Google Redirection, all browsers acting slowly

Looks like the TDL Rootkit is still present.

Download OTL by OldTimer to your Desktop.

Alternative Download

If you already have a copy of OTL delete it and use this version.

• Double click OTL.exe to launch the programme.
• Copy/Paste the contents of the code box below into the Custom Scans/Fixes box.

:Files

C:\Users\Alex\AppData\Local\cspiena.dll

C:\Users\Alex\AppData\Local\temp\rnewaomsxc.exe

C:\Users\Alex\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\42cc9baf-6632dd0d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\hxn0.jar



:Commands

[emptytemp]

[emptyflash]

[resethosts]

• Click the Run Fix button.
• OTL will now process the instructions.
• When finished a box will open asking you to open the fix log, click OK.
• The fix log will open.
• Copy/Paste the log in your next reply please.

Note: If necessary, OTL may re-boot your computer, or request that you do so, if it does, re-boot your computer. A log will be produced upon re-boot.

Next

• Download aswMBR.exe to your desktop.
• Double click aswMBR.exe to run it

• Click the SCAN button to start the scan.

• On completion of the scan click SAVE LOG and save it to your desktop.
• Post the log contents in your next reply please.

Do not attempt to fix anything with aswMBR.exe yet

Summary of the logs I need from you in your next post:

• OTL log
• aswMBR.exe log

Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.

Here you are!

otl.txt

All processes killed
========== FILES ==========
C:\Users\Alex\AppData\Local\cspiena.dll moved successfully.
C:\Users\Alex\AppData\Local\temp\rnewaomsxc.exe moved successfully.
C:\Users\Alex\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\42cc9baf-6632dd0d moved successfully.
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\hxn0.jar moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Alex
->Temp folder emptied: 60863107 bytes
->Temporary Internet Files folder emptied: 218905265 bytes
->Java cache emptied: 8306 bytes
->FireFox cache emptied: 100678775 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 7634944 bytes
->Flash cache emptied: 100261 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LogMeInRemoteUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4557953 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 375.00 mb


[EMPTYFLASH]

User: Alex
->Flash cache emptied: 0 bytes

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: LogMeInRemoteUser

User: Public

Total Flash Files Cleaned = 0.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.22.3 log created on 04032011_140204

Files\Folders moved on Reboot...
C:\Users\Alex\AppData\Local\Temp\VGXAF43.tmp moved successfully.

Registry entries deleted on Reboot...

aswMBR.txt

aswMBR version 0.9.4 Copyright(c) 2011 AVAST Software
Run date: 2011-04-04 23:05:21
-----------------------------
23:05:21.737 OS Version: Windows 6.0.6002 Service Pack 2
23:05:21.737 Number of processors: 2 586 0x6B02
23:05:21.739 ComputerName: ALEX-PC UserName: Alex
23:05:27.782 Initialize success
23:05:53.337 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000065
23:05:53.340 Disk 0 Vendor: WDC_WD16 08.0 Size: 152627MB BusType: 3
23:05:53.343 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000066
23:05:53.345 Disk 1 Vendor: Hitachi_ GM4O Size: 476940MB BusType: 3
23:05:55.369 Disk 0 MBR read successfully
23:05:55.372 Disk 0 MBR scan
23:05:57.377 Disk 0 scanning sectors +312578048
23:05:57.410 Disk 0 scanning C:\Windows\system32\drivers
23:06:03.465 Service scanning
23:06:05.565 Disk 0 trace - called modules:
23:06:05.576 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x8501f1f8]<<
23:06:05.579 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861c1ac8]
23:06:05.583 3 CLASSPNP.SYS[889c78b3] -> nt!IofCallDriver -> [0x858dbf08]
23:06:05.587 5 acpi.sys[881346bc] -> nt!IofCallDriver -> \Device\00000065[0x850e5b20]
23:06:05.593 \Driver\nvstor32[0x850cbdd8] -> IRP_MJ_CREATE -> 0x8501f1f8
23:06:05.598 Scan finished successfully

Well the aswMBR scan is saying you don't have a TDL infection, so ..... How is your computer behaving now ?

It seems to be running well. I hadn't tried anything video or processor intensive before yesterday night so I loaded up a game and ran it. Performance seems good. Redirection is no longer happening on my search results, my browsers and other programs launch quickly, and my windows look alright again.

Would it be prudent to run aswMBR again (maybe in safemode) just to verify its results? Also, a question about the bottom section of the ESET log:

C:\Qoobox\Quarantine\C\Users\Alex\AppData\Roaming\0AA35AA340E408D76C950D7A0C838F79\enemies-names.txt.vir Win32/Adware.AntimalwareDoctor.AE.Gen application (unable to clean) 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Users\Alex\AppData\Roaming\0AA35AA340E408D76C950D7A0C838F79\local.ini.vir Win32/Adware.AntimalwareDoctor.AE.Gen application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Alex\AppData\Local\cspiena.dll a variant of Win32/Cimag.GG trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Alex\AppData\Local\temp\rnewaomsxc.exe a variant of Win32/Cimag.GG trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Alex\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\42cc9baf-6632dd0d probably a variant of Java/Agent.AF trojan (unable to clean) 00000000000000000000000000000000 I
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\hxn0.jar a variant of Java/TrojanDownloader.Agent.NAL trojan (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\02092011_074510\C_Users\Alex\AppData\Roaming\BC3FC61EBD2390BE003660698B68EBA6\enemies-names.txt Win32/Adware.AntimalwareDoctor.AE.Gen application (unable to clean) 00000000000000000000000000000000 I
C:\_OTL\MovedFiles\02092011_074510\C_Users\Alex\AppData\Roaming\BC3FC61EBD2390BE003660698B68EBA6\local.ini Win32/Adware.AntimalwareDoctor.AE.Gen application (unable to clean) 00000000000000000000000000000000 I

I see the scanner is still finding traces of AntiMalwareDoctor... Is that something to worry about or are these not a concern because they have already been found and quarantined?

Have you run a new E-Set scan since the last one, or is the log section you've just posted the one you posted earlier? ...... PLEASE LET ME KNOW

We did not remove the Qoobox and _OTL\Moved file objects found by E-set because they are encrypted quarantine files created by Combofix and OTL, they cannot re-infect you and we will remove them when we remove Combofix and OTL.

The other files we removed with OTL and your last OTL log says they were moved successfully.

aswMBR was not designed to run in Safe Mode, it was designed to run in Normal Mode.

No, I have not run E-Set again; I don't do anything unless you tell me to . I was just quoting the earlier log a second time because I saw the name of the program that started this whole mess in the log... so I didn't understand how ESET could see it but aswMBR said I was free and clear. Thanks, that makes more sense now. Sorry I wasn't clear.

How do you suggest we proceed, or are we finished?

Since your latest logs appear clear, and your computer appears to be operating normally again, I think we must assume you're now clean of infection.

Time for a little tidying up, then I'll make a few suggestions about security.

First

Let's clear out OTL and the files and folders it created. This will also remove TDSSKiller.

• Double click OTL.exe to launch the programme.
• Click on the CleanUp! button.
• OTL will download a list from the Internet, if your firewall or other defensive programmes alerts you, allow it access.
• You will be prompted to allow the clean up procedure, click Yes
• When finished exit out of OTL
• Now delete OTL.exe (if still present).

Next

Please delete the following files ....

CKScanner.exe ... and any log files it created.
aswMBR.exe ... and any log files it created.
DDS.scr ... and any log files it created.

Next

Earlier on you disabled Win Patrol

To Re-enable WinPatrol.

• Click Start, Programs > All Programs > WinPatrol > WinPatrol
• Right Click the Scotty icon in your task bar and select Options.
• Check Automatically run Win Patrol when computer starts
• Close the Win Patrol window.

As far as I can see, your computer looks clear of infection now.

Are you still noticing any problems ?

• If you are let me know about them.
• If not it's time to make your computer more secure.

Please read the article below which will give you a few suggestions for how to minimise your chances of getting another infection.

• Computer Security - a short guide to staying safer online

If your computer is running slowly after your clean up, please read.

• What to do if your Computer is running slowly

As your problems appear to have been resolved,