I've read what I can on getting rid of the google redirect virus, but haven't been able to do so myself.
I installed Kaspersky Anti-virus this morning after my McAfee detected, but ignored, a trojan. I have uninstalled McAfee.
I managed to get HostsXpert, but it didn't work. I also have CCleaner, though it didn't appear to help either. Anything by Google gets redirected. I got Opera and it works until I use Google or don't have the webpage address in hand for the speed dial function.
I cannot restart in Safe mode with networking- every time I try, the screen stops loading and gives me a quick flash of the blue error screen, which I can't read, and proceeds to reboot again under the normal mode unless I tap F8 again. I get the same result each time.
I did full scans with Kasperky but it hasn't identified anything more than the 800+ suspicious programs and 64 trojans that were in my PC. I believe it's blocked, disinfected or deleted what it can. There appear to be some that it only detected but I can't manually deal with them- the quarantine function isn't working. The scans have ranged between 1.5hrs to 5 hrs each...which I found strange because they all had the same parameters. Also, I can't update when it tells me to. I figure that's b/c of the redirect virus. Now and then a request to accept a Kaspersky root certificate pops up, but I don't know if I can trust it so I don't install it.
Okay. I finally got a hold of a website the virus didn't recognise from one of the other posts (thank you, Touch!). It's the Cnet download.com one. I ran Malwarebytes twice- the first time, the reboot went wonky (blue error screen before blacking out) and after restarting it, I tried to get the log. The notepad kept coming up with errors and wouldn't display the file. Also, Kaspersky finally started updating, though very slowly.
The 1st log:
Malwarebytes' Anti-Malware 1.28 Database version: 1225 Windows 5.1.2600 Service Pack 2
Memory Processes Infected: (No malicious items detected)
Memory Modules Infected: (No malicious items detected)
Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected: (No malicious items detected)
Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully.
Folders Infected: (No malicious items detected)
Files Infected: C:\System Volume Information\_restore{B6387AD4-48E1-4511-AA40-A245D4C401AE}\RP573\A0107683.sys (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\drivers\ (Trojan.Agent) -> Delete on reboot. --------------------------
The 2nd reboot froze on the shutting down screen for several minutes. I manually shut it down. When it started again, Kaspersky had to be updated again- though it installed components beforehand. It's not connecting again. The trojans were quarantined in Malwarebytes and I then deleted them, but something is still around.
I'm going to try and run the Hijackthis program to see if it can help- after the Malwarebytes again b/c the notepad had errors again...
Important-> Temporarily disable your anti-virus, real-time protection before performing a scan. They can interfere with combofix or remove some of its embedded files which may cause "unpredictable results".
Go to Start->Run and copy/paste: ComboFix /snapshot and hit OK. It should run Combofix.
Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.
When finished, it will produce a logfile located at C:\combofix.txt.
ComboFix 08-09-30.03 - Vashea 2008-10-01 11:40:13.1 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.638 [GMT 1:00] Running from: C:\Documents and Settings\Vashea\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe * Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! .
((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) .
Currently it is Thursday, November 20, 2008 5:25 PM (GMT +1) There are a total of 63.934 posts in 15.821 threads. In the last 3 days there were 33 new threads and 157 reply posts. View Active Threads
Who's Online
This forum has 27177 registered members. Please welcome our newest member, fillon. 51 Guest(s), 1 Registered Member(s) are currently online. Details Behram
Seems alright? Muxas gracias!
|