8 Step search result hijack help

[kimsland]

I have done a bit of research, this will do it

• Download The Avenger by Swandog46 from HERE.
• Unzip/extract it to a folder on your desktop.
• Double click on avenger.exe to run The Avenger.
• Click OK.
• Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
• Copy all of the text in the below code box to the clipboard by highlighting it and then pressing Ctrl+C.

Files to move:
c:\windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys | C:\Windows\system32\drivers\atapi.sys

• In the avenger window, click the Paste Script from Clipboard,
  
  button.
• You will be asked Are you sure you want to execute the current script?.
• Click Yes.
• You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
• Click Yes.
• Your PC will now be rebooted.
• Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
• After your PC has completed the necessary reboots, a log should automatically open. If it does not automatically open, then the log can be found at %systemdrive%\avenger.txt (typically C:\avenger.txt).
• Please attach
  
  this log, along with a new HijackThis log in your next reply.

EDIT: This is for Vista only

 

[EMS0525]

after i get the are you sure you want to execute the current script and click yes, i get a box that says "Error: Invalid script. A valid script must begin with a command directive. Aborting execution!"

 

[kimsland]

You need to copy both lines
Including the "Files to move: "

 

[EMS0525]

oooooooooooooooooops

 

[EMS0525]

sorry, one moment

 

[EMS0525]

As you can see, I am not Eric. This is his wife Krissy. He is at work having do all of this stuff! Sorry, im messing it all up!

 

[kimsland]

What the hell

I gave you Vista command, god knows why, must have gone dumb for a sec
C:\WINDOWS\ServicePackFiles\i386 That's where atapi.sys lives

But we need to check something first:

Start > Run > cmd /c start /min cmd /c "PEV -l %systemdrive%\atapi.sys >Log.txt&Log.txt&del Log.txt"
Wait about 30 secs for this log to show. Please post this log file to a new reply

 

[EMS0525]

here it is

 

[kimsland]

Look no matter how that turns out, just do the following: (I'm really confident now )

Lets try another option to remove this infection

Download MBR.exe and save it to your c:\ root directory, so its at c:\mbr.exe

Click on Start > Run and type in cmd and click OK.

Type in: c:\mbr.exe -f and then press the Enter key

Restart

 

[EMS0525]

whats next?

 

[EMS0525]

My wifes at home doing this stuff, and im here at work, i can thank you enough for helping us through this. It doesnt seem that bad like id have to reformat the comp just bad enough to be annoying, and no programs were removing it. Thank you.

 

[kritius]

I wouldn't try using the -f command without seeing the output of -t first.

 

[kimsland]

I've safely done the f command before

Is it still redirecting?

 

[EMS0525]

yes it is.

 

[kimsland]

kritius its beyond me

HELP

Unless its Erunt doing it?

 

[davey3jobs]

redirected

can anyone help, newby in forum. I have read loads on removing malware including ccleaner, ad aware, super anti spyware and this is the log for Hijack this....

help needed

 

[kimsland]

Hi davey3jobs,

Sorry you cannot just post on someone's Topic (especially this one )

You need to create your own >> New Topic, just for you

 

[EMS0525]

kritius its beyond me

HELP

Unless its Erunt doing it?

So its up to him now?

 

[kimsland]

We can only Pray

kritius and Bobbye are the best Malware helpers here
But since kritius and I argue all the time Then I am praying a lot, that he will look through the posts and find something I've missed


I'm out of ideas, I even thought Erunt may be returning the Malware or something (who knows)
Hopefully kritius
(please?)

 

[EMS0525]

Yes,..... please.

 

[EMS0525]

kritius and bobbye are the best malware helpers here

help!!!!!!!

 

[kritius]

Are the redirects in Firefox, IE or both?

 

[EMS0525]

Yes they are.

 

[kritius]

Yes they are in Firefox or yes they are in both.

Delete the copy of ComboFix that you have and then download a fresh one.

 

[EMS0525]

Sorry, yes the search results are hijacked in both browsers.