Solved Google redirect virus on Windows 7. It stops most antivirus/malware software

Broni · Oct 4, 2011

Looks good

Go on....

Broni · Oct 10, 2011

The issue seems to be resolved.

revochiro · Oct 13, 2011

sorry, we had some major staffing issue within our office and had to put this on the back burner for a few days. I will try to run the other updates and scans as you posted earlier to make sure that we are clean and ready to go. We are trying to get our quickbooks working again since our monthly payments are behind.

Broni · Oct 13, 2011

OK......................

revochiro · Oct 14, 2011

All processes killed
========== OTL ==========
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
File C:\Users\revolution\AppData\Roaming\Mozilla\Firefox\Profiles\9l2n91d7.defau lt\searchplugins\askcom.xml not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
ADS C:\Windows\1368793489:1860069806.exe deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: levi
->Temp folder emptied: 70335 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 3766438 bytes
->Flash cache emptied: 42922 bytes

User: Public
->Temp folder emptied: 0 bytes

User: QBDataServiceUser20
->Temp folder emptied: 771072 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes

User: reception
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 43830 bytes

User: revolution
->Temp folder emptied: 4316678 bytes
->Temporary Internet Files folder emptied: 32869198 bytes
->Java cache emptied: 3192763 bytes
->FireFox cache emptied: 80972333 bytes
->Google Chrome cache emptied: 819568 bytes
->Flash cache emptied: 289141 bytes

User: revolution_2
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 43386 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 388110441 bytes
RecycleBin emptied: 19705088 bytes

Total Files Cleaned = 510.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: levi
->Flash cache emptied: 0 bytes

User: Public

User: QBDataServiceUser20
->Flash cache emptied: 0 bytes

User: reception
->Flash cache emptied: 0 bytes

User: revolution
->Flash cache emptied: 0 bytes

User: revolution_2
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.29.1 log created on 10142011_093020

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

revochiro · Oct 14, 2011

Results of screen317's Security Check version 0.99.7
Windows 7 Service Pack 1 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
avast! Free Antivirus
Trend Micro Internet Security
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java(TM) 6 Update 27
Out of date Java installed!
Adobe Flash Player 11.0.1.152
Adobe Reader 9.3.2
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.23)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
Alwil Software Avast5 AvastSvc.exe
Trend Micro OKAVAgent OKAVAgent.exe
Trend Micro Internet Security SfCtlCom.exe
Trend Micro Internet Security UfSeAgnt.exe
``````````End of Log````````````

Broni · Oct 14, 2011

You're running two AV programs:
avast! Free Antivirus
Trend Micro Internet Security
One of them has to go.
Your choice.

===============================================================

Update Adobe Reader

You can download it from https://www.techspot.com/downloads/2083-adobe-reader-dc.html
After installing the latest Adobe Reader, uninstall all previous versions (if present).
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

revochiro · Oct 14, 2011

C:\Qoobox\Quarantine\C\Program Files\Avira\AntiVir Desktop\_sched_.exe.zip Win32/Patched.HN trojan deleted - quarantined
C:\Qoobox\Quarantine\C\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe.vir Win32/Patched.HN trojan cleaned - quarantined
C:\Qoobox\Quarantine\C\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe.vir Win32/Patched.HN trojan cleaned - quarantined
C:\Qoobox\Quarantine\C\Program Files\CyberLink\Shared Files\RichVideo.exe.vir Win32/Patched.HN trojan cleaned - quarantined
C:\Qoobox\Quarantine\C\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe.vir Win32/Patched.HN trojan cleaned - quarantined
C:\Qoobox\Quarantine\C\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe.vir Win32/Patched.HN trojan cleaned - quarantined
C:\Qoobox\Quarantine\C\Program Files\SUPERAntiSpyware\SASCORE.EXE.vir Win32/Patched.HN trojan cleaned - quarantined
C:\Qoobox\Quarantine\C\Program Files\Trend Micro\Internet Security\SfCtlCom.exe.vir Win32/Patched.HN trojan cleaned - quarantined
C:\Qoobox\Quarantine\C\Program Files\Trend Micro\OKAVAgent\OKAVAgent.exe.vir Win32/Patched.HN trojan cleaned - quarantined
C:\Qoobox\Quarantine\C\Windows\assembly\GAC_MSIL\desktop.ini.vir a variant of Win32/Sirefef.CH trojan cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\system32\MuiUtvdm.dll.vir a variant of Win32/Kryptik.TIM trojan cleaned by deleting - quarantined

revochiro · Oct 14, 2011

Trend has been uninstalled and computer will be rebooted.

Broni · Oct 14, 2011

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.

revochiro · Oct 18, 2011

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: levi
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: QBDataServiceUser20
->Temp folder emptied: 771072 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: reception
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: revolution
->Temp folder emptied: 4874408 bytes
->Temporary Internet Files folder emptied: 4604966 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 91432274 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 2510 bytes

User: revolution_2
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2924490 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 100.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: levi
->Flash cache emptied: 0 bytes

User: Public

User: QBDataServiceUser20
->Flash cache emptied: 0 bytes

User: reception
->Flash cache emptied: 0 bytes

User: revolution
->Flash cache emptied: 0 bytes

User: revolution_2
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.29.1 log created on 10182011_144016

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Broni · Oct 18, 2011

13. Please, let me know, how your computer is doing.

Whenever ready.....

revochiro · Oct 18, 2011

it actually seems to be running perfectly. I was able to get my quickbooks up and running again. The only thing I cant find/figure out is one of my chiropractic software tools. I am still searching, as I think its a routing issue not a loss of data problem. Thanks for your help

Broni · Oct 18, 2011

Way to go!!

Good luck and stay safe

revochiro · Oct 28, 2011

donation sent, Thanks

Broni · Oct 28, 2011

Thank you very much

Solved Google redirect virus on Windows 7. It stops most antivirus/malware software

Broni

Posts: 56,041 +516

Broni

Posts: 56,041 +516

revochiro

Posts: 24 +0

Broni

Posts: 56,041 +516

revochiro

Posts: 24 +0

revochiro

Posts: 24 +0

Broni

Posts: 56,041 +516

revochiro

Posts: 24 +0

revochiro

Posts: 24 +0

Broni

Posts: 56,041 +516

revochiro

Posts: 24 +0

Broni

Posts: 56,041 +516

revochiro

Posts: 24 +0

Broni

Posts: 56,041 +516

revochiro

Posts: 24 +0

Broni

Posts: 56,041 +516

Similar threads

Latest posts