Enter your search terms

Web www.linabbs.com

Submit search form
Linabbs's blog
Categories
- Virus
- Windows7
- Zonealarm
Recent Comments
- punji on programs on my pc will not open. they say can not connect to the internet
- kymodoce on [Resolved] can’t open antivirus site and update antivirus
Recent Posts
Archives
Blogroll
- Linabbs
Pages
- About
Meta
Spam Blocked

343 spam comments

blocked by
Akismet

Feb

2

Virus Redirecting can’t update antivirus/download

Filed Under Virus |

So I seem to have a similar problem to many people on here. I try to search for something on google or yahoo and it redirects me to a page saying "did you mean this?" and it especially happens if I search for anything anti-virus related. Unfortunately for me I can’t download ANY anti-virus programs or even run the ones I have on my computer. I have tried to download Combofix and rename it and run it but it doesn’t work. I did get Kaspersky Online to scan my computer and it came up with 6 infected obejects…

C:\as3_ins\im_web_client\iss2.tar.gz - Trojan-downloader.win32.banload.xmu

C:\as3_ins\im_web_client\iss2.tar.gz - Trojan-downloader.win32.banload.xen

C:\as3_ins\im_web_client\iss2.tar.gz - Trojan-downloader.win32.banload.xmy

C:\as3_ins\im_web_client\iss2.tar.gz - Trojan-downloader.win32.banload.xmt

C:\as3_ins\im_web_client\webplr05.tar.gz - Trojan-downloader.win32.banload.xen

C:\as3_ins\im_web_client\webplr05.tar.gz - Trojan-downloader.win32.banload.xmy

I am on my laptop and not on my other computer so I had to just copy this by reading it. =P

If anyone can help that would be much appreciated!

Thanks!

Ian

Welcome to linabbs Ian

If you have a flash drive, download ComboFix by sUBs from here, saving it to the flash drive with a different name. kitty.exe or something.

Transfer it to the desktop of the affected computer, then run it as described below.

Disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

Close all open programs and windows
Double click ComboFix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.
Note: Do not mouseclick combofix’s window while its running. That may cause it to stall

If that fails, download RootRepeal to the Desktop. <—- shouldn’t be blocked on the affected machine Extract the compressed file to it’s own folder.
Open the folder and doubleclick on RootRepeal.exe to run it.
Click on the Report tab, and then click on: Scan
A window opens asking what to include in the scan.
Check the following boxes then click OK:Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services

You will then be asked which drive to scan.
Check C: (or the drive your operating system is installed on, if not C)
Click OK once again.
The tool will begin scanning and may take a while to complete, so please be patient.

When the scan finishes, click on: Save Report

Name the log RootRepeal.txt and save it to your Documents folder (it should default there).

Post the contents of the report in a reply here.

ROOTREPEAL (c) AD, 2007-2008

==================================================

Scan Time: 2009/01/19 14:19

Program Version: Version 1.2.3.0

Windows Version: Windows XP SP3

==================================================

Drivers

——————-

Name: 00000039

Image Path: \Driver\00000039

Address: 0×00000000 Size: 0 File Visible: No

Status: -

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xB3FEB000 Size: 98304 File Visible: No

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xBAE42000 Size: 8192 File Visible: No

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xB02A9000 Size: 45056 File Visible: No

Status: -

Name: TDSSpaxt.sys

Image Path: C:\WINDOWS\system32\drivers\TDSSpaxt.sys

Address: 0xB422B000 Size: 73728 File Visible: -

Status: Hidden from Windows API!

Hidden/Locked Files

——————-

Path: C:\Documents and Settings\Ian\ntuser.dat.LOG

Status: Size mismatch (API: 1331200, Raw: 1097728)

Path: C:\RECYCLER\S-1-5-21-484763869-573735546-725345543-1005\mbam-setup.exe

Status: Locked to the Windows API!

Path: C:\RECYCLER\S-1-5-21-484763869-573735546-725345543-1005\Kitty.exe.exe

Status: Locked to the Windows API!

Path: C:\RECYCLER\S-1-5-21-484763869-573735546-725345543-1005\Dc4.lnk:Zone.Identifier

Status: Invisible to the Windows API!

Path: C:\RECYCLER\S-1-5-21-484763869-573735546-725345543-1005\Dc4.lnk:Zone.Identifier

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\TDSScfum.dll

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\TDSSfxmp.dll

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\TDSSnrsr.dll

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\TDSSofxh.dll

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\TDSSosvd.dat

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\TDSSriqp.dll

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\TDSStkdv.log

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\TDSSpaxt.sys

Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Ian\Local Settings\Temp\TDSSac25.tmp

Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Ian\Local Settings\Temp\TDSSac35.tmp

Status: Invisible to the Windows API!

Path: C:\Documents and Settings\Ian\Local Settings\Temp\jusched.log

Status: Size mismatch (API: 4648, Raw: 4404)

Path: C:\Documents and Settings\Ian\Application Data\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρϴϱЄϱЃϵϳЅ

Status: Locked to the Windows API!

Path: C:\Documents and Settings\Ian\Application Data\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρЂϻϵЉЃϵϳЅ

Status: Locked to the Windows API!

Path: C:\Documents and Settings\Jaimee\Local Settings\History\History.IE5\index.dat

Status: Allocation size mismatch (API: 24576, Raw: 20480)

SSDT

——————-

#: 041 Function Name: NtCreateKey

Status: Hooked by "sptd.sys" at address 0xba6dbc04

#: 071 Function Name: NtEnumerateKey

Status: Hooked by "sptd.sys" at address 0xba6dbd48

#: 073 Function Name: NtEnumerateValueKey

Status: Hooked by "sptd.sys" at address 0xba6dc0c0

#: 119 Function Name: NtOpenKey

Status: Hooked by "sptd.sys" at address 0xba6dbae2

#: 160 Function Name: NtQueryKey

Status: Hooked by "sptd.sys" at address 0xba6dc18a

#: 177 Function Name: NtQueryValueKey

Status: Hooked by "sptd.sys" at address 0xba6dc022

#: 247 Function Name: NtSetValueKey

Status: Hooked by "sptd.sys" at address 0xba6dc212

Stealth Objects

——————-