This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Mozilla Browser Hijacked - Google Search Results redirected

9 min read

Looking for the outcome? Ask AI

This thread's last reply is from January 15, 2011, 7:08 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

deltalima Admin/Teacher
January 9, 2011, 7:59 PM UTC
TDSS killer downloaded and I ran it but it never produced the log, or otherwise showed that it was running.

Please reboot and then download a new copy of TDSSKiller and run it again then check in C:\ for the log.
ericldauster
January 9, 2011, 9:22 PM UTC
Downloaded TDSSkiller.zip again. Extracted TDSSKiller.exe and double clicked it.

Got the dialog box asking permission to run the exe - ran it. Nothing opened up to indicate activity although the disk light was blinking.

Waited 10 minutes and checked C: for the log - no log found. Did a search and it didn't show up.

I haven't run the Malwarebytes scan as requested earlier because I was waiting to run TDSSKiller first.
ericldauster
January 9, 2011, 9:24 PM UTC
And I did reboot before downloading and trying again.
deltalima Admin/Teacher
January 9, 2011, 9:28 PM UTC
Hi ericldauster,

I haven't run the Malwarebytes scan as requested earlier because I was waiting to run TDSSKiller first.


OK let's pass on those two scans for now while I research the problem with TDSSKiller.

MBRBackup
Download MBRBackup to your Desktop.
http://www.misec.net/products/mbrBackup.exe
Doubleclick MBRBackup.exe to launch the program. If prompted by your computer allow it to run.
Click SaveMBR (top left corner) and save the backup file to your Desktop.
Exit the program.
It will have a name similar to MBR_2010-10-06.bin where the numbers correspond to the date the backup was made.


Analyze file(s).
Please visit Virustotal.

Click on browse > navigate to the MBR_2010-xx-xx.bin backup file > Click Open:

  • Press Send File - this will submit the file for testing.
  • Please wait for all the scanners to finish then copy and paste the permalink (web address) in your next response.

Example of web address :


Create a batch file
  1. Open Notepad.
  2. Copy/paste the following text into the empty Notepad window. 
    @echo off
    
Nslookup www.malwarebytes.org >> results.txt 
    
Nslookup www.safer-networking.org >> results.txt 
    
Nslookup www.google.com >> results.txt
    
Nslookup www.google.co.uk  >> results.txt
    
Ping www.malwarebytes.org >> results.txt 
    
ping www.safer-networking.org >> results.txt 
    
ping www.google.com >> results.txt 
    
ping www.google.co.uk >> results.txt 
    
start notepad results.txt 
    
Del %0
  3. Save the file as xxx.bat on your desktop. Save it with the file type... all types *.*.
  4. Double click the file xxx.bat to execute.


results.txt should open in Notepad automatically when the script has complete, post the contents of this file in your next response.
ericldauster
January 9, 2011, 9:36 PM UTC
I'm getting a "page not found" error message when I click on http://www.misec.net/products/mbrBackup.exe
deltalima Admin/Teacher
January 9, 2011, 9:38 PM UTC
Try this link

http://www.misec.net/products/MBRBackup.exe
ericldauster
January 9, 2011, 9:48 PM UTC
Successfully ran MBR Backup but cannot visit VirusTotal at link provided

http://www.virustotal.com/en/indexf.html

page not found
deltalima Admin/Teacher
January 9, 2011, 9:50 PM UTC
Try this one

http://www.virustotal.com
ericldauster
January 9, 2011, 9:55 PM UTC
http://www.virustotal.com/file-scan/report.html?id=7626d6cdea02e368e524868aeeccbaf247dd626cb0bd26fe27c2573b43ceb0c3-1294610030

Creating and running batch file now.
ericldauster
January 9, 2011, 9:59 PM UTC
results of batch file run
--------------

Server: dsldevice
Address: 192.168.1.254

Name: malwarebytes.org
Address: 216.245.195.234
Aliases: www.malwarebytes.org

Server: dsldevice
Address: 192.168.1.254

Name: www.safer-networking.org
Address: 188.165.126.152

Server: dsldevice
Address: 192.168.1.254

Name: www.l.google.com
Addresses: 74.125.224.18, 74.125.224.19, 74.125.224.16, 74.125.224.17
74.125.224.20
Aliases: www.google.com

Server: dsldevice
Address: 192.168.1.254

Name: www.l.google.com
Addresses: 74.125.224.16, 74.125.224.17, 74.125.224.20, 74.125.224.18
74.125.224.19
Aliases: www.google.co.uk, www.google.com



Pinging malwarebytes.org [216.245.195.234] with 32 bytes of data:



Reply from 216.245.195.234: bytes=32 time=58ms TTL=50

Reply from 216.245.195.234: bytes=32 time=57ms TTL=50

Reply from 216.245.195.234: bytes=32 time=56ms TTL=50

Reply from 216.245.195.234: bytes=32 time=57ms TTL=50



Ping statistics for 216.245.195.234:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 56ms, Maximum = 58ms, Average = 57ms



Pinging www.safer-networking.org [188.165.126.152] with 32 bytes of data:



Reply from 188.165.126.152: bytes=32 time=181ms TTL=50

Reply from 188.165.126.152: bytes=32 time=179ms TTL=50

Reply from 188.165.126.152: bytes=32 time=174ms TTL=50

Reply from 188.165.126.152: bytes=32 time=178ms TTL=50



Ping statistics for 188.165.126.152:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 174ms, Maximum = 181ms, Average = 178ms



Pinging www.l.google.com [74.125.224.19] with 32 bytes of data:



Reply from 74.125.224.19: bytes=32 time=16ms TTL=55

Reply from 74.125.224.19: bytes=32 time=16ms TTL=55

Reply from 74.125.224.19: bytes=32 time=16ms TTL=55

Reply from 74.125.224.19: bytes=32 time=15ms TTL=55



Ping statistics for 74.125.224.19:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 15ms, Maximum = 16ms, Average = 15ms
deltalima Admin/Teacher
January 9, 2011, 10:19 PM UTC
Hi ericldauster,

TFC

  • Please download TFC to your desktop,
  • Save any unsaved work. TFC will close all open application windows.
  • Double-click TFC.exe to run the program.
  • Click the Start button in the bottom left of TFC
  • If prompted, click "Yes" to reboot.


Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It should not take longer than a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

Please run Malwarebytes, update and then run a quick scan and post the log in your next reply.

ESET online scannner

  • Please go Here then click on:
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • Select the option YES, I accept the Terms of Use then click on:
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:

    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology

  • Now click on:
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on:
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.
ericldauster
January 12, 2011, 1:09 AM UTC
Ran TFC and the MalWare scan - I'll try to remember to run the ESET scan tonight. -Here's the MalWare log.
----------------
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5489

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/9/2011 2:44:28 PM
mbam-log-2011-01-09 (14-44-28).txt

Scan type: Quick scan
Objects scanned: 153685
Time elapsed: 6 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
=====================
deltalima Admin/Teacher
January 12, 2011, 7:47 AM UTC
OK, please post when ready.
ericldauster
January 12, 2011, 5:07 PM UTC
I appreciate all of the help you've given me.

The hard drive appears to have died last night. Controller checks out ok but I can't get the hard drive to spin. I will work on this but it may be the weekend before I know if this drive will come back to life or not.

If I end up with a new drive I'll want to transfer over photos and videos to the new drive. What should I be sure to not transfer over in order to try to avoid the transfer of the virus?
deltalima Admin/Teacher
January 12, 2011, 7:19 PM UTC
Hi ericldauster,

Sorry to hear about the disk drive failing.

If I end up with a new drive I'll want to transfer over photos and videos to the new drive. What should I be sure to not transfer over in order to try to avoid the transfer of the virus?


The main thin is to get antivirus software installed and all Microsoft updates as soon as possible once the machine has been installed.

Photos and videos should be OK to transfer, but make sure you scan all of them with the antivirus before you open any of them.

I will keep this thread open for 3 days so that if you manage to get the drive running we can continue to track down this infection.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI