Browser Redirect problem in IE and Firefox

By Astronerd
Dec 18, 2009
Topic Status:
Not open for further replies.
  1. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    Kritius,
    Here is the log...

    Attached Files:

  2. kritius

    kritius TechSpot Guru Posts: 2,087

    Still being redirected?
  3. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    Kritius,
    It appears as though the redirect has been cleared up. In my testing, all of the Google searches have been directed to the proper links. Same goes for Yahoo and Bing. Do you guys think it will be safe to use this machine or is there a chance there are more "backdoor" hijacks lurking around on the HD?
  4. kritius

    kritius TechSpot Guru Posts: 2,087

    DDS by sUBs
    Please download DDS by sUBs from HERE or HERE and save it to your Desktop.

    Vista users. Right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

    • Double click on dds to run it.
    • When done, DDS.txt will open.
    • You will receive another prompt after a while. Click Yes at the prompt. It will take another few minutes to scan.
    • When done, Attach.txt will open.
    • Please zip and attach the contents of DDS.txt and Attach.txt in your next reply.
  5. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    Kritius,
    Your first link opens a site that McAfee flags as dangerous. The second downloads a screen saver! I am REAL CAUTIOUS about screen savers. Are you sure about this?
  6. kritius

    kritius TechSpot Guru Posts: 2,087

    Yup.

    McAfee wouldn't know the preverbial **** from elbow. Disable it and then download
  7. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    Am I to open a screen saver named dds.scr?
  8. kritius

    kritius TechSpot Guru Posts: 2,087

    Disable McAfee and then download from link 1
  9. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

  10. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    OK...
    Here is the zipped file...

    Attached Files:

  11. kritius

    kritius TechSpot Guru Posts: 2,087

    Download ComboFix from one of these locations:

    Link 1
    Link 2


    * IMPORTANT !!! Save ComboFix.exe to your Desktop


    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

    • Double click on ComboFix.exe & follow the prompts.

    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


    [​IMG]


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [​IMG]


    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.
     
  12. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    Here is the ComboFix Log...

    Attached Files:

  13. kritius

    kritius TechSpot Guru Posts: 2,087

    1. Close any open browsers.

    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    3. Open notepad and copy/paste the text in the quotebox below into it:

    Save this as CFScript.txt, in the same location as ComboFix.exe


    [​IMG]

    Refering to the picture above, drag CFScript into ComboFix.exe

    When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
  14. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    Step 3 of your instructions includes a single line:

    c:\windows\system32\drivers\raqhcge.sys

    In the e-mail instructions there are multipl lines:

    c:\windows\system32\AVSredirect.dll
    c:\windows\system32\cygwin1.dll
    c:\windows\system32\cygz.dll
    c:\windows\system32\x.264.exe
    c:\windows\system32\drivers\raqhcge.sys

    I have already started the ComboFix with the first virsion and my machine is rebooting.
    Should I rerun with the second set?
  15. kritius

    kritius TechSpot Guru Posts: 2,087

    c:\windows\system32\drivers\raqhcge.sys this is what it should have been.

    No need to re run.
  16. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    OK... Here is the ComboFix file...

    Attached Files:

  17. kritius

    kritius TechSpot Guru Posts: 2,087

    Looks good.

    Download TFC to your desktop
    • Open the file and close any other windows.
    • It will close all programs itself when run, make sure to let it run uninterrupted.
    • Click the Start button to begin the process. The program should not take long to finish its job
    • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean


    Please download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.
    • Open JavaRa.exe again and select Search For Updates.
    • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

    Please do an online scan with Kaspersky WebScanner

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure the following is checked.
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases
    5. Click on My Computer under Scan.
    6. Once the scan is complete, it will display the results. Click on View Scan Report.
    7. You will see a list of infected items there. Click on Save Report As....
    8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
    9. Please post this log in your next reply.
  18. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    OK...
    The TFC was easy and ran with no problem...
    JavaRa downloaded, ran the first time and deleted Older Versions with no problem.
    When I selected Search For Updates, It went to the web page... I selected the JRE version for my OS and the download Java window opened. I selected the file and hit the Start button. The progress bar filled up but I am at a loss as to where the file was put!
     
  19. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    Never mind... I think I found it...
  20. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    The Kaspersky WebScanner is running awfully slowly. I started it over 4 hours ago. The time lapse counter only shows 2hrs 29min. Twice it has stalled on some script error. I let it run. It has found only 1 threat. It has only finished 14% of the scan. What do you suggest?
  21. kritius

    kritius TechSpot Guru Posts: 2,087

    Can you remember what the threat was?
  22. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    OK...
    This thing ran for about 8 hours. About 5 or 6 times a script error message popped up. I always responded to continue to allow scripts to run. The process found one threat. It seems to be in a program that I use to read EXIF data from digital camera photos. I can kill that and find something else to read or edit this information.
    Here is the file...

    Attached Files:

  23. kritius

    kritius TechSpot Guru Posts: 2,087

    Ok.

    You can go ahead and delete that.

    Other than that.

    Remove Combofix now that we're done with it.
    • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
    • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
      [​IMG]
    • Please follow the prompts to uninstall Combofix.
    • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
    This will uninstall Combofix and anything assoicated with it.



    • Download OTC to your desktop and run it
    • Click Yes to beginning the Cleanup process and remove these components, including this application.
    • You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.
  24. Astronerd

    Astronerd Newcomer, in training Topic Starter Posts: 64

    OK... This is done.
    The OTC process seems to have removed some programs and files but there is a lot of other stuff left... such as Malwarebytes, SUPERAntiSpyware, Trojan Remover, etc. Should these files have been removed?
    Also, is the end of the process to get rid of the problems?
  25. kritius

    kritius TechSpot Guru Posts: 2,087

    Get rid of Trojan Remover, it's rubbish.

    Keep MBAM, ans SAS.

    Any other things left behind?
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.