Google redirect and trojan horse dropper -- 8 steps completed

By apeliz
Dec 4, 2009
  1. Hello,

    The past week AVG has been coming up with a trojan horse dropper.generic infection warning about every time I start my computer. I tried to get rid of it myself but it keeps coming back. And today I ran into the google redirect problem like many other people. I attached the log files here and ran an AVG scan that detected 15 trojan viruses, all were .exe files in my temp folder that keep coming back even if I delete them.

    Any help would be much appreciated!
  2. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Startup HJT Scan Only
    Check (tick) the following entries, and then select FIX
    Close HJT

    • Download [​IMG]Combofix to your desktop.
    • Disable your Antivirus (as Combofix will remove any found malwares)
    • Double click ComboFix & follow the prompts.
    • A window will open with a warning.
    • When the scan completes it will open a text window. Please attach that log back here
    Also restart and provide a fresh HJT Scan log

    Note also I'm not a big favorite of AVG
    If yours is the free version, I'd suggest uninstalling it (from Add/Remove programs) the running the >Removal Tool, then restarting
    After restart, download install and update to: >Free Avira, and run a full scan
  3. apeliz

    apeliz TS Rookie Topic Starter

    Sorry for the delay.

    I've attached the combofix log and the new HJT log. I did an Avira scan and it came up with one virus--I attached that log too in case you wanted to look at it.

    Thanks for your help!
  4. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Please uninstall the following:
    SUPERAntiSpyware (this has served its purpose now)
    Ad-Aware (your choice, but it hasn't helped you)
    Vuze (P2P and Windows do not go together)
    Azureus (P2P and Windows do not go together)

    Go HERE and confirm your Java is up to date
    Download and run JavaRa
    This will remove all your old Java stuff (that is not required)

    Download and run TFC by Oldtimer
    Then start a clean. Note: Your computer may need to restart

    Startup CCleaner again and run a clean (also select: DNS Cache under System)
    Still in CCleaner, select the "Registry" button, and select Scan for issues
    Fix all found issues, you may need to do this about 3 times in a row to get them all

    Start > Run > Combofix /uninstall > ok
    To fully uninstall Combofix and its quarantine folder

    Go to Start >> Run - type or copy/paste control sysdm.cpl,,4 and then press Enter
    • Tick on the checkbox - Turn off System Restore on all drives
    • Click Apply
    Turn it back 'On' by unticking the same checkbox & click Apply, and then OK


    You may want to update Malwarebytes once more, and run a quick scan
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    apeliz, Avira shows malware in "C:\Qoobox\Quarantine"- this is where Combofix put the files it quarantines- it's not going to affect the system now. When we have you uninstall Combofix, these will be removed.

    There is a list of 19 files in the Recycler folder in show in the Combofixc log.They look like this but the number strings are different:

    The Recycler is a hidden folder that holds the files emptied from the Recycle Bin. They can be removed easily. The Recycler folder received the deleted files from ALL of the users, each user having their own identification number. Looking at this list, it appears that there are 19 different accounts listed.

    Is this an older machine that had other users or are there 19 users now? That's a lot of users on one machine. There is a command that can be use to empty this but It doesn't always work, so let's try a different way.

    First, it's important that you empty the recycle bin first. These files won't delete if there is trash in the bin.
    Second, you must show hidden files and folders:
    Click on the Control Panel> Folder Options> View tab> Check 'show hidden files and folders'> Uncheck 'hide system and protected files (Recommended'> Apply> OK

    Now open Windows Explorer: Right click on Start> explore> My Computer> Local Drive- usually C> click on the Recycler folder on the left. This shows the files on the right screen> do a right click> delete on each.

    Go back and hide the files.

    You have Viewpoint Media Player installed on your system. This program is not malware but it is foistware in that it is usually installed without the user's knowledge or approval, and for this reason I recommend you remove it. If you actually use this program, I recommend you try using safe and free alternatives such as VLC Media Player:

    To remove, find and remove Viewpoint Media Player

    Boot into Safe Mode
    • Restart your computer and start pressing the F8 key on your keyboard.
    • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.
    • Click on Start > Run and type: services.msc> OK
    • Click the "Extended tab".
    • Scroll down the list and find the service called "Viewpoint Manager Service"
    • When you find the service, double-click on it.
    • In the Properties Window > General Tab that opens, click the "Stop" button.
    • From the drop-down menu next to "Startup Type", click on "Disabled".
    • Now click "Apply", then "OK" and close any open windows.
    • Click on Start > Settings > Control Panel >Add/Remove Programs
    • Highlight and remove all references to Viewpoint - i.e. Viewpoint, Viewpoint Manager, Viewpoint Media Player.

    Finally, delete the following folders if they still exist: Open Windows Explorer> Programs:
    C:\Program Files\ViewManager\ <-- and delete this folder
    C:\Program Files\Viewpoint\ <-- and delete this folder

    Empty the Recycle Bin

    The SAS log shows the malware in the temp files and System Restore. We'll have you drop those old restore points at the end- don't do a SR now:

    TFC (Temp File Cleaner)

    Download TFC to your desktop
    • Open the file and close any other windows.
    • It will close all programs itself when run, make sure to let it run uninterrupted.
    • Click the Start button to begin the process. The program should not take long to finish its job
    • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

    TFC only cleans temp folders. TFC will not clean URL history, prefetch, or cookies. Depending on how often someone cleans their temp folders, their system hardware, and how many accounts are present, it can take anywhere from a few seconds to a minute or more. TFC will completely clear all temp files where other temp file cleaners may fail. TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.

    TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder.

    After all of that is done, run an online scan:
    Run Eset NOD32 Online AntiVirus Scanner HERE

    Note: You will need to use Internet Explorer for this scan.
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the Active X control to install
    • Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    • Click Start
    • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    • Click Scan
    • Wait for the scan to finish
    • Re-enable your Antivirus software.
    • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

    Please attach online scan log.
    Rescan with HJT and attach new log.

    kimsland may come alone and write script for all this, but if not, this should help. I'll give you a heads up for the tracking cookies in my next reply.
  6. apeliz

    apeliz TS Rookie Topic Starter


    I did everything you said and the malwarebytes scan didn't come up with anything. Do I need to do anything else or is my system clean now?


    I also did what you suggested. When I went to the recycler to delete those 19 files you were talking about, there was only one and I couldn't delete it because it said the file was in use. Other than that, everything else went fine and it seems like my system is clean now. I attached the online scan and a new HJT log.

    Thanks for your help!
  7. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Don't worry about the Recycler- the Eset log is clean and so is HJT. As far as I'm concerned, if the original problem has been resolved, you can remove the cleaning tools and set clean restore point.

    One note: If you have the paid AdAware which comes with AdWatch, there is no reason to remove it. In fact, even if it doesn't, you can keep it. There is no security program on the market that comes with a guarantee to keep all malware out!

    Remove all of the tools we used and the files and folders they created
    • DownloadOTCleanIt by OldTimer
    • Save it to your Desktop.
    • Double click OTCleanIt.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    The tool will delete itself once it finishes.

    If you are prompted to Reboot during the cleanup, select Yes.

    You should now set a new Restore Point to prevent infection from any previous Restore Points. The easiest and safest way to do this is:
    • Go to Start > All Programs > Accessories > System Tools and click "System Restore".
    • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the Restore Point a name then click "Create". The new Restore Point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
    • Go to "Disk Cleanup" which can be found by going to Start > All Programs > Accessories > System Tools.
    • Click "OK" to select the partition or drive you desire.
    • Click the "More Options" Tab.
    • Click "Clean Up" in the System Restore section to remove all previous Restore Points except the newly created one.

    Edit: You should update the Adobe Reader: Yours is outdated.
    Visit this Adobe Reader site often and make sure you have the most current update. Uninstall any earlier updates as they are vulnerabilities.

    You might wait a few hours and see if kimsland has any additional instructions. If not, please let us know if you need our help in the future.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...