windowsclick.com redirect (UACd.sys.trojan) removal

System Infected

Windows XP Pro SP2


What you'll need

Windows XP Installation CD


My situation

So, my fellow employee in the IT security department had gotten himself infected. Again. This time, his workstation was running like a dog with 3 broken legs, McAffee VShield wasn't scanning anything at all; Spybot S&D wouldn't even start (the TeaTimer Resident starts just fine), and the MalwareBytes AntiMalware scanner's installation program wouldn't even run as well. Safe mode did nothing different.

McAffee's On-Demand scanner did find a few trojan files, and one NTOSKRNL hook file, but as soon as those were deleted, the hook file was right back where it was before.

Rootkit Revealer found 3 different hidden registry entries related to UACd (hidden from Windows API), but if course it had no way of removing those.

Looking on Google, this link (myantispyware.com) came up third, but the initial steps didn't work, due to the fact that the UACd driver didn't show up under "Hidden Drivers" in the Device Manager. Then, another site under myantispyware had a very nice tutorial on using the Windows XP installation CD's Recovery Console to simply list the services and drivers available, and to disable the UACd.sys driver, but for some odd reason, upon searching for the exact same thing in Google when actually cleaning out the machine, the site was no longer there. So, I'm posting about what to do if infected by this particular trojan.

Symptoms

Seemingly random browser redirects to windowsclick.com, especially from search engines such as Yahoo, Google, etc., and from security sites such as Symantec, McAffee, etc. Also, Security programs such as firewalls, antivirus... fail to execute.

What to do

Download MalwareByte's Anti-Malware (MBAM) scanner, and save the install program on your desktop (or somewhere you'll find it later). Don't bother trying to install it now, because, with this trojan, it won't even get the chance to run. Having the XP installation CD ready, reboot the machine, stick the CD into the CD drive. You may or may not have to go into the BIOS to tell it to let the CD try to boot before the harddrive. When it asks you to, press any key to reboot using the CD.

You'll next see the usual steps the CD goes through (installing generic drivers, starting windows, blah blah). Then, when the main menu comes up, press 'R' to boot into the Recovery Console.

You may have to wait a few seconds before it gives you a choice of which windows installation you want to use the Console on. If you only have one Windows XP installation on the harddrive, press 1, and hit enter. Otherwise, choose which installation you want to recover, and hit enter.

It will most likely ask you for an Administrator password (you DO remember the password, don't you?). Type in the password, and hit Enter. The obligatory C:>WINDOWS prompt should pop up.

First, you want to make sure the UACd.sys driver is even in the system. To do this, type in "listsvc" without the quotes. Hit Enter to scroll page by page until you see UACD.sys in the list. Then, press ESC to stop listing, and go back to the prompt.

Assuming you've seen the UACd.sys driver in the list, you'll type in "DISABLE UACd" at the prompt, and hit Enter. Some gook should come up, admonishing you to take note of the state of the driver, and that the state of the driver has been changed to "System_disabled" or something like that. Take the XP CD out, and reboot the computer.

No safe mode is needed here. Reboot as you would normally, and log in as you would normally. Your antivirus should start scanning (you DO have antivirus installed, right?), indicating a few infected files found in the system (how long has it been since you updated your antivirus definitions?) and you should be able to install MBAM with no problems. Update MBAM, and do a Full Scan. This *should* get rid of all traces of the UACd trojan, but just to be sure, look for, and delete these files if you find them:

%System%\uacinit.dll
%System%\drivers\UAC[RANDOM CHARACTERS].sys
%System%\UAC[RANDOM CHARACTERS].dll
%System%\UAC[RANDOM CHARACTERS].log
%System%\UAC[RANDOM CHARACTERS].dat
%Temp%\tmp[RANDOM NUMBERS].tmp

%System% is a system variable, it usually means "C:\Windows\System32".
%temp% is also a system variable, you may have to search for this directory.

Happy computing!

Why would anyone think that they could just "delete" system files?

The best thing to do would be a full REINSTALL and start using the guest account and the policy editor instead of downloading and using multiple antivirus software.

True. Problem is, most users have never heard of the policy editor available in XP. It's generally time-consuming if you don't have an image already loaded with the correct policy settings.

Granted, most users will never see, much less be able to operate, the Recovery console as well. But, this particular trojan, while being nearly impossible to delete in normal mode, is easily disabled in the Recovery console, thus turning a 2+ hour process (30+ minutes reinstalling the OS, 30 more minutes to 1 hour updating, service packs, AV definitions, etc.; then another hour, depending, on reloading all the programs/data) to just under 20 minutes (disabling it in recovery mode, rebooting and then scanning and deleting the files involved, then changing all passwords).

I had this show up on my computer yesterday, was easily solved by downloading combofix(saving it as fixcombo.exe) and executing it. windowsclick redirect blocks specifically named EXEs from execution, change their name and they run without problem.


no reinstall, no recovery console, just run a program, reboot, program runs again, done

If your computer is screwed up to the point where you are not able to execute any of the programs suggested, even after renaming.... this is what I did, except I skipped step 1 since I didn't have it:

Step 1: Disable UACd.sys trojan driver.
• Right click the My computer icon. If you are using the non classic Start menu, then right click My computer icon on your Start button menu.
• Click Properties.
• Click Hardware Tab.
• Click Device Manager.
• In the top menu, click View and click Show Hidden Drivers.
• Scroll down to non Plug and Play drivers.
• Click + at left.
• In the list of drivers right click UACd.sys.
• Click Disable.
• Click YES for confirm.
• Close all windows and reboot your computer.

Step 2: Delete UACd.sys trojan driver and malware files.
• Download Avenger from here and unzip to your desktop.
• Run Avenger, copy,then paste the following text in Input script Box:

Drivers to delete:
UACd.sys

Files to delete:
C:\WINDOWS\system32\wJQs.exe

Then click on ‘Execute’. When you put the input in, I mean all 4 lines, not just a combination of them.

• You will be asked Are you sure you want to execute the current script?. Click Yes.
• You will now be asked First step completed — The Avenger has been successfully set up to run on next boot. Reboot now?. Click Yes.
• Your PC will now be rebooted.


Step 3: Remove UACd.sys trojan files and any associated malware.
• Download Malwarebytes Anti-Malware (MBAM). The program designed to quickly detect, destroy and prevent malware, spyware, trojans.
• Once downloaded, close all programs and Windows on your computer (including this one).
• Double-click on the icon named mbam-setup.exe to install the application.
• When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select “Perform Quick Scan”, then click Scan.
• MBAM will now start scanning your computer for malware. This process may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• MBAM will now delete all of the files and registry keys and add them to the quarantine.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
UACd.sys trojan creates the following files.
%System%\uacinit.dll
%System%\drivers\UAC[RANDOM CHARACTERS].sys
%System%\UAC[RANDOM CHARACTERS].dll
%System%\UAC[RANDOM CHARACTERS].log
%System%\UAC[RANDOM CHARACTERS].dat
%Temp%\tmp[RANDOM NUMBERS].tmp



A final note.... to do this, you'll probably need a second computer to download the programs. Email the programs to yourself. If you are using gmail, it will not allow an executable through, even if it is zipped. So, rename the .exe extension to something like .bexe. Then, rename back to .exe when you successfully have these files on the infected computer.

Hope this helps. A real ***** masterminded this one. Wish I would have thought of it first, lol.

Big T, you forgot to include the url to this avenger app.. ;)

http://swandog46.geekstogo.com/avenger2/avenger2.html

:halo::D

Quote:

---

Originally Posted by big t

If your computer is screwed up to the point where you are not able to execute any of the programs suggested, even after renaming.... this is what I did, except I skipped step 1 since I didn't have it:

Step 1: Disable UACd.sys trojan driver.

---

FYI - I thought it would be worth mentioning that the UAC driver was not in my list of drivers in the device manager, but Combofix was able to find and clean it up for me.

I used:
http://www.bleepingcomputer.com/comb...o-use-combofix
and it fixed the problem for me. Be patient and save as "combo-fix"

Thanks for the links. Bookmarked :)

Just wanted to say a big thank you to NukEvil and others for clear, precise, simple no-nonsense instructions on how to get rid of windowsclick trojan. Process worked a treat! Thanks! :)

Hi all, I do helpdesk on State Applications, and work as a liason and am not a techie person. My State pays State emps and contractors to do that kind of stuff.

This is my home PC that is having the problem with Windowsclick, a very old 40 gig Gateway that used to run like a charm.

I have this malware and I stayed up really really late last night trying to get rid of it, :fpissed: safe mode did not work, 4 different malwares including spybot and malbytes (sp??). I finally gave up. Did find some viruses and trojans that got past my AVGfree. :drink:

Someone posted about downloading to another Computer and e-mailing the anti-malware.

:confused: If I download the malware from my laptop, is it OK to download it to my external HD? Reconnect the external HD to the infected machine and run it from there? :confused:

Thanks for any help, my wall paper is getting lighter and lighter...

Seems that Google has indexed this thread..

Anyways, remelian, I assume you've read this thread? If so, did you try the Recovery Console method, or renaming the anti-malware program?

Windowsclick is rather easy to remove after you've found an easy way to remove it.

I tried renaming 2 of the anti malwares. That did not allow them to work either.

This is running XP 2002, so finding any disc is going to be a challenge, buried somewhere in this room...I bought this right before Gateway gave up their brick and Mortar stores. It has served me well, Fire dog guys were suprised how fast it booted when I added memory last year...So I would like to keep it running and NOT depend on my Viao with Vista :argue: I really hate Vista. My Viao stuff and my EEEP stuff will not work.

yes I found you all through Google.

I am getting ready to download to my Viao, one of the techies at work warned me that since my external HD has been hooked up to my Gateway, it could be infected too. I have a 40 gig external HD for my EEEP (it has like 12 gig, so if I want my music camping it has to be on an external HD) so I can download the set up through my Viao into my mini external HD, I hope.

Disable System Restore, dump AVG and install Avira AntiVir instead.

Install Ccleaner (www.ccleaner.com) and manually delete as many
contents of temp folders as you can on that PC.

Update everything: SpyBot, MalwareBytes, AntiVir.

Then run 'em again.

If you are going to connect the external drive, make sure when you go to copy stuff that you do not open it by clicking the drive's icon, instead open my computer and click the Folder button above the addresse bar ;)

and on folders bar open the drive that way.

and when accessing the copied files on the infected machine do the same..

Avira sees it (well I can see the file as it cascades through) but does not trap it.
I think I have now the Cleanest registry in the State of DE...(private computer)...
Avira keeps trapping the same 2 things, one is a root kit.

t34b4g5, I did not know there was another way to get to the flash or external HD. There are no icons for the H drive (external) and G drive (flash) on my desk top. So I guess that is a good thing.

My work computer let me download the setups for malbytes and and something with the icon of a lion(???) onto my flash drive and let me change the names and the extension, but when I changed the extension, it did not recognize it. My brain is foggy with lack of sleep and all this technical stuff.

I did find my restore disc last night at the bottom of the software drawer, so if all fails, I will back all my music, and do a full disc restore. the rest is pretty well backed up or easy enough to re-down load, with the exception of my DVD Santa and ca couple of other paid with only one key things...most of what I have is free ware. I ahve not ahd to do that in years and years and never on this really reliable Gateway...teaches me NOT to be where I really should not be...

I ran Combofix and within seconds it ID'd a bunch of UACd files.
I completed the run, did what it said to do.
I rebooted.
Then went back into the internet. Nope windowsclick is still redirrecting.
I ran Avira, it picked up a root kit. I got rid of that (quarantined)
Then I re-ran Combofix, hard drive was clean.
I downloaded the root kit tool from Avira, that came up clean.
Went back into the internet, and got redirected again...methinks that it might be something in my external HD...I guess I need to wipe it clean since I cannot figure out how to get Combo fix to look at it.

I left for work running a full scan with Avira, I have my external HD and my flash drive being scanned in the full scan.

I defraged the C drive last night and where I had 24.7% free space on my C drive, I now have 37.8% free space, so I had a lot of junk that was removed. Malwarebytes removed one of my paid for antiviruses as a "rogue".

I have had this gateway since 2001, found files I installed back to there. It has seen Verizon internet and now Comcast, as well as a local ISP before I made the plung to Verizon. So this computer is like an old friend. Like an old friend, I hate when someone is sick...

I am going to dump all the files on the External HD and reload from the C Drive. I had EVERYTHING backed up including the hidden files. I also have a brand new 500 gig External, I may just try backing up into that and seeing what happens after a full scan.

Remelian try following this guide and let me know if it helps.

Quote:

---

Originally Posted by t34b4g5

I recently had to fix a friends computer that was doing the same thing..

here's the way that i was able to fix it.


try going to my computer.
Click the folder button and make sure view hidden files/folders is turned on and check your drives for "resycled" and "autorun.inf" files/folder
They will appear in the root directory..

If they are there then go to a command prompt and change the attrib settings to the "resycled" folder and the “autorun.inf” file

attrib -r -s -h

then while still in the command prompt just use the del command on both.

then do a search for autorun.inf on your drives and after the scan just right click on each one and open with notepad or wordpad and check each one, and if any happen to have "boot.com" before a string of jumbled letters numbers then delete.
the "boot.com hides in the “recycled” folder and when the “autorun.inf” files is loaded it loads the “boot.com” file and your browser will continually get redirected.

restart computer and then go to my computer and click folder and check to make sure there both gone..

this thing was not only not letting me access the computers drives it also decided that it would re-direct the browser to www{X}copy-book{X}com {Note don't click site got active malware} all the time a little and i did the above and it should solve the issue.


Also
Start Windows in safe mode, then click Start -> Run. Type in regedit and click okay.

Now at the top of the registry editor,
click Edit -> Find.
Type boot.com and click Find Next. Every time it finds a new boot.com, press the delete key and then enter. It should find a dozen or so copies.

Now, plug in any external drives or flash drives you have used with this computer.
Open
My Computer. Click Tools -> Folder Options -> View and select "Show Hidden Files and Folders" and click okay.

For each drive, open it and delete the “recycled” folder and “autorun.inf”. Back up each “autorun.inf” before deleting them off external drives, because they might be important.

Restart the computer and the problem should be gone.

Any removable usb drives you've plugged into that computer will also be infected with the virus, so make sure you clean them out too (note if you clean your comp, then plug-in the usb drives it'll re-install itself)
any computers you've plugged that usb drive into are also infected

a summary of what this thing does - its installed itself as a windows driver with a random dll file name, you'll have to track down ALL instances of it and eradicate it completely. Booting in safe-mode will assist, the drivers wont show up in control panel or admin tools either as its hidden

other things you will need to remove this damn virus
malware-bytes anti malware
SmitFruadFix Scan
hijack this
gmer

this thread should help you: http://www.bleepingcomputer.com/forums/topic191577.html

if you download and install the latest version of those programs they should work fine without and update, the virus re-directs the update URL's as well. You will find its system-wide not browser specific!

---

I think that you have a variant.. :)

Hmmm, are you able to run an online scan tool?

www.pandasecurity.com/activescan

Post the log here ...

Thanks all.

yes I could run online scans. I have now been virus free for about 2 days. I dumped almost all my backup files on my external except for a few that I cannot easily replace since they were not stored anywhere but my H drive, and ran independent scans on each of those areas. Evidently something was hiding in my H drive, re"infecting" my Gateway.

All of the scans (when H drive was disconnected) came up clean, as in all zeros...BUT when I hooked back up my H drive, the windowsclick came back even thought the C drive came up clean. The H drive would fireup even when not engaged (the light would brighten and I could hear it "thinking").

Thanks again!!!!

Just registered specifically to say thanks for the info. I used billybobbubba's method and went with combofix first. Worked like a charm. I'd say try that first, then the manual method as you have nothing to lose.

registered to say thanks to NukEvil - I tried the other methods, but the file did not show up in my hidden drivers list and whenever I tried to run combo fix, my computer would just shut down - even after renaming the exe. NukEvils method did the trick - I was able to run Malwarebytes after disabling the uac file and Avira found all the infected dll files and removed them. THANKS NukEvil.

A quick scan with Malwarebytes and a full scan with an updated Norton both come up clean. Google works (ie, no more redirecting).

Now the fun part…

1. Was I infected with something that steals passwords or enables another use to control my computer such as a backdoor trojan?
2. Is my computer now clean? Can I use it for online banking? Or is it permanently compromised (until I reformat)?
3. Is it prudent to reformat?
4. In the process of cleaning, I tried a system restore at one point, though it was blocked from working. I’ve read that the trojan can be backed-up by system restore. Should I turn off system restore, thereby deleting all saved versions to ensure the Trojan isn’t saved, and then turn it back on again?
5. The original operating system is on my E: drive, I believe portioned away from the rest. Could that have been infected?

Well its very hard to say ...

You will never be truly clean until you format...

Just make sure you have some soft of firewall / AV running.

Had a Vista system with this same "condition", full of UAC<xxxxxxxxx>dll files which AVG picked up and killed off, but it wouldn't touch or couldn't find the main driver (as per design of the trojan and the nature of a rootkit).

As suggested I tried ComboFix.exe but it wouldn't run. Nor would MalwareBytes AntiMalware, AdAware, HijackThis or anything else useful in killing it off. Internet Explorer ran though.

It wasn't until I renamed ComboFix.exe to something more random than just Combo-Fix.exe that it could actually do anything.

1 reboot later and all looked well. Got MBAM to do a full scan overnight and that found nothing. CPU use dropped from min. 55% to min. 0%.

All sorted! (6 hours trying, though!)

I had to register to make this post. Thank you so much to Big T on the first page. Avenger + MalwareBytes seems to have solved the issue. I feel so much better because I thought I had messed up a work computer. We're not supposed to use that computer for crap, and I made a stupid, unthoughtful, and lazy mistake when I was using it.

Anyways, thanks so much for your post and if anyone else has the same problem (can't get antispyware to load, UPC crap, etc) this thing definitely works. Thanks so much guys! :D