Inactive Search redirect/computer running very inefficiently please help!

[rupal12213]

Upon browsing these forums, I have noticed that alot of people are having problems similar to mine. Since I have read that there is no uniform mehod to fix this issue, I need your help .

Attached are the files from the preliminary 8-step procedure.

please and thanks.

Regards,
Rupal

 

[Broni]

Download the MBR Rootkit Detector: http://www2.gmer.net/mbr/mbr.exe to your desktop.

* Doubleclick mbr.exe and follow prompts (Vista users: right click on mbr.exe and click "Run As Administrator").
* A black DOS window will quickly appear then disappear.
* When mbr.exe is finished it will create a log on your desktop.
* Copy and paste contents of that log (mbr.log) file to your next reply.

 

[rupal12213]

here is the contents of the requested log file.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

 

[Broni]

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[rupal12213]

Here is combofix.txt

 

[Broni]

Download and save HelpAsst_mebroot_fix.exe to your desktop.

• Close all open programs.
• Double click HelpAsst_mebroot_fix.exe to run it.
• Pay attention to the running tool.
• If the tool detects mbr infection, please allow it to run mbr -f and shutdown your computer. To do so, type Y and press Enter.
• After restart, wait 5 minutes, then go Start>Run, copy and paste the following command in the run box then hit Enter:
  • 
    helpasst -mbrt
• When it completes, a log will open.
• Please post the contents of that log.

IMPORTANT!
If the tool does NOT detect any mbr infection and completes, proceed with the following...

• Click Start>Run and copy and paste the following command, then hit Enter:
  • 
    mbr -f
• Repeat the above step one more time
• Now shut down the computer (do not restart, but shut it down), wait 5 minutes then start it back up.
• Wait another 5 minutes, then click Start>Run and copy and paste the following command, then hit Enter.
  • 
    helpasst -mbrt
    
• When it completes, a log will open.
• Please post the contents of that log.

**Important note to Dell users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended).

 

[rupal12213]

Mbr infection was not detected.

attatched is the log file from the second procedure.

Thanks again!!

 

[Broni]

Very well...

Delete your GMER file, download fresh one, run it and post new log.

 

[rupal12213]

Computer crashed twice while trying to obtain new gmer log

displayed a blue screen with an error called "irql_not_less_or_equal"

attatched is the new gmer log file.

 

[Broni]

Delete your Combofix file, download fresh one, run it and post fresh log.

 

[rupal12213]

While running combofix, rootkit activity was detected and I was prompted to reboot. After the reboot, my computer has not started up completely and is stuck on a black screen with just the cursor showing. What should I do now?

 

[Broni]

Did you try to restart it manually?

 

[rupal12213]

No. Combofix restarted it. Should I manually restart it now?

 

[Broni]

Please, do.

 

[rupal12213]

Attatched is the new combofix log.

 

[Broni]

Delete your copy of HelpAsst_mebroot_fix.exe.
Download fresh file.
Physically disconnect from the internet (disconnect ethernet cable).

Re-run same procedure as in my reply #6

 

[rupal12213]

Re-ran the process while physically disconnected from the internet with the same results.

here is the log.

 

[Broni]

Delete your Combofix file, download fresh one, run it and post fresh log.

 

[rupal12213]

New combofix log attatched.

 

[Broni]

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

"%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v

If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
When it is done, a log file should be created on your C: drive called TDSSKiller.txt please copy and paste the contents of that file here.

 

[rupal12213]

When it ran, it did not notify me of a hidden service detected. here is the log file.

 

[Broni]

This is really ugly rootkit, we're dealing here with.
How is redirection issue at this moment?

Please, delete your GMER file, download fresh one and post new log.

 

[rupal12213]

Indeed it is! last night, the computer seemed to be clean. it was running normally, and the redirection issue had stopped. after about an hour of smooth running, everything returned .

also, there is a phising component to this virus, as it asked my father to change his bank of america password to a suggested one. and when you try to log onto AOL it says put in your bank info for security.

anyway, here is the new gmer log.

 

[Broni]

Yeah, the rootkit is still present.

Let's see, if we can look at your computer booting from an external source.

Please download OTLPE (filesize 120,9 MB)

• When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
• Reboot your system using the boot CD you just created.
  • Note : If you do not know how to set your computer to boot from CD follow the steps here
• Your system should now display a REATOGO-X-PE desktop.
• Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
• Double-click on the OTLPE icon.
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system
• Please post the contents of the OTL.txt file in your reply.

 

[rupal12213]

I'm unable to boot from the onboard cd drive i have. I ran the OTLPENet.exe program and it worked just fine, but when i set my bios to boot from the cd drive, it says device is unbootable.

also, im considering backing up important files to an external drive or online virtual drive and performing a clean install. would you suggest that?