Browser Redirection

[quackers]

Hi all,

need a bit of help, i've got a pc that is getting redirected when using a search engine like google. I'll open google, type something ie bbc.co.uk, then when you click on the bbc link it opens up another browser window with some random websites in it!

I cant for the life of me find this little bugger, i'm starting to run out of ideas!

So far, i've tried:

Nothing in the host file
all cookies/temp files emptied
AVG8 - full scans found nothing
Spywareblaster - all updated
Spybot search and destroy - found a couple of bits, removed
I'm running superantispyware at the moment
nothing running at startup with msconfig

I've ran hihack this, as it's found things like this in the past but i cant see anything in the log:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Gemplus\GemSafe Libraries\BIN\GCardSrvNT.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.co.uk/hws/sb/dell-inc-rel/en/side.html?channel=uk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/ig/dell?hl=en&client=dell-inc-rel&channel=uk
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: GemSAFE Card Server - Gemplus - C:\Program Files\Gemplus\GemSafe Libraries\BIN\GCardSrvNT.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

I was planning on running one of the online virus scans next, to see if that picks anything up and installing adaware as well.

Has anyone got any other ideas i can try?

 

[Liquidfox]

I've been using Super AntiSpyware Free recently, awesome piece of software.

Typically a name you'd associate with rogue software, along with the website too, but i can assure you it's all legit.

 

[GarethDW]

Seeing as though you've already got it installed, try pasting your Hijack This log into the following website and seeing if it comes back with anything...

http://www.hijackthis.de/

 

[bledd]

check your hosts file

 

[quackers]

Done that bledd, it's got me completely stumped this one.

I've just removed google toolbars etc etc from add/remove programs and i'm restarting to see if that makes any difference at all.

It's system restore time next or fresh install next

 

[bledd]

try this..

disable system restore
remove whatever av you've got now

run..

ccleaner slim
nod32 av trial
spybot s&d
adaware
avg antispyware (remove this after)

put firefox on with adblock plus and Easylist subscription (do this on your pc too)

shotgun blast approach, but usually works!

 

[quackers]

How about this for weird. If i goto to www.google.co.uk and click on a link it opens a new windows and wacky websites, if i goto http://images.google.co.uk and then search for bbc it works fine.

www.altavista.com doesnt seem to be affected either, works like normal. So it seems it's anything to do with www.google.co.uk in IE7 and Firefox

Bizarre as anything..

 

[quackers]

I'm running spybot again and then adaware

 

[bledd]

tried nod32 & avg antispyware

they're both very very good at finding things


disabling system restore is vital too, to stop crap-ware from 'hiding' in there

 

[quackers]

I havent tried nod32 yet, this is bizarre. In the past when you have something nasty redirecting traffic, it does it for everything not particular bits

 

[bledd]

re-check the hosts file, and the lmhosts file

 

[quackers]

Well finally got it sorted, used combofix from this guide here:

http://forums.techguy.org/malware-removal-hijackthis-logs/746850-go-google-redirect-virus.html

Worked really well, might be an idea to put that in the freeware sticky

 

[bledd]

man, that's a real stubborn ****, glad it's sorted

 

[quackers]

Cheers fella, it was a right royal pain in the ***. Got to love the challenge of an infection.

That combo tool seemed to pick up the root kit straight away, naughty DLL's in the system folder.

 

[bledd]

did you try nod32 btw?

i swear they must write half the viruses out there, the speed they get their definitions updated is unreal at times

 

[quackers]

I didnt in the end, that was going to be the next stop if the combo tool didnt work.

It's definately worth paying for that product, i've used it in the past and it's always done the job

It wouldnt surprise me if the anti-virus companies did write half of the crap that's out there, they do seem to be able to patch stuff up quickly all the time.

 

[Mr_Orange]

Funny enough got infected with this a few minutes ago. Thanks for the fix!

Might re-install xp just to be on the safe side this one raped my computer.

Anyone know the origin of it?

 

[Darg]

This thing is getting clever. It now detects any website with any mention of combofix and blocks it. If you click on the link to combofix direct from google (I forgot to copy and paste the url a few times) then it actually tries to download a program called combofix to your computer. Sneaky!

Be careful with this.. this guy is obviously updating it trying to avoid the programs out there that gets rid of it.

EDIT: I had to download it directly through getright using this link:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

EDIT2: Fix:

Disable System Restore in My Computer Properties.

Run combofix in safe mode.

fixed

 

[quackers]

Glad the fix is working for people, i've got my gf's brother's laptop to do this afternoon as well