#1
Member
Profile: Join Date: Apr 2009
Posts: 9
Computer Experience:
[Resolved] First google redirects, now page load error
Hi, I've been having this problem for a while now. I couldn't access microsoft.com and have been redirected to another site. I've done HJT to solve the problem but now, instead of being redirected to that site, I get another site. And also, if I try to access anti-virus sites, all I get is a page load error. I've looked into the other threads to help me solve this problem but I'm not sure if following instructions for others would do me good. I tried running goored fix and combo fix though. >.< I hope that won't mess with my system. HJT Report ===============http://www.yahoo.com http://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://www.yahoo.com http://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZK http://favorites.live.com/quickadd.aspx js : browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - chrome://fastdial/content/fastdial.htmljs : keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZK&fl=0&ptb=zoHy9EBFIgl_3GyHSWSnbw&st=kwd&o=kwd&url=http ://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&searchfor=SP1 )SP1 (KB953595)SP1 SP2 (KB936181)PCI -E NIC DriverTCP "= 55928:TCP :PlayerJava ModemWebTCP "= 52605:TCP :PlayerJava DebugWebhttp://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZK http://favorites.live.com/quickadd.aspx js : browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - chrome://fastdial/content/fastdial.htmljs : keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZK&fl=0&ptb=zoHy9EBFIgl_3GyHSWSnbw&st=kwd&o=kwd&url=http ://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&searchfor=http://www.gmer.net SP2 -Pro-BootDisk-ENU.exe
Didn't find the information you thought to find?Similar Threads
#2
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
Hi and welcome, sorry for the delay.Flash_Disinfector by sUBs and save it to your desktop:>here< desktop Plug in your USB flash drive.
Double-click Flash_Disinfector.exe to run it.
Follow any prompts that may appear.
Your desktop will vanish for a while, and then reappear. This is normal.
Wait until the program has finished scanning, then please exit the program. If you use more than 1 flash drive, run the tool with each plugged in.
Combofix from any of the links below. . desktop .Link 1 Link 2 Link 3 Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working. This includes Antivirus, Firewall, and any Spyware scanners that run in the background. Here Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below: "CFScript.txt" including quotes and change the "Save as type " to "All Files " and place it on your desktop .
Code:
RegLockDel::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tapiprov]
File::
c:\windows\~GLH0001.TMP
c:\windows\~GLC0001.TMP
c:\windows\system32\Odbcjtnw.hlp
c:\windows\~GLH0000.TMP
c:\windows\~GLC0000.TMP
J:\g068vy6.cmd
K:\6l6.com
K:\peyfrf2.cmd
J:\autorun.exe
K:\br8ym2l.bat
K:\ls0f92.bat
P:\autorun.exe
J:\o3w2.com
K:\pmut.bat
c:\windows\system32\cqtjh.dll
c:\documents and settings\Jerrine\Application Data\CasinoOnNet
c:\program files\CasinoOnNet
Firefox::
FF - prefs.js : keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZK&fl=0&ptb=zoHy9EBFIgl_3GyHSWSnbw&st=kwd&o=kwd&url=http ://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&searchfor=
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb5f5666-07c9-11de-bc75-000c76ab60bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8541a43-9eec-11dd-bb10-001bfc7af398}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbd678d3-0506-11de-bc66-000c76ab60bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbd678d2-0506-11de-bc66-000c76ab60bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa1d18c7-99c4-11dd-bae8-001bfc7af398}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ffe6fb1-b048-11dd-bb3e-001bfc7af398}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{6f762209-a60d-11dd-bb27-001bfc7af398}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0d451e09-ffb4-11dd-bc4e-000c76ab60bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\P]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0010daee-0744-11de-bc70-000c76ab60bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05f13c08-f245-11dd-bc12-000c76ab60bf}]
NetSvc::
Tapiprov
DDS::
BHO: 1 (0x1) - No File
BHO: IEHlprObj Class: {f171a450-7af5-43e1-afed-edc826a1b0f5} - c:\windows\system32\bgotrtu0.dll
TB: {CD292324-974F-4224-D074-CACA427AA030} - No File
http://img.photobucket.com/albums/v6...FScriptB-4.gif
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you, C:\ComboFix.txt . Post that log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Last edited by Juliet; 5th May 2009 at 21:39 .
Reason: added info
#3
Member
Profile: Join Date: Apr 2009
Posts: 9
Computer Experience:
Thank you for your reply. Here are my logs for combofix and DDS.TCP "= 10216:TCP :PlayerJava MakerReferenceTCP "= 55928:TCP :PlayerJava ModemWebhttp://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZK http://favorites.live.com/quickadd.aspx js : browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - chrome://fastdial/content/fastdial.htmljs : keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZK&fl=0&ptb=zoHy9EBFIgl_3GyHSWSnbw&st=kwd&o=kwd&url=http ://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&searchfor=http://www.gmer.net HJT Report ===============http://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZK http://favorites.live.com/quickadd.aspx js : browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - chrome://fastdial/content/fastdial.htmljs : keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZK&fl=0&ptb=zoHy9EBFIgl_3GyHSWSnbw&st=kwd&o=kwd&url=http ://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&searchfor=
#4
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
Welcome backAVG Anti-Virus Free *On-access scanning disabled* (Outdated)ESET NOD32 antivirus system 2.70 *On-access scanning disabled* (Outdated)Please leave your flash/usb drive plugged in while completing the following. Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working. This includes Antivirus, Firewall, and any Spyware scanners that run in the background. Here Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the CODE box below: "CFScript.txt" including quotes and change the "Save as type " to "All Files " and place it on your desktop .
Code:
File::
C:\o3w2.com
M:\ku.bat
K:\ku.bat
K:\6l6.com
L:\fpnw.com
O:\ku.bat
J:\vn.cmd
Folder::
c:\program files\CasinoOnNet
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{f2b69e97-a2f9-11dd-bb23-001bfc7af398}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{49404641-371f-11de-bcf4-000c76ab60bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{49404643-371f-11de-bcf4-000c76ab60bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{6f762209-a60d-11dd-bb27-001bfc7af398}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{bafd6b96-a018-11dd-bb14-001bfc7af398}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\{c3e1168d-9b2d-11dd-baf4-001bfc7af398}]
DDS::
IE: &Search - http ://edits.mywebsearch.com/toolbar...rch.jhtml?p=ZK
FF - prefs.js : keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZK&fl=0&ptb=zoHy9EBFIgl_3GyHSWSnbw&st=kwd&o=kwd&url=http ://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&searchfor= http://img.photobucket.com/albums/v6...FScriptB-4.gif CFScript.txt into ComboFix.exe. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. C:\ComboFix.txt . Post that log in your next reply. CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine. ATF Cleaner by Atribune From Here Desktop . Follow the instructions for the browser you use. ATF-Cleaner.exe Windows Temp "Select All" . Empty Selected . When you get the "Done Cleaning" message, click OK . Firefox or Opera browsers , you can use this program Exit button in the Main menu. *Note http://www.kaspersky.com/service?chapter=161739400 Kaspersky Online Scanner http://www.kaspersky.com/virusscanner Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan. Accept button and install any components it needs. The program will install and then begin downloading the latest definition
After the files have been downloaded on the left side of the page in the Scan section select My Computer .
This will start the program and scan your system.
The scan will take a while, so be patient and let it run. (At times it may appear to stall)
Once the scan is complete, click on View scan report To obtain the report:
Save Report As Save as Save in Desktop File name Save as type Text file [*.txt] Save Kaspersky Online Scanner Report http://i275.photobucket.com/albums/j...g/KAS/KAS9.gif Note .. for Internet Explorer 7 Accept " button of the license, click on the "Zoom " tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100% . ) https://addons.mozilla.org/en-US/firefox/addon/1419 HJT log taken after the above scans have runYou may need several replies to post the requested logs, otherwise they might get cut off .
#5
Member
Profile: Join Date: Apr 2009
Posts: 9
Computer Experience:
I've just tried checking the sites right now, I can now access them (Microsoft, kasperksy, etc) . Thank you very much!
#6
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
Quote:
Originally Posted by
sakurajiru
I've just tried checking the sites right now, I can now access them (Microsoft, kasperksy, etc) . Thank you very much!
Will I still have to do your latest instructions?
I'm glad things appears to be near normal, we need to continue with that last set of instructions to completely remove what needs to go.
#7
Member
Profile: Join Date: Apr 2009
Posts: 9
Computer Experience:
Here are my logs TCP "= 10216:TCP :PlayerJava MakerReferenceTCP "= 55928:TCP :PlayerJava ModemWebhttp://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://favorites.live.com/quickadd.aspx js : browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - chrome://fastdial/content/fastdial.htmljs : keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZK&fl=0&ptb=zoHy9EBFIgl_3GyHSWSnbw&st=kwd&o=kwd&url=http ://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&searchfor=http://www.gmer.net SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://www.yahoo.com/ http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://my.magicjack.com/ http://favorites.live.com/quickadd.aspx VB .bu 1
#8
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
Thank you for returning the information.OTMoveIt3 by OldTimer Double-click OTMoveIt3.exe to run it.
Copy the lines in the codebox below. ( Make sure you include :Processes )
Code:
:Processes
explorer.exe
:Files
K:\ku.bat
K:\6l6.com
O:\ku.bat
J:\vn.cmd
M:\ku.bat
D:\installers\misc\SmileyCentralPFSetup2.3.50.40.ZNfox000.exe
D:\o3w2.com
F:\o3w2.com
G:\o3w2.com
H:\o3w2.com
I:\eGames\Galaxy_of_MahJongg_JC\TSUninstaller.exe
I:\My Games\Big City Adventure Sydney Australia\BigCityAdventureSyd.exe.bak
I:\My Games\Finders Keepers\Finders Keepers.exe
I:\My Games\Nanny Mania\NannyMania.exe
I:\My Games\Poker Superstars II\PokerSuperstars2.exe
I:\o3w2.com
L:\peyfrf2.cmd
L:\EXPLORER.EXE
L:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx
L:\o3w2.com
L:\br8ym2l.bat
L:\pmut.bat
L:\ls0f92.bat
:reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49404641-371f-11de-bcf4-000c76ab60bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49404643-371f-11de-bcf4-000c76ab60bf}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f762209-a60d-11dd-bb27-001bfc7af398}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3e1168d-9b2d-11dd-baf4-001bfc7af398}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f2b69e97-a2f9-11dd-bb23-001bfc7af398}]
:Commands
[Purity]
[EmptyTemp]
[Start Explorer]
[Reboot] Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste .
- Close ALL open windows (especially Internet Explorer!)-
Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply. Close OTMoveIt3
Yes. c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log OTMoveIt logHJT log
Last edited by Juliet; 7th May 2009 at 15:43 .
Reason: again a typo
#9
Member
Profile: Join Date: Apr 2009
Posts: 9
Computer Experience:
As soon as my computer rebooted, I couldn't use it. I kept on restarting the computer until I decided to just go on safe mode. I am using safe mode now, I'm not quite sure if I'll be able to use it normally. Here are my logsSP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://www.yahoo.com/ http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://my.magicjack.com/ http://favorites.live.com/quickadd.aspx
#10
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
This is what we're trying to get off your computer. Conficker virus.http://www.sophos.com/security/analy...utorunafq.html HijackThis Click Do a system scan only , checkmark these. Then close all other windows and browsers except HijackThis and press fix checked.Double-click OTMoveIt3.exe to run it.
Copy the lines in the codebox below. ( Make sure you include :Processes )
Code:
:Processes
explorer.exe
:Files
C:\WINDOWS\system32\kva8wr.exe
:reg
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kvasoft"=-
:Commands
[Purity]
[EmptyTemp]
[Start Explorer]
[Reboot] Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste .
- Close ALL open windows (especially Internet Explorer!)-
Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply. Close OTMoveIt3
Yes. c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log
#11
Member
Profile: Join Date: Apr 2009
Posts: 9
Computer Experience:
I can boot in normal mode now http://i695.photobucket.com/albums/v...screenshot.jpg
#12
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
The error message is related to your computers grahics card.....http://www.techsupportforum.com/micr...urred-etc.html
#13
Member
Profile: Join Date: Apr 2009
Posts: 9
Computer Experience:
It seems to hang for quite some time. I'm not sure why. The reason why I plan to reformat is not only because of the malware, but to also free some memory space in the computer.
#14
Member
Profile: Join Date: Apr 2009
Posts: 9
Computer Experience:
I think I'll go with the reformat. I suppose my computer would run faster if I did it that way. I really appreciate all your help Juliet
All times are GMT +1. The time now is 23:24 .
Will I still have to do your latest instructions? 
