Yes, ANOTHER Google redirect victim! Please help.

Viruses and worms
1

This one seems to be making the rounds, doesn’t it? Same old story: Suddenly found that Firefox is trying to redirect me from Google results to various addresses; Avast stops it most of the time, with the result that every site on my search results appears compromised, which is bollocks.

Running Firefox 3.6.18 and Windows 7 Ultimate 32-bit.

I read the posts here for a while and am here to beg for help. Ran OTS; I offer my log for analysis. Thanks for your time.

Edit: I believe I ran OTS before Malwarebytes Anti-Malware. My Malwarebytes scan of a little while ago uncovered a trojan which I promptly had the program fix; I did not make further note of it, but the redirect problem has persisted after a reboot.

2

Hi - I have had OTS zip the malware files could you upload them to Avast once we are done please

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says “Paste fix here” and then click the Run Fix button.

 
[Unregister Dlls]
[Processes - Safe List]
YN -> autoinstallejcdsvc.exe -> 
YY -> kbdaze32.exe -> C:\Windows\System32\KBDAZE32.exe
YY -> alttab32.exe -> C:\ProgramData\AltTab32.exe
[Win32 Services - Safe List]
YY -> (PeerDistSvc32) BranchCache  [Auto | Running] -> C:\Windows\System32\KBDAZE32.exe
[Registry - Safe List]
< FireFox Extensions [User Folders] > -> 
YY -> XUL Cache   -> C:\Users\Iska\AppData\Roaming\mozilla\Firefox\Profiles\iadhecjg.default\extensions\{b446686b-0c86-4abb-b4b3-18a4ebbb8c30}
< FireFox Extensions [Program Folders] > -> 
YY -> 走るフォクすけ -> C:\USERS\ISKA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\IADHECJG.DEFAULT\EXTENSIONS\RUNFOXKEH@NORAHMODEL.EXBLOG.JP
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-4101301263-791040741-1378103366-1000\] > -> HKEY_USERS\S-1-5-21-4101301263-791040741-1378103366-1000\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{9D425283-D487-4337-BAB6-AB8354A81457}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
[Files/Folders - Created Within 30 Days]
NY ->  AltTab32.exe -> C:\ProgramData\AltTab32.exe
NY ->  KBDAZE32.exe -> C:\Windows\System32\KBDAZE32.exe
NY ->  AltTab32.dll -> C:\Windows\System32\AltTab32.dll
[Files/Folders - Modified Within 30 Days]
NY ->  1787000635 -> C:\Windows\System32\1787000635
NY ->  AltTab32.dll -> C:\Windows\System32\AltTab32.dll
NY ->  KBDAZE32.exe -> C:\Windows\System32\KBDAZE32.exe
NY ->  AltTab32.exe -> C:\ProgramData\AltTab32.exe
[Files - No Company Name]
NY ->  1787000635 -> C:\Windows\System32\1787000635
[Custom Items]
:Files
ipconfig /flushdns /c
:end
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]
[ZipFiles]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here

I will review the information when it comes back in.

Depending on what the fix contains, this process may take some time and your desktop icons might disappear or other uncommon behavior may occur.

This is no sign of malfunction, do not panic!

3

Thank you for seeing to my post so quickly. Please forgive my profound noobishness; I do not understand what you mean by asking me to upload the zipped malware files, as I do not know where they are located. I had to go AFK while the fix was running. When I returned, it had completed and popped the message saying I needed to reboot, but the program had frozen. Upon reloading my desktop, the OTS log appeared. I am attaching it now.

4

OK I will explain how to upload them when we are finished ;D

A few checks now to see if we got it

Download aswMBR.exe ( 1.8mb ) to your desktop.

Double click the aswMBR.exe to run it

Click the “Scan” button to start scan

http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR2-1.gif

On completion of the scan click save log, save it to your desktop and post in your next reply

http://public.avast.com/~gmerek/aswMBR2.png

THEN

http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Please download Malwarebytes’ Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

[*]Make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
[*]If an update is found, it will download and install the latest version.
[*]Once the program has loaded, select “Perform Quick Scan”, then click Scan.
[*]The scan may take some time to finish,so please be patient.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Make sure that everything is checked, and click Remove Selected.
[]When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
[]The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
[*]Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

5

Haha, thanks again! I have these programs, so I’m letting them do their thing. This will take quite some time, if my earlier MWBAM scan of an hour was any indication. I’ll post the results ASAP.

6

Whilst we are waiting - do you still have the redirects ?

7

Do you mean the addresses to which it was trying to redirect me on Google? All I have is this:

64.111.211.158

8

Please post the aswMBR log so we can see the generation of the TDL you are infected.

Btw,are you from greece?Amalia is a greek name ;D

9

At the time of my last post, aswMBR was still in the early stages of its scan, so I could not upload anything yet.

Amalia seems to originally be an old Germanic name, though it is also used as a Hebrew name (and also Greek, apparently :D). It is not mine, though; I am an American involved in the Society for Creative Anachronism. Members of this group are encouraged to create for themselves a named persona representing a person who might have lived in the Middle Ages. :smiley: I just decided to try it as my username.

I have attached the aswMBR log, as it’s finally finished. Starting MWBAM!

10

It’s clean.Any other problems?

11

Thank you! Seems fine thus far; I was able to go to the first page of Google search results on “how to make a drinking horn”, while before, I couldn’t click most of those links without being redirected. Still running MWBAM.

12

Thanks goes to Essexboy,not me ;)!
Post the mbam log when the scan is finished.

13

Well, I was actually just politely thanking you for asking. Malwarebytes says nothing is infected, though.

14

Hmmm good ;D.
Read more about TDSS variants here:
http://www.securelist.com/en/analysis/204792131
and about TDL-4 here:
http://www.securelist.com/en/analysis/204792180/TDL4_Top_Bot

15

Yep, everything seems to be running smoothly as before the infection. Thanks ever so much for your time, essex; you do great work.

Cool. Will look at those right now.

16

I’m not so sure it looks clean, this I believe needs further investigation:

13:43:28.781 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll [b]>>UNKNOWN [0x8557f1f8]< \Device\Harddisk0\DR0[0x863eb390]

Could be that there is a TDL rootkit

17

Yeah, I am waiting for essexboy to opine. Thanks.

18

According to GMER’S post ? “Please post links to the topics or mbr.dat files to similar”

10:15:19.273 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xfffffa8004a73254]<<

Amalia said she is free of problems,so i guess/hope it’s gone.

Amalia could also upload her MBR.dat to www.virustotal.com,so we can determine whether it’s infected or not.

19

Probably it may be usefull to make check by TDSSKiller. The fresh version of it can deal with some occurences of new SST rootkit.

20

I don’t think this is what he might be after as they are looking for the new variant and the aswMBR is reporting the default windows MBR, so it can’t be that, it would at least be reporting Unknown MBR code…

Or it could be well hidden or a failed installation of the malware (also happens).

Whilst it won’t hurt, I would be very surprised if much came out if this isn’t something I would expect many standard AV scans to be looking for much less pick up.