This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

GOOGLE problem

7 min read

This thread's last reply is from December 10, 2009, 3:10 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

champ
December 9, 2009, 7:41 PM UTC
I am having this problem in firefox and IE both..

google.com is getting automatically shifted to google.de and if I try to open gmail.com then I am getting "Connection is untrusted" error..

Date n time on my computer is upto date..I used Malwarebytes to remove the malware and it has removed much of it but not all of it..there are still one remaiining



MalwareBytes LOG:

Malwarebytes' Anti-Malware 1.42
Database version: 3289
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

12/9/2009 11:18:33 AM
mbam-log-2009-12-09 (11-18-33).txt

Scan type: Full Scan (C:\|)
Objects scanned: 304567
Time elapsed: 47 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\disableconfig (Windows.Tool.Disabled) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

but this DISABLECONFIG seems to be the problem as it is the only malware getting detected now and even if I reboot its not getting deleted :(

while doing a scan using HijackThis..I got two warnings..




HiJackThis logfile is as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:49:07 AM, on 12/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\mfevtps.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Timbuktu Pro\tb2launch.exe
C:\Program Files\Timbuktu Pro\TimbuktuRemoteConsole.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Timbuktu Pro\Tb2Logon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Timbuktu Pro\tb2pro.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClientUI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Timbuktu Pro\TNOTIFY.EXE
C:\Documents and Settings\mrkassistant\My Documents\Downloads\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\SearchProtocolHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fullerton.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 http://www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 http://www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 http://www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 88.198.247.66 google.ae
O1 - Hosts: 88.198.247.66 google.as
O1 - Hosts: 88.198.247.66 google.at
O1 - Hosts: 88.198.247.66 google.az
O1 - Hosts: 88.198.247.66 google.ba
O1 - Hosts: 88.198.247.66 google.be
O1 - Hosts: 88.198.247.66 google.bg
O1 - Hosts: 88.198.247.66 google.bs
O1 - Hosts: 88.198.247.66 google.ca
O1 - Hosts: 88.198.247.66 google.cd
O1 - Hosts: 88.198.247.66 google.com.gh
O1 - Hosts: 88.198.247.66 google.com.hk
O1 - Hosts: 88.198.247.66 google.com.jm
O1 - Hosts: 88.198.247.66 google.com.mx
O1 - Hosts: 88.198.247.66 google.com.my
O1 - Hosts: 88.198.247.66 google.com.na
O1 - Hosts: 88.198.247.66 google.com.nf
O1 - Hosts: 88.198.247.66 google.com.ng
O1 - Hosts: 88.198.247.66 google.ch
O1 - Hosts: 88.198.247.66 google.com.np
O1 - Hosts: 88.198.247.66 google.com.pr
O1 - Hosts: 88.198.247.66 google.com.qa
O1 - Hosts: 88.198.247.66 google.com.sg
O1 - Hosts: 88.198.247.66 google.com.tj
O1 - Hosts: 88.198.247.66 google.com.tw
O1 - Hosts: 88.198.247.66 google.dj
O1 - Hosts: 88.198.247.66 google.de
O1 - Hosts: 88.198.247.66 google.dk
O1 - Hosts: 88.198.247.66 google.dm
O1 - Hosts: 88.198.247.66 google.ee
O1 - Hosts: 88.198.247.66 google.fi
O1 - Hosts: 88.198.247.66 google.fm
O1 - Hosts: 88.198.247.66 google.fr
O1 - Hosts: 88.198.247.66 google.ge
O1 - Hosts: 88.198.247.66 google.gg
O1 - Hosts: 88.198.247.66 google.gm
O1 - Hosts: 88.198.247.66 google.gr
O1 - Hosts: 88.198.247.66 google.ht
O1 - Hosts: 88.198.247.66 google.ie
O1 - Hosts: 88.198.247.66 google.im
O1 - Hosts: 88.198.247.66 google.in
O1 - Hosts: 88.198.247.66 google.it
O1 - Hosts: 88.198.247.66 google.ki
O1 - Hosts: 88.198.247.66 google.la
O1 - Hosts: 88.198.247.66 google.li
O1 - Hosts: 88.198.247.66 google.lv
O1 - Hosts: 88.198.247.66 google.ma
O1 - Hosts: 88.198.247.66 google.ms
O1 - Hosts: 88.198.247.66 google.mu
O1 - Hosts: 88.198.247.66 google.mw
O1 - Hosts: 88.198.247.66 google.nl
O1 - Hosts: 88.198.247.66 google.no
O1 - Hosts: 88.198.247.66 google.nr
O1 - Hosts: 88.198.247.66 google.nu
O1 - Hosts: 88.198.247.66 google.pl
O1 - Hosts: 88.198.247.66 google.pn
O1 - Hosts: 88.198.247.66 google.pt
O1 - Hosts: 88.198.247.66 google.ro
O1 - Hosts: 88.198.247.66 google.ru
O1 - Hosts: 88.198.247.66 google.rw
O1 - Hosts: 88.198.247.66 google.sc
O1 - Hosts: 88.198.247.66 google.se
O1 - Hosts: 88.198.247.66 google.sh
O1 - Hosts: 88.198.247.66 google.si
O1 - Hosts: 88.198.247.66 google.sm
O1 - Hosts: 88.198.247.66 google.sn
O1 - Hosts: 88.198.247.66 google.st
O1 - Hosts: 88.198.247.66 google.tl
O1 - Hosts: 88.198.247.66 google.tm
O1 - Hosts: 88.198.247.66 google.tt
O1 - Hosts: 88.198.247.66 google.us
O1 - Hosts: 88.198.247.66 google.vu
O1 - Hosts: 88.198.247.66 google.ws
O1 - Hosts: 88.198.247.66 google.co.ck
O1 - Hosts: 88.198.247.66 google.co.id
O1 - Hosts: 88.198.247.66 google.co.il
O1 - Hosts: 88.198.247.66 google.co.in
O1 - Hosts: 88.198.247.66 google.co.jp
O1 - Hosts: 88.198.247.66 google.co.kr
O1 - Hosts: 88.198.247.66 google.co.ls
O1 - Hosts: 88.198.247.66 google.co.ma
O1 - Hosts: 88.198.247.66 google.co.nz
O1 - Hosts: 88.198.247.66 google.co.tz
O1 - Hosts: 88.198.247.66 google.co.ug
O1 - Hosts: 88.198.247.66 google.co.uk
O1 - Hosts: 88.198.247.66 google.co.za
O1 - Hosts: 88.198.247.66 google.co.zm
O1 - Hosts: 88.198.247.66 google.com
O1 - Hosts: 88.198.247.66 google.com.af
O1 - Hosts: 88.198.247.66 google.com.ag
O1 - Hosts: 88.198.247.66 google.com.ar
O1 - Hosts: 88.198.247.66 google.com.au
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [TLogonPath] "C:\Program Files\Timbuktu Pro\Tb2Logon.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Mkumuf] rundll32.exe "C:\WINDOWS\unokijirazohit.dll",Startup
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {03A89EFD-E023-9000-A22D-45F77558EB4C} (ILINCInstall9 Class) - https://content9.ilinc.com/download/AXCltInstall.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1182451130359
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207778105946
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} (VodClient Control Class) - http://www.tvucricket.com/player/vjocx-en-black.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AD.FULLERTON.EDU
O17 - HKLM\Software\..\Telephony: DomainName = AD.FULLERTON.EDU
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = AD.FULLERTON.EDU
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fullerton.edu,ad.fullerton.edu
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fullerton.edu,ad.fullerton.edu
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BES Client (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Tb2 Launch (Tb2Launch) - Netopia, Inc. - C:\Program Files\Timbuktu Pro\tb2launch.exe

--
End of file - 13667 bytes
champ
December 9, 2009, 7:43 PM UTC
I cleared cookies and restarted PC several times..but that did not help :(
NonSuch
December 10, 2009, 3:10 AM UTC
We're sorry, but it is necessary to close your topic because you have replied to it prior to receiving a response from a helper.

Due to adding on to your topic with your second post it is highly unlikely that you would have received a response. Our helpers are looking for topics with zero responses. When you post replies to your own topic, it no longer has zero responses, and so it appears that you have received help when in fact, you have not.

If you still require help, please open a new thread in the Malware Removal forum and wait for assistance. Please do not run additional programs and/or post additional logs. Just your HijackThis log to start with is adequate. Your helper will ask for additional logs as needed. DO NOT reply to your own topic until you have received a response from a helper. Be patient. There are others who have been waiting longer than you, so do not expect an immediate reply.