IE and Firefox Hijacked and Chrome won't connect

FYI, I'm still being re-directed after running combofix.

An AVG window just popped up stating there was a threat detected, Win32/Patched.DO, in the file C:\WINDOWS\system32\drivers\ftdisk.sys that you had me check earlier. I reran it at both sites listed before and got the same results. My only option for action to be taken was Ignore.

Hi jtjag03

you have a rootkit called TDL3 and it can be very difficult to remove

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  
  *ftdisk*
  
  *iastor*
  
  
  
   

  
  
• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found at on your Desktop entitled SystemLook.txt

Thanks peku006

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 10:27 on 16/04/2010 by J....n J.....d (Administrator - Elevation successful)

========== filefind ==========

Searching for "*ftdisk*"
C:\cmdcons\FTDISK.SY_ --a--- 60791 bytes [18:52 17/08/2001] [18:52 17/08/2001] 345CA06DF0C008EA223F924391B4C205
C:\Documents and Settings\J....n J.....d\Local Settings\Temporary Internet Files\Content.IE5\8YKOEZHI\ftdisk.sys[1].htm --a--- 9866 bytes [06:11 16/04/2010] [06:11 16/04/2010] 2C6726E530CE409F7BB2DC9A9868A804
C:\WINDOWS\system32\dllcache\ftdisk.sys --a--c 125056 bytes [11:00 10/08/2004] [05:17 16/04/2010] 6AC26732762483366C3969C9E4D2259D
C:\WINDOWS\system32\drivers\ftdisk.sys --a--- 125056 bytes [11:00 10/08/2004] [05:17 16/04/2010] 6AC26732762483366C3969C9E4D2259D

Searching for "*iastor*"
C:\WINDOWS\dell\iastor\iastor.cat --a--- 8278 bytes [06:41 22/05/2006] [06:41 22/05/2006] 2E3C024419060C15DC9532C11FD8D73C
C:\WINDOWS\dell\iastor\iastor.inf --a--- 5742 bytes [16:18 11/05/2006] [16:18 11/05/2006] 6A9AB910B565B5108538C5E01CDECA43
C:\WINDOWS\dell\iastor\iastor.PNF --a--- 11516 bytes [19:15 17/09/2008] [19:15 17/09/2008] 492524055B3DC44849C9D6552FEFDF3B
C:\WINDOWS\dell\iastor\iastor.sys --a--- 247808 bytes [16:30 11/05/2006] [16:30 11/05/2006] 294110966CEDD127629C5BE48367C8CF
C:\WINDOWS\system32\drivers\iaStor.sys --a--- 247808 bytes [16:30 11/05/2006] [16:30 11/05/2006] 294110966CEDD127629C5BE48367C8CF

-=End Of File=-

Hi

Download and run OTM

Download OTM by Old Timer and save it to your Desktop.

• Double-click OTM.exe to run it.
• Paste the following code under the area. Do not include the word Code.
  

  :Files
  
  C:\Documents and Settings\J....n J.....d\Local Settings\Temporary Internet Files\Content.IE5\8YKOEZHI\ftdisk.sys[1]
  
  
  
  :Commands
  
  
  
  [emptytemp]
  
  
  
  

  
  
  • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
  • Push the large button.
  • OTM may ask to reboot the machine. Please do so if asked.
  • Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Thanks peku006

I didn't realize until after I ran OTM that I hadn't corrected the "..." that I replaced my name with in the file name, so I ran it again after the reboot. I will post both logs. Also, over night at some point, XP Security Tool 2010 snuck on. AVG no longer loads and if I go to Control Panel => Security, I no longer have control over firewall settings.

Run 1
All processes killed
========== FILES ==========
File/Folder C:\Documents and Settings\J....n J.....d\Local Settings\Temporary Internet Files\Content.IE5\8YKOEZHI\ftdisk.sys[1] not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 84 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41 bytes

User: J....n J.....d
->Temp folder emptied: 978158 bytes
->Temporary Internet Files folder emptied: 17134061 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 82714536 bytes
->Google Chrome cache emptied: 819568 bytes
->Flash cache emptied: 1937374 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 378412 bytes
->Flash cache emptied: 4316 bytes

User: NetworkService
->Temp folder emptied: 896 bytes
->Temporary Internet Files folder emptied: 92708367 bytes
->Java cache emptied: 78 bytes
->Flash cache emptied: 21732 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1238856 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 78254132 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 19817860 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 282.00 mb

Run 2

All processes killed
========== FILES ==========
File/Folder C:\Documents and Settings\J....n J.....d\Local Settings\Temporary Internet Files\Content.IE5\8YKOEZHI\ftdisk.sys[1] not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: J....n J.....d
->Temp folder emptied: 31896 bytes
->Temporary Internet Files folder emptied: 59794 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 17824045 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 641 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 896 bytes
->Temporary Internet Files folder emptied: 10439900 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 1196 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 808 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 27.00 mb


OTM by OldTimer - Version 3.1.10.1 log created on 04172010_144106

Files moved on Reboot...
File move failed. C:\Documents and Settings\J....n J.....d\Local Settings\Temp\5sbBr21 scheduled to be moved on reboot.
C:\Documents and Settings\J....n J.....d\Local Settings\Temp\WCESLog.log moved successfully.
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\RBI2SUH5\yp_demo[1].flv not found!
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5XLW98UG\yp_com[1].txt moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\3G7GQKZN\blank[1].htm moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\1OXKOUPN\launch[1].txt moved successfully.

Registry entries deleted on Reboot...

Hi jtjag03

Please do this:

• Click on the Start button, then click on Run...
  
• In the empty "Open:" box provided, type cmd and press Enter This will launch a Command Prompt window (looks like DOS).
  
• Copy the entire blue text below to the clipboard by highlighting all of it and pressing Ctrl+C (or after highlighting, right-click and select Copy).
  
  copy C:\WINDOWS\system32\drivers\ftdisk.sys c:\ftdisk.sys.sys
  
• In the Command Prompt window, paste the copied text by right-clicking and selecting Paste.
  
• Press Enter. When successfully, you should get this message within the Command Prompt: "1 file(s) copied"
  
• Exit the Command Prompt window.

Now we need to boot into the Recovery Environment:

Reboot your computer. Combofix should have installed the recovery console so this should already be available.

Follow the instructions here to start it

Next

Type cd system32\drivers and press Enter.
Type ren ftdisk.sys ftdisk.vir and press Enter.
Then type copy C:\ftdisk.sys ftdisk.sys and press Enter.
Now type exit and press Enter to reboot your computer into normal mode.

Please run Gmer and post the log.

Thanks peku006

I've tried running recovery console 3 times. I get a BSOD every time with a Stop : 0x0000007B error.

Hi

Please run Gmer and post the log.

Thanks peku006

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-18 23:09:45
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\JUSTIN~1\LOCALS~1\Temp\pxtdypow.sys


---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xBA0F887E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xBA0F8BFE]

---- Kernel code sections - GMER 1.0.15 ----

.rsrc C:\WINDOWS\system32\drivers\ftdisk.sys entry point in ".rsrc" section [0xB9F65314]
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB83EB380, 0x34C81F, 0xE8000020]
init C:\WINDOWS\system32\drivers\monfilt.sys entry point in "init" section [0xB0A72280]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[436] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B5000A
.text C:\WINDOWS\Explorer.EXE[436] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00BF000A
.text C:\WINDOWS\Explorer.EXE[436] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B4000C
.text C:\Program Files\Java\jre6\bin\jusched.exe[648] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00F60001
.text C:\WINDOWS\System32\svchost.exe[1240] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0098000A
.text C:\WINDOWS\System32\svchost.exe[1240] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0099000A
.text C:\WINDOWS\System32\svchost.exe[1240] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0097000C
.text C:\WINDOWS\System32\svchost.exe[1240] USER32.dll!GetCursorPos 7E41BD76 5 Bytes JMP 026A000A
.text C:\WINDOWS\System32\svchost.exe[1240] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 0207000A
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[2100] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 011F0001
.text C:\WINDOWS\stsystra.exe[2240] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 016B0001
.text C:\Program Files\iTunes\iTunesHelper.exe[2332] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 02920001
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[2340] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 010A0001
.text C:\WINDOWS\ehome\ehtray.exe[2392] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 016E0001
.text ...
.text C:\WINDOWS\system32\wuauclt.exe[3220] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0098000A
.text C:\WINDOWS\system32\wuauclt.exe[3220] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0099000A
.text C:\WINDOWS\system32\wuauclt.exe[3220] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0097000C

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \FileSystem\Fastfat \Fat A9AAAC8A

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device -> \Driver\iastor \Device\Harddisk0\DR0 8A65FAC8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys\modules@ESQULserv
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys\modules@ESQULl
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys\modules@ESQULclk

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\ftdisk.sys suspicious modification
File C:\WINDOWS\system32\drivers\iastor.sys suspicious modification

---- EOF - GMER 1.0.15 ----

BTW, I know I'm not supposed to run any scanners without being asked, but can I run the registry fix and malwarebytes so I don't have the XP antivirus 2010 opening every time I run something?

Hi jtjag03

Sorry for delay, I have some "Internet connection problems"

Run Malwarebytes' Anti-Malware

• Open Malwarebytes' Anti-Malware
• Select the Update tab
• Click Check for Updates
• After the update have been completed, Select the Scanner tab.
  On the Scanner tab:
  1. Make sure the "Perform full scan" option is selected.
  2. Then click on the Scan button.
  3. If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  4. The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  5. When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  6. Click OK to close the message box and continue with the removal process.
  
  Back at the main Scanner screen:
  1. Click on the Show Results button to see a list of any malware that was found.
  2. Check all items except items in the C:\System Volume Information folder... then click on Remove Selected.
     We will take care of the System Volume Information items later.
  3. When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  4. The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
     The log can also be found here:
     C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
  5. Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

2 - Status Check
Please reply with

description of any problems you are having with your PC

Thanks peku006

Ran a Quick then Full scan. Logs are below. I haven't been redirected yet when clicking on a google link, but I have had a random window popup.

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4012

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

4/20/2010 12:42:40 PM
mbam-log-2010-04-20 (12-42-40).txt

Scan type: Quick scan
Objects scanned: 120263
Time elapsed: 8 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 6
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\NetworkService\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Internet Explorer\IEXPLORE.EXE") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\MSASCui.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.


Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4013

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

4/20/2010 3:10:17 PM
mbam-log-2010-04-20 (15-10-17).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 285697
Time elapsed: 1 hour(s), 57 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\J....n J.....d\Local Settings\Temporary Internet Files\Content.IE5\23P1KUPF\update[1].exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.

Figured it was only a matter of time. I'm getting redirected again.

Hi jtjag03

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  
  *ftdisk*
  
  *iastor*
  
  
  
   

  
  
• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found at on your Desktop entitled SystemLook.txt

Thanks peku006