2

This machine was infected with various malware. I have scanned the system with Malwarebytes. It found and removed some 600 or so infected files.

Now the machine seems to be running well with only one exception.

Some Google search results are being redirected to some shady search engines.

If I were to copy the URL from the Google Search results and paste it in the address bar it would go to the correct site, but if I click the link, I will be redirected somewhere else.

Here is my log file from HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:55:16 AM, on 7/14/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T3418
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O2 - BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINDOWS\system32\oobe\msoobe.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm172YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {6E704581-CCAE-46D2-9C64-20D724B3624E} (UnagiAx Class) - http://radaol-prod-web-rr.streamops.aol.com/mediaplugin/3.0.84.2/win32/unagi3.0.84.2.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.cab
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
Improve this question
2
  • This is probably just your proxy settings in IE they will stay there even after removing the virus.
    – Supercereal
    Jan 17, 2011 at 20:46
  • I had this for a long time, and I finally fixed it. It's not a virus, it has to do with DNS servers. You just have to start using a public DNS like OpenDNS or Google DNS.
    – ixtmixilix
    Jan 31, 2011 at 12:59

4 Answers 4

Reset to default
4

Disable these under safe mode:

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINDOWS\system32\oobe\msoobe.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm172YYUS
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.cab

And use CWShredder as you might be infected with CoolWebSearch.

Reboot and post a new HijackThis log in your post, also do this so I can do a more detailed view:

  1. Download AutoRuns, run it and accept the EULA, let it scan.
  2. When the scanning is done, go to File and then Save it as a .arn file.
  3. Upload this file to a file hosting website like RapidShare/MegaUpload/...

For virus scanning purposes, check Mouche's post... I'm more the 'manual cleaning' type.
I hate resource consuming virus scanners that take their time... :-D

Regarding CT his comment...

In Safe Mode, run Autoruns as an administrator and untick the following items,
Look in the first column for the name before the ; symbol and in the last column for the path after the ;:

0; File not found: About:Home
SimpleShlExt; File not found: C:\PROGRA~1\DEFENS~1\defext.dll
Defense Center extension; File not found: C:\PROGRA~1\DEFENS~1\defext.dll
bbbbbe90-4903-4a9b-bd83-dcb5abdbbe75; File not found: E:\CDS300\cds300.dll

Please note that Defense Center is a fake rogue antivirus which should be removed!

When you have removed these four entries, reboot and tell me if you still have the problem.
It is wise to update and scan with your virus scanner to remove any files left.

Improve this answer
4
1

There is no other explanation : Your machine is still infected.

It is unlikely after such a massive infection as you describe, that any AV product will completely clean up everything. There is no other safe solution than to restart from a clean slate.

My advice is to save your data, reformat the hard disk, and reinstall Windows (or restore the computer to factory image, as the case may be).

Improve this answer
6
  • Massive infections can be cured just by removing all possible ways to start the malware and then removing any infected files during Safe Mode, if you want to take it to the next level you still have AutoRuns for checking the low-level stuff and other performance analysis tools like XPerf, XBootMgr, Process Monitor, ... Reinstalling your Windows is a solution that tends to werk, but it's not a solution to spend a lot of time reinstalling everything every time you are infected.
    – Tamara Wijsman
    Jul 14, 2010 at 16:34
  • @TomWij: Getting infected shouldn't happen very frequently ... And to succeed he would need such a high level of knowledge that excludes him asking his question in the first place.
    – harrymc
    Jul 14, 2010 at 16:43
  • @TomWij: You have the knowledge to answer questions in superuser.com and to avoid infection. Not everybody does.
    – harrymc
    Jul 14, 2010 at 16:49
  • Yes, indeed, but for some people it does and for those people it isn't helpful to keep reinstalling their system, he has 600 infections so he tends to be such guy... Reinstalling is always an easy fix, but you better learn to prevent viruses and how to get rid of them.
    – Tamara Wijsman
    Jul 14, 2010 at 16:55
  • I took "Getting infected shouldn't happen very frequently" a bit personal but it wasn't about me, that's why I typed the first part of my answer after the second, adjusted my answer to the right context of your response to avoid confusion...
    – Tamara Wijsman
    Jul 14, 2010 at 16:55
1

I agree that it would be best to do a clean install after a backup, but you have some options.

First, reboot into safe mode with networking.

Next, run ESET Online Scanner, an excellent, free scanner that is a scan/remove-only version of ESET NOD32. I've had great success with this product. This will scan for viruses along with other malware in its definitions.

Next, run Spybot Search & Destroy to clean up remaining spyware and malware.

Finally, reboot into normal mode and look through Add/Remove Programs to get rid of anything that looks suspect. Typically, they will have already been removed, and you're just getting them out of the list ("Adhelper" for example).

I've had great success with this method. I usually do some clean up using Disk Cleanup or CCleaner afterwards. I've never had anything escape me through this process, but I don't deal with viruses or malware very frequently.

Improve this answer
-1

It's really simple to cure this. Just start using Google Public DNS. Change your primary DNS to 8.8.8.8 and secondary DNS to 8.8.4.4 ...

Improve this answer
3
  • -1 Using different DNS servers will not fix an infection.
    – goblinbox
    Jan 17, 2011 at 21:01
  • @goblinbox I had this for a long time, and it's not the result of malware.
    – ixtmixilix
    Jan 31, 2011 at 12:58
  • 1
    Understood, but the original question states specifically that there had been an infection. (Many believe that changing DNS servers has some kind of magic result, but such people typically don't know what DNS is or how it works: DNS means domain name service, and it resolves names to numbers. Period. Changing DNS servers does not heal infections, and one's local DNS servers will practically always be faster and have more relevant information than remote DNS servers. Finally, correlation does not imply causation.)
    – goblinbox
    Feb 7, 2011 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .