Google Redirect

Viruses and worms
1

I am having a search bar redirect problem similar to this:

http://forum.avast.com/index.php?topic=81308.msg664582#msg664582

-Redirecting to scour.com like this user was.

-Avast found nothing

-Malwarebytes found nothing

-ran TDSS Killer once, found nothing (and have since removed the program)

-Backed up reg with ERUNT

-Also ran OTL and aswMBR as per “logs to assist cleaning malware” :
http://forum.avast.com/index.php?topic=53253.0

Any help would be GREATLY appreciated…Looks like the genius that goes by ESSEXBOY was able to rout out the problem successfully before by pasting text, but specifically stated, “Warning This fix is only relevant for this system and no other, using on another computer may cause problems.” and I will strictly obey that level of computer prowess in fixing this.

Like the previous poster so aptly put, “Mainly, I am just sort of worn down from fighting this dumb thing.”

Thanks again in advance, and I will post logs (let me know if I missed something…hope I went about this right…should I post the MBR.dat file?).

2

Hi,

Don’t worry about the MBR.dat file…but don’t delete it either.

Let me look over the logs and I will return shortly. :slight_smile:

3

Thanks for the post and the quick reply! Take your time…I appreciate the help!

4

Hi,

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click VirusTotal

Press Choose File and then browse to the following file: (one at a time if more than one file is listed)

C:\Users\Filip\AppData\Local\Temp\Microsoft Help\xstlvmxf.dll

Once you locate the file select it and press Open now press Scan it!.

Now Copy/Paste the link to the results showing in the web browser bar to your next reply so that I can take a look at the results.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.

5

here you go.

https://www.virustotal.com/file/a9080aa18f213e7b67ee3648963eebf4a2af4586045b43ef0cca03828f0eeca2/analysis/

6

I know that you already ran TDSSKiller but please do the following…

Please download TDSSKiller.zip

[*]Extract it to your desktop
[*]Double click TDSSKiller.exe
[*]when the window opens, click on Change Parameters
[*]under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
[*]click OK
[*]Press Start Scan

[*]Only if Malicious objects are found then ensure Cure is selected
[*]Then click Continue > Reboot now

[*]Attach the log in your next reply

[*]A copy of the log will be saved automatically to the root of the drive (typically C:)

7

Posting TDSS Killer log.

8

Hi,

I see that you have ERUNT already. Please run that and make a backup and then do the following…

Run OTL.exe

[*]Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL


:Services

:OTL
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2A DB 11 B7 1A 18 CD 01  [binary data]
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1370244251-421495555-1663435379-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[start explorer]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot when it is done
[*]Then run a new scan and post a new OTL log ( don’t check the boxes beside LOP Check or Purity this time )

9

New OTL log

10

Funny, I think that did it searches uninturrupted now…

11

Thank you!! You are super Awesome. Everything seems to work great now. I truly appreciate all the help…Can’t thank you enough!

12

Glad that it is working better. Stick with me though. :slight_smile:

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.

Please run a free online scan with the ESET Online Scanner
[i]Note: You will need to use Internet Explorer for this scan[/i]
[*]Tick the box next to YES, I accept the Terms of Use
[*]Click Start
[*]When asked, allow the ActiveX control to install
[*]Click Start
[*]Make sure that the options Remove found threats is NOT selected and the option Scan unwanted applications is selected.
[*]Click Scan (This scan can take several hours, so please be patient)
[*]Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner[b]log.txt
[*]Copy and paste that log as a reply to this topic

Attach the logs that are made by Malwarebytes and ESET. :slight_smile:

13

I’m still with you. Eset got a hit

C:_OTL\MovedFiles\06022012_173328\C_Users\Filip\AppData\Local\Temp\Microsoft Help\xstlvmxf.dll a variant of Win32/Kryptik.AGFG trojan

moved it to notepad

Eset log doesn’t look like there is anything in it…did I do something wrong there?

Anyway here are the logs

14

Hi,

The file that ESET picked up is already quarantined by OTL so that is not a problem.

How is your system running now?

15

I haven’t had one redirect or popup redirect. It seems to be running flawlessly. On startup I get a notification of that file (Microsoft Help\xstlvmxf.dll)
being “undetected” or “missing”. But closing a window on startup is a small price to pay for being able to run an internet search again.

Again, many thanks!

16

Hi,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

[*]Double-click SystemLook.exe to run it.
[*]Copy the content of the following codebox into the main textfield:


:filefind
*xstlvmxf.dll

[*]Click the Look button to start the scan.
[*]When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

17

Here’s the log

18

Let’s see if we can get file fixed up.

Do you have your Windows disk available if we need it? :slight_smile:

19

I believe so.

20

Get it out as we may need this during the following steps:

[*]Click on Start, type cmd in the Start Search bar.
[*]Right click on Command Prompt at the top of the window and select Run as Administrator.
[*]In the Command Prompt Window, type (or copy and paste) sfc /scannow and press Enter.

The scan may take some time, so be patient. Windows will repair any corrupted or missing files that it finds. If information from the installation CD is needed to repair the problem, you may be prompted to insert your Windows 7 CD.

Reboot your system when done and see if that notification pops up again. :slight_smile: