Browser hijacking

I've got a peculiar piece of Malware running on my box now. It hijacks the links on a Google search and sends you to a random place, usual a commercial seach engine but never the same place twice.

It affects IE 8, FF 3.5 and Opera 10. It does not affect Chrome. Running an Avast boot scan shows no malware. Spybot and Ad aware with the latest editions find nothing. For grins i downloaded and ran MS malware detection and removal tool and it found nothing as well.

So far this only affects search results, it doesn't hijack manual entries or bookmarks.

Any ideas of where to take this next?

many thanks

Did you try Malware Bytes Anti-Malware?

malwarebytes.org

Run spybot S&D as well as HiJackThis - remove any concerning/unknown entries.

Alternatively, post the results of HiJackThis here and I will inspect and advise what you should/can remove.


CTO

Spybot S&D says I'm clean, Ad Aware says I'm clean, Malwarebytes found Rougue.error removed it, came up clean 2nd time (7 hours of scanning) Avast says I'm clean. The process is still there.

Currently I'm sorting through the 52 processes that are running when I've got my browser open to a Google search results page.

Will try to Hijack this on it but I've got a lot of other projects this week. I appreciate the suggestions. Gut feeling is that I've got a new "bug" that hasn't been profiled yet, when it does it will be found, at this point it's just a nuisance.

In the mean time, I've trained the family to use Chrome instead of FF, IE and Opera.

Taken from > windowsclick.com redirect (UACd.sys.trojan) removal

Post> #19

Quote:

---

Originally Posted by t34b4g5

I recently had to fix a friends computer that was doing the same thing..

here's the way that i was able to fix it.


try going to my computer.
Click the folder button and make sure view hidden files/folders is turned on and check your drives for "resycled" and "autorun.inf" files/folder
They will appear in the root directory..

If they are there then go to a command prompt and change the attrib settings to the "resycled" folder and the “autorun.inf” file

attrib -r -s -h

then while still in the command prompt just use the del command on both.

then do a search for autorun.inf on your drives and after the scan just right click on each one and open with notepad or wordpad and check each one, and if any happen to have "boot.com" before a string of jumbled letters numbers then delete.
the "boot.com hides in the “recycled” folder and when the “autorun.inf” files is loaded it loads the “boot.com” file and your browser will continually get redirected.

restart computer and then go to my computer and click folder and check to make sure there both gone..

this thing was not only not letting me access the computers drives it also decided that it would re-direct the browser to www{X}copy-book{X}com {Note don't click site got active malware} all the time a little and i did the above and it should solve the issue.


Also
Start Windows in safe mode, then click Start -> Run. Type in regedit and click okay.

Now at the top of the registry editor,
click Edit -> Find.
Type boot.com and click Find Next. Every time it finds a new boot.com, press the delete key and then enter. It should find a dozen or so copies.

Now, plug in any external drives or flash drives you have used with this computer.
Open
My Computer. Click Tools -> Folder Options -> View and select "Show Hidden Files and Folders" and click okay.

For each drive, open it and delete the “recycled” folder and “autorun.inf”. Back up each “autorun.inf” before deleting them off external drives, because they might be important.

Restart the computer and the problem should be gone.

Any removable usb drives you've plugged into that computer will also be infected with the virus, so make sure you clean them out too (note if you clean your comp, then plug-in the usb drives it'll re-install itself)
any computers you've plugged that usb drive into are also infected

a summary of what this thing does - its installed itself as a windows driver with a random dll file name, you'll have to track down ALL instances of it and eradicate it completely. Booting in safe-mode will assist, the drivers wont show up in control panel or admin tools either as its hidden

other things you will need to remove this damn virus
malware-bytes anti malware
SmitFruadFix Scan
hijack this
gmer

this thread should help you: http://www.bleepingcomputer.com/forums/topic191577.html

if you download and install the latest version of those programs they should work fine without and update, the virus re-directs the update URL's as well. You will find its system-wide not browser specific!

---

You will need to use gmer as this infeciton uses rootkit. Find the driver, unload it, then the rest of the components should show.

gmer tool is good, perhaps using EndItAll to kill the process prior to scanning would also help?

gl

Got home from work this morning, downloaded gmer, installed it an ran it.

Popped off for a nap. woke up 4 hours or so later Windows was cycling in a boot mode. Wouldn't safe boot.

Used a Ubuntu live cd to copy my documents to a portable drive and I'm in the process of formatting my hard drive for a full Windows install. So I won't know what the malware was and I'll spend my day off tomorrow building my system back up. I got hit with CoolWebSearch two years ago and had to do the same thing.

I've run Linux and Windows on my home network (7 computers with a wireless as well as a wired lan) and I have never had a problem with Linux, Friggin Windows Sucks!

Thanks for your help everyone, I was hoping to find out what the little buggie was.

Quote:

---

Originally Posted by fourdc

I'm in the process of formatting my hard drive for a full Windows install.

---

Probably for the best. It is hard to tell how deep that stuff digs sometimes...

I know, I'll be clean (for a while), but like I said I wanted the post mortem, i wanted to know what killed it. It bothered me that none of the stuff I ran even noticed it.

When I got CoolWebSearch all of the virus/spyware programs caught it but nothing could take it off. This bug was only detectable by the user, and only if you were using a search.

The thing is probably an unwanted "Browser Helper Object" perhaps. Maybe, your web browser trusts it ...but not you.
Just install a good BHO disabling program like Bho Demon or Bho capture.

Next time try combofix. The newest version removes even the nastiest bug/root kits I have come across.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

HackGenie,

It got into three of my four browsers. I even uninstalled FF and reinstalled the newest version and it was there. I don't know what Chrome does differently but it didn't get to Chrome.

I appreciate the tips.

Quote:

---

Originally Posted by fourdc

I've run Linux and Windows on my home network (7 computers with a wireless as well as a wired lan) and I have never had a problem with Linux, Friggin Windows Sucks!

---

People say that... intil you write a perl script that causes problems for an estimated 30,000-50,000++ machines, most running linux.

Windows is built for toddlers and grandmothers. If you can't launch the policy editor and update a few adobe products then just accept that you know next to nothing about computers.

Quote:

---

Originally Posted by The-Specialist

People say that... intil you write a perl script that causes problems for an estimated 30,000-50,000++ machines, most running linux.

Windows is built for toddlers and grandmothers. If you can't launch the policy editor and update a few adobe products then just accept that you know next to nothing about computers.

---

Yea because someone is MUCH more likely to open a Perl Script they can see the source for, or, if it's been shadowed or whatever, or they don't know Perl, the chance they'll run a Perl script as root, without knowing what it does, is so likely... ?

I've got a bunch of Linux and BSD boxes here, the only Perl scripts running are system scripts and mine, and I'm not sure I even know anyone who'd go "Oh wow, a .pl file on my machine, I should su and run it as root!" lol.

I know what you're getting at, and what you meant, but with Windows, an infection is a web page or in some cases a media file away. People and Linux and BSD boxes all need to TRY to get an infection. The back roads of the net probably do have thing a lot like 5 mile in Detroit where you're going to be "itching" your "ports" after doing something"fun" but... Ah hell the puns are making it to easy, you know what I mean ;)

Under nobody you can still edit certian files and in some cases setup crone jobs. A windows guest account won't even give you write access to text files without editing the policy first. And exploits.... you can't even find exploits to escalate privileges under a windows install.

You need to escalate? Hmm, last 50 patches I installed said they were to stop someone from having complete control heh.

The average Linux and BSD user, have multiple accounts on their machines:

I have books going back to about 1999 and 2000 for Linux AND BSD, and they all talk about setting up the machine once it's installed. All of them mention you need to make a non root account for you to use. Windows on the other hand, you install and it logs in as admin as soon as the install is finished. A lot of people don't ever make another account, they use Admin accounts. and some even auto log in. So having admin logged in and no where does it say you should create another account that isn't admin. In other words, even if it doesn't let you do that, editing a text file as guest isn't a problem when most people leave only the default admin account on the machine to begin with.

Also, the nobody user, doesn't have as many real access points. And most of the stuff you install right now, like, for example, the newest version of BSD, isn't going to let "nobody" do much of anything. The idea behind the nobody account is a good one in my book.

Also, most Linux distros don't let the nobody account do too much either. I think I have seen some versions where nobody had access to certain system files, which is, as you said, a bad idea, but I don't think it takes but 5 minutes to fix that.