Solved Google searches are redirecting and I have a false anti-virus auto-installed

[Broni]

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\Tasks\WGASetup.job


Folder::
c:\documents and settings\Christopher Aune\Local Settings\Application Data\ejkmovahe

FCopy::
c:\windows\system32\dllcache\tcpip.sys | c:\windows\system32\drivers\tcpip.sys


Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"=-
"UpdReg"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt

 

[SirCarnifex]

Here's the Combofix.txt.

Note I'm online with my problem computer now, so that's good!

Still getting the 3 day activation notice, but I presume we'll get to that down the line.

Thanks again! I'm awaiting the next step.

EDIT: Still had some problems with Firefox trying to upload (program not responding and ANOTHER Trojan alert) but got it on the second try.

 

[Broni]

Excellent

Still getting the 3 day activation notice

Can you post a screenshot of that?

Also....
Go http://www.microsoft.com/genuine/default.aspx?displaylang=en
* Click on Validate Windows
* Click on Validate Now button and save the file to your desktop.
* Double click on that file you just downloaded and install it.
* Now go back to the webpage where you downloaded the file and click on the Refresh button. Then click on Continue.
* It should take a few seconds. Tell me what you see on the next page.

=======================================================================

Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

==================================================================

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:



netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
/md5start
/md5stop
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs



* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

 

[SirCarnifex]

Here's the screenshot. This is what happens when I look at the icon that is in my toolbar. I don't think I can screenshot something in the startup screen (will try in a moment).

But I can pretty much remember the message offhand:

"There have been some significant changes to your hardware settings since you last ran Windows. Windows will need to be reactivated within the next three days to confirm these."

That is not a direct quote, but one from my memory...


Will post here again in a minute and then proceed to follow the rest of the instructions.

 

[SirCarnifex]

Direct Quote (can't get the screenshot):

Since Windows was first activated on this computer, the hardware on the computer has changed significantly. Due to these changes, Windows must be reactivated within 3 days. Do you want to reactivate Windows now? (Yes/no)

 

[Broni]

That image looks legit, but to make sure, I prefer you proceed with MS page (steps listed in my previous reply).

 

[SirCarnifex]

Alright, I got a screenshot of the results of the validation. I also tried to uninstall ComboFix and it tells me that it cannot find ComboFix. I double checked to make sure the space is in there. Also, I noticed that Broni.exe is now missing from my desktop.

 

[Broni]

I also tried to uninstall ComboFix and it tells me that it cannot find ComboFix. I double checked to make sure the space is in there. Also, I noticed that Broni.exe is now missing from my desktop.

That's fine. We'll remove leftovers later.

It looks like you'll have to reactivate Windows.
I suspect, the infection made some system file(s) change(s), which was fixed by our tools, but apparently, validation issue can't be fixed.
I recently had another case like that.
At any time, you can proceed with steps at MS site to reactivate.

Meanwhile, post OTL log.

 

[SirCarnifex]

They're too long to post here, so I attached them.

Note: Windows reactivated - no problems.

 

[Broni]

Windows reactivated

Cool

==================================================================

Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.

=======================================================================

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
  [2010/08/01 14:58:59 | 000,000,000 | ---D | C] -- C:\broni2821b
  [2010/08/01 11:19:39 | 000,000,000 | ---D | C] -- C:\broni
  [2010/08/01 00:19:29 | 000,000,000 | ---D | C] -- C:\Qoobox
  
  
  :Services
  
  :Reg
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
  "DisableMonitoring" =-
  
  :Files
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

 

[SirCarnifex]

Here's the first log:

All processes killed
========== OTL ==========
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
C:\broni2821b folder moved successfully.
C:\broni folder moved successfully.
C:\Qoobox\Quarantine\Registry_backups folder moved successfully.
C:\Qoobox\Quarantine\C\WINDOWS\Tasks folder moved successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers folder moved successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32 folder moved successfully.
C:\Qoobox\Quarantine\C\WINDOWS folder moved successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\Christopher Aune\Application Data\Microsoft\Internet Explorer\Quick Launch folder moved successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\Christopher Aune\Application Data\Microsoft\Internet Explorer folder moved successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\Christopher Aune\Application Data\Microsoft folder moved successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\Christopher Aune\Application Data\AABC51974B7D388983F0677E6D063914 folder moved successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\Christopher Aune\Application Data folder moved successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\Christopher Aune folder moved successfully.
C:\Qoobox\Quarantine\C\Documents and Settings folder moved successfully.
C:\Qoobox\Quarantine\C folder moved successfully.
C:\Qoobox\Quarantine folder moved successfully.
C:\Qoobox\BackEnv folder moved successfully.
C:\Qoobox\32788R22FWJFW folder moved successfully.
C:\Qoobox folder moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\\DisableMonitoring deleted successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Christopher Aune
->Temp folder emptied: 9841731 bytes
->Temporary Internet Files folder emptied: 1508089 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 40830836 bytes
->Flash cache emptied: 560 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1024 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 50.00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Christopher Aune
->Flash cache emptied: 0 bytes

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.9.1 log created on 08012010_171143

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

 

[SirCarnifex]

And the OTL log after the Quick Scan.

Note: Java updated successfully and old versions removed successfully. Forgot to mention that before.

Another Note: I still get the "Page cannot be displayed" quite often when clicking the links that you provide. They seem to work when opened in a new window, however.

 

[Broni]

Good

I still get the "Page cannot be displayed" quite often

What browser?

Last scans.....

1. Download Security Check from HERE, and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

2. Download Temp File Cleaner (TFC)

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

3. Go to Kaspersky website and perform an online antivirus scan.

• Disable your active antivirus program.
• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  
  • Spyware, Adware, Dialers, and other potentially dangerous programs
  • Archives
  • Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

 

[SirCarnifex]

Firefox is the browser. It's the only one I use.

Also, you already had me download TFC before. Is this something that I should redownload or is my current version okay?

 

[SirCarnifex]

The Security Check log:

The Java seems strange as I just updated that! Also, IE is out of date precisely because I never use it for browsing and don't intend on using it. The few times that I do are for offline purposes (testing for website compatibility, etc.).

Results of screen317's Security Check version 0.99.4
Windows XP Service Pack 3
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
McAfee SecurityCenter
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java(TM) 6 Update 21
Out of date Java installed!
Adobe Flash Player 10.0.22.87
Adobe Reader 6.0
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.8)
````````````````````````````````
Process Check:
objlist.exe by Laurent
McAfee VIRUSS~1 mcods.exe
McAfee VIRUSS~1 mcshield.exe
McAfee VIRUSS~1 mcsysmon.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

 

[Broni]

You surely can use your TFC, since you have it.

As for Firefox, issues like that are usually caused by some add-on(s).
Close Firefox. Go Start>All Programs>Mozilla Firefox, click on Mozilla Firefox (safe mode). Surf in that setting for couple of hours and see how it goes.

IE should be kept up to date, no matter, if you use it, or not. At least IE7 will do.

As for Java, your current version is fine, but you may have some old versions installed. Did you run JavaRa (my post #35)?

 

[SirCarnifex]

Yes, I ran JavaRa and it said that it removed the older versions. It had a log but I can't seem to find where it saved (or if it saved!) and since I wasn't asked to post it, I closed it out.

Mozilla Firefox has the Ad-blocker Plus add-on.

I'll go ahead and run those two other programs now.

 

[Broni]

Yes, I ran JavaRa and it said that it removed the older versions. It had a log but I can't seem to find where it saved (or if it saved!) and since I wasn't asked to post it, I closed it out.

Don't worry about it then.

 

[SirCarnifex]

The Kaspersky report.

I got some freezing/stalling with Firefox Safemode (though it worked fine until I tried uploading the Kaspersky report). I posted this on normal mode.

 

[Broni]

OTL Clean-Up
Clean up with OTL:

* Double-click OTL.exe to start the program.
* Close all other programs apart from OTL as this step will require a reboot
* On the OTL main screen, press the CLEANUP button
* Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

====================================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista and 7:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

 

[SirCarnifex]

I ran OTL and it almost immediately asked for a reboot. I'm assuming that the last bit was supposed to take care of the 5 infected files reported by Kaspersky? Also, OTL seems to have cleaned up a lot of the programs that were on my desktop. I assume that's intended.

I still have gmer, Malwarebytes (still unupdated) and TFC on my computer. Should I keep them around?

Anyway, the system is on a fresh restore point now. Windows is fully updated supposedly. That's it? I'll let you know how things are running then. Hopefully Firefox doesn't stall like it was before cleanup and hopefully the redirect virus is gone. I'll soon find out.

Thanks very much for all you help with this.

 

[Broni]

I'm assuming that the last bit was supposed to take care of the 5 infected files reported by Kaspersky? Also, OTL seems to have cleaned up a lot of the programs that were on my desktop.

Yes and yes.

I still have gmer, Malwarebytes (still unupdated) and TFC on my computer. Should I keep them around?

You can delete GMER.
I want you to check, if MBAM will update now. I suggest, you keep it and you run it once in a while. This is the best antimalware tool, you can get.
Same applies to TFC. Run it weekly.

Let me know in a day, or two
Good luck

 

[SirCarnifex]

Right before I read your post I checked the site and found that I can access it now whereas it always came up as "unable to connect to server" beforehand. The update worked just fine as well.

Should I get rid of SecurityCheck? Also, getting rid of gmer caused a 30 second freeze on the computer, but it seems to be running fine now.

Final question (I hope!). All I ever hear of McAfee from anyone I speak to is that it's worthless, out of date, succumbs to malware/viruses, doesn't do a good job scanning and blocks legitimate programs. I have it because it came with my internet but I'm not exactly satisfied with it. Would moving to Avira be much better?

Thanks!

 

[Broni]

Should I get rid of SecurityCheck?

Yes.

If you got McAfee for free, I'd definitely get rid of it.
I don't like it at all.
Two reasons: low detection rate and a lot of false positives.
You'll do much better with either Avira, or Avast.
If you want to do it, make sure, you use McAfee Consumer Product Removal Tool: http://www.softpedia.com/get/Tweak/Uninstallers/McAfee-Consumer-Product-Removal-Tool.shtml

 

[SirCarnifex]

Thanks for the info.

I'll report back in a couple days with how the computer it running. If you hear from me any earlier than that it will probably be because it isn't. I hope that's not the case!