Browser Redirect problem in IE and Firefox

Status
Not open for further replies.
Kritius,
It appears as though the redirect has been cleared up. In my testing, all of the Google searches have been directed to the proper links. Same goes for Yahoo and Bing. Do you guys think it will be safe to use this machine or is there a chance there are more "backdoor" hijacks lurking around on the HD?
 
DDS by sUBs
Please download DDS by sUBs from HERE or HERE and save it to your Desktop.

Vista users. Right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

  • Double click on dds to run it.
  • When done, DDS.txt will open.
  • You will receive another prompt after a while. Click Yes at the prompt. It will take another few minutes to scan.
  • When done, Attach.txt will open.
  • Please zip and attach the contents of DDS.txt and Attach.txt in your next reply.
 
Kritius,
Your first link opens a site that McAfee flags as dangerous. The second downloads a screen saver! I am REAL CAUTIOUS about screen savers. Are you sure about this?
 
Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[CENTER]
RC1.png
[/CENTER]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC2-1.png



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.
 
1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\system32\drivers\raqhcge.sys

Driver::
bxblxpwr

KILLALL::
Click to expand...

Save this as CFScript.txt, in the same location as ComboFix.exe


CFScriptB-4.gif


Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
 
Step 3 of your instructions includes a single line:

c:\windows\system32\drivers\raqhcge.sys

In the e-mail instructions there are multipl lines:

c:\windows\system32\AVSredirect.dll
c:\windows\system32\cygwin1.dll
c:\windows\system32\cygz.dll
c:\windows\system32\x.264.exe
c:\windows\system32\drivers\raqhcge.sys

I have already started the ComboFix with the first virsion and my machine is rebooting.
Should I rerun with the second set?
 
c:\windows\system32\drivers\raqhcge.sys this is what it should have been.

No need to re run.
 
Looks good.

Download TFC to your desktop
  • Open the file and close any other windows.
  • It will close all programs itself when run, make sure to let it run uninterrupted.
  • Click the Start button to begin the process. The program should not take long to finish its job
  • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean


Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Please do an online scan with Kaspersky WebScanner

  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure the following is checked.
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  5. Click on My Computer under Scan.
  6. Once the scan is complete, it will display the results. Click on View Scan Report.
  7. You will see a list of infected items there. Click on Save Report As....
  8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  9. Please post this log in your next reply.
 
OK...
The TFC was easy and ran with no problem...
JavaRa downloaded, ran the first time and deleted Older Versions with no problem.
When I selected Search For Updates, It went to the web page... I selected the JRE version for my OS and the download Java window opened. I selected the file and hit the Start button. The progress bar filled up but I am at a loss as to where the file was put!
 
The Kaspersky WebScanner is running awfully slowly. I started it over 4 hours ago. The time lapse counter only shows 2hrs 29min. Twice it has stalled on some script error. I let it run. It has found only 1 threat. It has only finished 14% of the scan. What do you suggest?
 
OK...
This thing ran for about 8 hours. About 5 or 6 times a script error message popped up. I always responded to continue to allow scripts to run. The process found one threat. It seems to be in a program that I use to read EXIF data from digital camera photos. I can kill that and find something else to read or edit this information.
Here is the file...
 

Attachments

  • Kaspersky.txt
    766 bytes · Views: 1
Ok.

You can go ahead and delete that.

Other than that.

Remove Combofix now that we're done with it.
  • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
    CF_Uninstall-1.jpg
  • Please follow the prompts to uninstall Combofix.
  • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
This will uninstall Combofix and anything assoicated with it.



  • Download OTC to your desktop and run it
  • Click Yes to beginning the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.
 
OK... This is done.
The OTC process seems to have removed some programs and files but there is a lot of other stuff left... such as Malwarebytes, SUPERAntiSpyware, Trojan Remover, etc. Should these files have been removed?
Also, is the end of the process to get rid of the problems?
 
Get rid of Trojan Remover, it's rubbish.

Keep MBAM, ans SAS.

Any other things left behind?
 
Status
Not open for further replies.

Similar threads

learninmypc
S Mode Again??
Replies
1
Views
454
learninmypc
learninmypc
A
Mozilla calls on Apple, Google, and Microsoft to create a more level playing field in...
Replies
11
Views
385
lazer
lazer
midian182
Google's AI-powered search can recommend malicious sites, including scams and malware
Replies
6
Views
139
James Ryan
J

Latest posts

Back