5f1-4870-bac6-e233ec8e7023}"= "c:\program files\Softonic_English\tbSoft.dll" [2008-09-12 1780248]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712]

[HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{930F1200-F5F1-4870-BAC6-E233EC8E7023}"= "c:\program files\Softonic_English\tbSoft.dll" [2008-09-12 1780248]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712]

[HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-24 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-02-26 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-02-26 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-02-26 133912]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-03-29 176128]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

c:\users\Sonia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OneNote Table Of Contents.onetoc2 [2007-10-27 3656]
West Orange Public Library Tray App.lnk - c:\program files\PermissionTV\bin\dmtray.exe [2008-5-8 57344]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
Vongo Tray.lnk - c:\windows\Installer\{8C3AE2D1-854D-4650-A73D-C7CC7EE36B80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe [2007-4-19 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
2008-11-10 17:23 157312 ----a-w- c:\program files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 135664]
R2 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-04-08 271480]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-09-04 84264]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2010-09-04 64304]
S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-09-04 164808]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-04-08 271480]
S2 McMPFSvc;McAfee Personal Firewall;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-04-08 271480]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-04-08 271480]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2010-09-04 188136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2010-09-04 141792]
S2 PermissionTVDownloadManager;PermissionTV Download Manager Service;c:\progra~1\PERMIS~1\bin\dm.exe [2007-08-07 221245]
S2 Seagate Sync Service;Seagate Sync Service;c:\program files\Seagate\Sync\SeaSyncServices.exe [2007-01-18 24120]
S2 ServicepointService;ServicepointService;c:\program files\Verizon\VSP\ServicepointService.exe [2010-03-16 689392]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-09-04 55840]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-09-04 312904]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2009-10-26 4247552]


--- Other Services/Drivers In Memory ---

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-12-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-11-24 08:10]

2010-12-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 02:26]

2010-12-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 02:26]

2010-11-17 c:\windows\Tasks\HPCeeScheduleForJoe.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-04-19 21:23]

2010-12-05 c:\windows\Tasks\HPCeeScheduleForSonia.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-04-19 21:23]

2010-12-07 c:\windows\Tasks\User_Feed_Synchronization-{2933925B-0929-4965-86AF-B48000DDDC3B}.job
- c:\windows\system32\msfeedssync.exe [2010-10-14 04:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://connect2.prudential.com/dana-ca ... Client.cab
FF - ProfilePath - c:\users\Sonia\AppData\Roaming\Mozilla\Firefox\Profiles\o428qjez.default\
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - component: c:\program files\Mozilla Firefox\components\Scriptff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\users\Sonia\AppData\Roaming\Mozilla\Firefox\Profiles\o428qjez.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Verizon\VSP\nprpspa.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Extension: Skype extension for Firefox: {B13721C7-F507-4982-B2E5-502A71474FED} - c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Extension: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\users\Sonia\AppData\Roaming\Mozilla\Firefox\Profiles\o428qjez.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Extension: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\users\Sonia\AppData\Roaming\Mozilla\Firefox\Profiles\o428qjez.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Extension: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\users\Sonia\AppData\Roaming\Mozilla\Firefox\Profiles\o428qjez.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
.
.
------- File Associations -------
.
.scr=AutoCADLTScriptFile
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-07 08:43
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-12-07 08:51:37
ComboFix-quarantined-files.txt 2010-12-07 13:51
ComboFix2.txt 2010-12-05 22:52

Pre-Run: 80,188,469,248 bytes free
Post-Run: 80,190,648,320 bytes free

- - End Of File - - 554A03EC318B8CCA1A312D06D90EFAF3
jlaureni
Regular Member
 
Posts: 21
Joined: November 28th, 2010, 1:29 pm

Re: Google search results links hijacked

Unread postby deltalima » December 7th, 2010, 10:25 am

Hi jlaureni,

Run OTL Script

  • Right click OTL.exe and select: Run as Administrator.
  • Copy and Paste the following code into the Image textbox. Do not include the word Code
    Code: Select all
    :otl
    O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
    O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
    O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://connect2.prudential.com/dana-ca ... Client.cab (JuniperSetupClientControl Class)
    :reg
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
    "DisableMonitoring" = 0
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring" = 0
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
    "DisableMonitoring" = 0
    :commands
    [EMPTYTEMP]
    [REBOOT]
    
  • Then click the Run Fix button at the top.
  • Click Image.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Upload a File to Virustotal

Please go to Virustotal

Copy/paste this file and path into the white box at the top:
c:\windows\explorer.exe

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: Google search results links hijacked

Unread postby jlaureni » December 7th, 2010, 7:27 pm

Hi deltalima,
Here is the log from OTL:

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Starting removal of ActiveX control {F27237D7-93C8-44C2-AC6E-D6057B9A918F}
C:\Windows\Downloaded Program Files\JuniperSetupClient.INF moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F27237D7-93C8-44C2-AC6E-D6057B9A918F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F27237D7-93C8-44C2-AC6E-D6057B9A918F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{F27237D7-93C8-44C2-AC6E-D6057B9A918F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F27237D7-93C8-44C2-AC6E-D6057B9A918F}\ not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\\"DisableMonitoring" | 0 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\\"DisableMonitoring" | 0 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\\"DisableMonitoring" | 0 /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Joe
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 52907477 bytes
->Java cache emptied: 35000038 bytes
->FireFox cache emptied: 94786578 bytes
->Apple Safari cache emptied: 6122496 bytes
->Flash cache emptied: 124700 bytes

User: MixedReception
->Temp folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Sonia
->Temp folder emptied: 734810 bytes
->Temporary Internet Files folder emptied: 16998565 bytes
->Java cache emptied: 80065505 bytes
->FireFox cache emptied: 55571579 bytes
->Apple Safari cache emptied: 3618816 bytes
->Flash cache emptied: 17414233 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6105 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 347.00 mb


OTL by OldTimer - Version 3.2.17.3 log created on 12072010_175746

Files\Folders moved on Reboot...
C:\Users\Sonia\AppData\Local\Temp\ehmsas.txt moved successfully.
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF5296.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF52A2.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF5373.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF5384.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFB313.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFB31A.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFB3C8.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFB3FD.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFCDF6.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFCE1A.tmp not found!
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIPCR4QG\blank[1].html moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIPCR4QG\default[2].htm moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIDQFJV5\0;~sscs=_;ord=675395246239[1].htm moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIDQFJV5\launch[1].htm moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIDQFJV5\openmail.app[1].htm moved successfully.
File move failed. C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I2AYCAZB\0510;net=cm;u=,cm-30374929_1291762480,11cac353f18a620,Miscellaneous,co.al-co.co-co.in;;sz=160x600;contx=Miscellaneous;dc=w;btg=co.al;btg=co.co;btg=co.in;ord=0[1].htm scheduled to be moved on reboot.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I2AYCAZB\blank[1].html moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I2AYCAZB\fc[1].htm moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I2AYCAZB\openmail.app[1].htm moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I2AYCAZB\viewtopic[1].htm moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BEQKUJCU\blank[1].html moved successfully.
C:\Windows\temp\sqlite_ihT8XPBq4nWUNB8 moved successfully.

Registry entries deleted on Reboot...
jlaureni
Regular Member
 
Posts: 21
Joined: November 28th, 2010, 1:29 pm

Re: Google search results links hijacked

Unread postby deltalima » December 8th, 2010, 5:05 am

Hi jlaureni,

Upload a File to Virustotal

Please go to Virustotal

Copy/paste this file and path into the white box at the top:
c:\windows\explorer.exe

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.

Next

  • Click Start, point to Settings, and then click Control Panel.
  • In Control Panel, double-click Add or Remove Programs.
  • In Add or Remove Programs,
    highlight Ask Toolbar
    click Remove
    highlight Coupon Printer for Windows
    click Remove
    highlight Juniper Networks Network Connect 6.3.0
    click Remove
  • Close the Add or Remove Programs and the Control Panel windows.

Next

You should Download and Install the newest version of Adobe Reader for reading pdf files, due to the vulnerabilities in earlier versions.
All versions numbered lower than 9.4 are vulnerable.
  • Go HERE, UNCHECK any Free Add-Ons, and click Download to install the latest version of Adobe Acrobat Reader.
  • After it completes the Installation, close the Download Manager.

Update Java Runtime
You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 22.
  • Download the latest version of Java Runtime Environment (JRE) 6 Here
  • Scroll down to where it says "JDK 6 Update 22 (JDK or JRE)"
  • Click the orange Download JRE button to the right
  • Select the Windows platform from the dropdown menu
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh
  • Click on the link to download Windows Offline Installation & save the file to your desktop
  • Close any programs you may have running - especially your web browser
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions
  • Reboot your computer once all Java components are removed
  • Then from your desktop double-click on jre-6u22-windows-i586-p.exe to install the newest version

Now please run Malwarebytes, make sure you run Update, this should update to the latest version (1.50), run update again to get the latest signatures and then run a quick scan and post the log in your next reply.

ESET online scannner

  • Please go Here then click on: Image
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • Select the option YES, I accept the Terms of Use then click on: Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: Image
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Please let me know how the computer is running now.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: Google search results links hijacked

Unread postby jlaureni » December 8th, 2010, 7:24 am

Hi deltalima,
I had to email the file to VirusTotal - their upload utility was too busy. I should get a response by email and I will send it along. I have a busy day and I will do the rest of the steps this evening. I am wondering about the issue with coupon printer - it is used to print coupons to take to the grocery store - it there a problem in general or is it the version on my computer? Thanks.

Can I turn the virus protection on again?

Joe
jlaureni
Regular Member
 
Posts: 21
Joined: November 28th, 2010, 1:29 pm

Re: Google search results links hijacked

Unread postby jlaureni » December 8th, 2010, 7:28 am

Hi deltalima,
The VirusTotal Scan results came back quick:

Complete scanning result of "explorer.exe", processed in VirusTotal at 12/08/2010 12:19:58 (CET).

[ file data ]
* name..: explorer.exe
* size..: 2923520
* md5...: fd8c53fb002217f6f888bcf6f5d7084d
* sha1..: 5f07ce4751b142b22cd26f4fdb1d6708ff13982d
* peid..: -

[ scan result ]
AhnLab-V3 2010.12.08.00/20101207 found nothing
AntiVir 7.10.14.223/20101208 found nothing
Antiy-AVL 2.0.3.7/20101208 found nothing
Avast 4.8.1351.0/20101208 found nothing
Avast5 5.0.677.0/20101208 found nothing
AVG 9.0.0.851/20101207 found nothing
BitDefender 7.2/20101208 found nothing
CAT-QuickHeal 11.00/20101208 found nothing
ClamAV 0.96.4.0/20101208 found nothing
Command 5.2.11.5/20101208 found nothing
Comodo 6989/20101208 found nothing
DrWeb 5.0.2.03300/20101208 found nothing
Emsisoft 5.1.0.1/20101208 found nothing
eSafe 7.0.17.0/20101207 found nothing
eTrust-Vet 36.1.8027/20101208 found nothing
F-Prot 4.6.2.117/20101207 found nothing
F-Secure 9.0.16160.0/20101208 found nothing
Fortinet 4.2.254.0/20101208 found nothing
GData 21/20101208 found nothing
Ikarus T3.1.1.90.0/20101208 found nothing
Jiangmin 13.0.900/20101208 found nothing
K7AntiVirus 9.71.3182/20101207 found nothing
Kaspersky 7.0.0.125/20101208 found nothing
McAfee 5.400.0.1158/20101208 found nothing
McAfee-GW-Edition 2010.1C/20101208 found nothing
Microsoft 1.6402/20101208 found nothing
NOD32 5684/20101208 found nothing
Norman 6.06.10/20101208 found nothing
nProtect 2010-12-08.02/20101208 found nothing
Panda 10.0.2.7/20101208 found nothing
PCTools 7.0.3.5/20101208 found nothing
Prevx 3.0/20101208 found nothing
Rising 22.77.01.08/20101208 found nothing
Sophos 4.60.0/20101208 found nothing
SUPERAntiSpyware 4.40.0.1006/20101208 found nothing
Symantec 20101.2.0.161/20101208 found nothing
TheHacker 6.7.0.1.096/20101206 found nothing
TrendMicro 9.120.0.1004/20101208 found nothing
TrendMicro-HouseCall 9.120.0.1004/20101208 found nothing
VBA32 3.12.14.2/20101207 found nothing
VIPRE 7557/20101208 found nothing
ViRobot 2010.12.8.4191/20101208 found nothing
VirusBuster 13.6.80.0/20101208 found nothing
jlaureni
Regular Member
 
Posts: 21
Joined: November 28th, 2010, 1:29 pm

Re: Google search results links hijacked

Unread postby deltalima » December 8th, 2010, 9:06 am

Hi jlaureni,


I am wondering about the issue with coupon printer - it is used to print coupons to take to the grocery store - it there a problem in general or is it the version on my computer?


Coupon Printer in general has a bad reputation, not specifically your version and we always recommend it's removal.

Can I turn the virus protection on again?


Yes, please do.

Please post the rest of the logs when complete.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: Google search results links hijacked

Unread postby jlaureni » December 11th, 2010, 8:51 am

Hi deltalima,
I thought that I posted the logs from MalwareBytes and ESET but I don't see them. I will post them again.

MalwareBytes:
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5285

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18975

12/10/2010 5:45:16 PM
mbam-log-2010-12-10 (17-45-16).txt

Scan type: Quick scan
Objects scanned: 166291
Time elapsed: 11 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

ESET:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6415
# api_version=3.0.2
# EOSSerial=7a8424668c40204ba8677884f205906d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-12-10 04:31:52
# local_time=2010-12-10 11:31:52 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 103667 103667 0 0
# compatibility_mode=5121 16777213 100 75 1006372 20607472 0 0
# compatibility_mode=5892 16776574 100 100 1952263 128586660 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=202406
# found=5
# cleaned=0
# scan_time=19583
C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Joe\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Public\Documents\Server\hlp.dat Win32/Bamital.DZ trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Sonia\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Sonia\Downloads\registrybooster.exe Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
jlaureni
Regular Member
 
Posts: 21
Joined: November 28th, 2010, 1:29 pm

Re: Google search results links hijacked

Unread postby deltalima » December 11th, 2010, 12:32 pm

Hi jlaureni,

Run OTL Script

  • Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the Image textbox. Do not include the word Code
    Code: Select all
    :files
    C:\Users\Public\Documents\Server\hlp.dat
    C:\Users\Sonia\Downloads\registrybooster.exe
    C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar
    C:\Users\Joe\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar
    C:\Users\Sonia\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar
    :commands
    [EMPTYTEMP]
    [REBOOT]
    
  • Then click the Run Fix button at the top.
  • Click Image.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Now please run a new scan with ESET and post the log in your next reply.
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: Google search results links hijacked

Unread postby jlaureni » December 12th, 2010, 8:32 am

Hi deltalima,

Here are the scan results.

OTL:
All processes killed
========== FILES ==========
C:\Users\Public\Documents\Server\hlp.dat moved successfully.
C:\Users\Sonia\Downloads\registrybooster.exe moved successfully.
C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar moved successfully.
C:\Users\Joe\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar moved successfully.
C:\Users\Sonia\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Joe
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: MixedReception
->Temp folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Sonia
->Temp folder emptied: 2769457 bytes
->Temporary Internet Files folder emptied: 53592182 bytes
->Java cache emptied: 10150 bytes
->FireFox cache emptied: 81882402 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 11556 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 242008 bytes
RecycleBin emptied: 1887 bytes

Total Files Cleaned = 132.00 mb


OTL by OldTimer - Version 3.2.17.3 log created on 12112010_163623

Files\Folders moved on Reboot...
File\Folder C:\Users\Sonia\AppData\Local\Temp\hsperfdata_Sonia\6108 not found!
C:\Users\Sonia\AppData\Local\Temp\ehmsas.txt moved successfully.
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF44CF.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF4575.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF616E.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF61A9.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF8A31.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF8A44.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF8E18.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DF8F3E.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFC925.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFC95E.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFDB9C.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFDBB5.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFEE83.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFEE91.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFF206.tmp not found!
File\Folder C:\Users\Sonia\AppData\Local\Temp\~DFF215.tmp not found!
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FNYPQ6VT\empty[1].htm moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJM3OAIZ\ecco-casual-bouillon-poms-sepia-quick-nubuck[1].htm moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\631R2V2O\like[1].htm moved successfully.
C:\Users\Sonia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\631R2V2O\viewtopic[2].htm moved successfully.
C:\Windows\temp\sqlite_AKZdzn3kBYIvuuN moved successfully.

Registry entries deleted on Reboot...

ESET:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6415
# api_version=3.0.2
# EOSSerial=7a8424668c40204ba8677884f205906d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-12-10 04:31:52
# local_time=2010-12-10 11:31:52 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 103667 103667 0 0
# compatibility_mode=5121 16777213 100 75 1006372 20607472 0 0
# compatibility_mode=5892 16776574 100 100 1952263 128586660 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=202406
# found=5
# cleaned=0
# scan_time=19583
C:\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Joe\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Public\Documents\Server\hlp.dat Win32/Bamital.DZ trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Sonia\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Sonia\Downloads\registrybooster.exe Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6415
# api_version=3.0.2
# EOSSerial=7a8424668c40204ba8677884f205906d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-12-12 03:22:39
# local_time=2010-12-11 10:22:39 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 229481 229481 0 0
# compatibility_mode=5121 16777213 100 75 1132186 20733286 0 0
# compatibility_mode=5892 16776574 100 100 2078077 128712474 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=201730
# found=5
# cleaned=0
# scan_time=19219
C:\_OTL\MovedFiles\12112010_163623\C_Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\12112010_163623\C_Users\Joe\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\12112010_163623\C_Users\Public\Documents\Server\hlp.dat Win32/Bamital.DZ trojan (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\12112010_163623\C_Users\Sonia\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\12112010_163623\C_Users\Sonia\Downloads\registrybooster.exe Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6415
# api_version=3.0.2
# EOSSerial=7a8424668c40204ba8677884f205906d
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-12-12 09:15:51
# local_time=2010-12-12 04:15:51 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 251960 251960 0 0
# compatibility_mode=5121 16777213 100 75 1154665 20755765 0 0
# compatibility_mode=5892 16776574 100 100 2100556 128734953 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=201689
# found=5
# cleaned=0
# scan_time=17926
C:\_OTL\MovedFiles\12112010_163623\C_Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\12112010_163623\C_Users\Joe\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\12112010_163623\C_Users\Public\Documents\Server\hlp.dat Win32/Bamital.DZ trojan (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\12112010_163623\C_Users\Sonia\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\12112010_163623\C_Users\Sonia\Downloads\registrybooster.exe Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
jlaureni
Regular Member
 
Posts: 21
Joined: November 28th, 2010, 1:29 pm

Re: Google search results links hijacked

Unread postby deltalima » December 12th, 2010, 3:56 pm

Hi jlaureni,

The ESET detections are all in the safe OTL moved folder and will be removed below.

Now that you are clean, please follow these steps in order to keep your computer clean and secure.

Remove GMER

Delete the GMER icon from your desktop.

Uninstall ComboFix

  • Click START then RUN
  • Now type Combofix /Uninstall in the runbox and click OK

Clean up with OTL

  • Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CleanUp! button
  • Say Yes to the prompt and then allow the program to reboot your computer.


Create a new, clean System Restore point which you can use in case of future system problems:
  • Press Start >> All Programs >> Accessories >>System Tools >> System Restore
  • Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
  • Now remove old, infected System Restore points:
  • Next click Start >> Run and type cleanmgr in the box and press OK
  • Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
  • Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
  • Press OK and Yes to confirm

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.


Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety


Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean!
User avatar
deltalima
Admin/Teacher
Admin/Teacher
 
Posts: 7614
Joined: February 28th, 2009, 4:38 pm
Location: UK

Re: Google search results links hijacked

Unread postby Gary R » December 13th, 2010, 6:22 pm

As your problems appear to have been resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.
User avatar
Gary R
Administrator
Administrator
 
Posts: 25888
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 296 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware