Can't Access Major Search Sites By URL

[allanc]

A client running XP PRO sp3 is having an interesting problem.
They are using the Windows Firewall and Avira Free (same results with AVG).

They can't access the major search engines by URL (Google, Yahoo, etc).
However, they can by IP address.
Any attempt to access another page within the domain (again by URL) or actually search go nowhere.

I set their home page to dogpile.con (another lesser known search engine) and it is not blocked.
So, they can use this search engine until the problem is resolved.

I have checked their hosts, ran process explorer, autoruns, hijackthis, SAS, Malware Bytes, Spybot and all is well.
Neither AVG or Avira find any issues.
I have checked their TCP/IP settings and everything is set to automatic.

Both Internet Explorer and a newly installed FireFox (4.x) have the same problem.

A bit of background....
This computer was infected and the client brought the computer to Staples.
After the tech was finished he said that the computer was infected with some sort of 'google virus' and that is why he (at Staples) could not access the major search engines either.
He said that he removed the virus but that the computer needed to be formatted and Windows reinstalled.

All assistance is appreciated.

 

[dbdawn]

Does this happen with a new account on the machine? Does it still happen in safe mode?

 

[allanc]

Does this happen with a new account on the machine? Does it still happen in safe mode?

Have not tried creating a new account but it does have the same issues in SAFE mode.

 

[Steve202]

So if you type www.google.com in the address bar nothing comes up, ie times out, or does it redirect to another website?

 

[ZenTree]

What about if you ping google.com, can it resolve it then?

I'd second trying a diff user account as well.

 

[B Trevathan]

Check the DNS settings, try using different servers such as Google's:

8.8.8.8
8.8.4.4

Display and/or flush the DNS resolver cache.

Have you checked the proxy settings?

Ping both the IP address and URL and see what response you get.

Tracert the IP address and URL see where the URL stops at.

Have you checked the MBR, run aswMBR?

Have you checked for rootkits, run tdsskiller, gmer, etc.?

Run some offline scans like Avria Rescue CD or Dr. Web Live CD.

Run OTL by oldtimer instead of Hijackthis.

Have you tried running Combofix?

 

[Hayes]

Checked the hosts file?

 

[ATTech]

I've heard some people have had success with the Norton and McAfee removal tools.

 

[DSep]

Try flushing the DNS Cache. That should probably clear up the issue if the virus is gone.

Steps:
1) open command prompt
2) type "ipconfig /flushdns"

 

[Countryside]

I would suggest downloading and running rkill if you can. if not, load it onto a thumb drive on another PC and then bring the thumb drive to the PC that has issues. rkill will locate and stop any malware processes that might be running. After this, download and run TDSSKiller. It will search for and remove commonly known re-direct bugs in IE.
After that, go into internet explorer settings - advanced - and reset IE settings to their default settings.

 

[allanc]

Does this happen with a new account on the machine? Does it still happen in safe mode?

Yes to a new account and the new account in Safe Mode.

 

[allanc]

So if you type www.google.com in the address bar nothing comes up, ie times out, or does it redirect to another website?

It times out in both regular windows and safe mode.

 

[allanc]

What about if you ping google.com, can it resolve it then?

I'd second trying a diff user account as well.

Pinging resolves on both accounts.

 

[allanc]

Check the DNS settings, try using different servers such as Google's:

8.8.8.8
8.8.4.4

Display and/or flush the DNS resolver cache.

Have you checked the proxy settings?

Ping both the IP address and URL and see what response you get.

Tracert the IP address and URL see where the URL stops at.

Have you checked the MBR, run aswMBR?

Have you checked for rootkits, run tdsskiller, gmer, etc.?

Run some offline scans like Avria Rescue CD or Dr. Web Live CD.

Run OTL by oldtimer instead of Hijackthis.

Have you tried running Combofix?

Using Google's DNS server results in all attempts to browse being unsuccessful.
I flushed the DNS with no success.
There are no proxy settings.
Pings are successful.
Ran 'aswMBR' with nothing found.
Gmer no results.
Tdsskiller results in a BSOD 'kernel_stack_Inpage_Error' which could be the results of a rootkit.
Avira rescue disk finds a 'tr/rootkit/gen2' in file windows/system32/acpi.sys but does not repair it.

 

[allanc]

Try flushing the DNS Cache. That should probably clear up the issue if the virus is gone.

Steps:
1) open command prompt
2) type "ipconfig /flushdns"

Done. Did not resolve the problem.

 

[allanc]

I would suggest downloading and running rkill if you can. if not, load it onto a thumb drive on another PC and then bring the thumb drive to the PC that has issues. rkill will locate and stop any malware processes that might be running. After this, download and run TDSSKiller. It will search for and remove commonly known re-direct bugs in IE.
After that, go into internet explorer settings - advanced - and reset IE settings to their default settings.

Done. This also did not resolve the issue.

 

[Steve202]

Pinging resolves on both accounts.

Do you get a reply?

Filler text.

 

[B Trevathan]

Tdsskiller results in a BSOD 'kernel_stack_Inpage_Error' which could be the results of a rootkit.
Avira rescue disk finds a 'tr/rootkit/gen2' in file windows/system32/acpi.sys but does not repair it.

Looks like you may have found the root of your problems. I think the acpi.sys file is normally located in the C:\Windows\System32\drivers folder if it is in the C:\Windows\System32\ folder then it is probably a malware replacement. Is the MS original acpi.sys file in the drivers folder, I think it should be around 179 to 187 KB in size?

Avria Rescue CD and Dr. Web Live CD are set by default to scan only, I always check the Avria Rescue CD option to rename the malware files that it finds instead of deleting the malware so that if I ever have to back track I can go back and rename the malware to its original name.

 

[allanc]

Looks like you may have found the root of your problems. I think the acpi.sys file is normally located in the C:\Windows\System32\drivers folder if it is in the C:\Windows\System32\ folder then it is probably a malware replacement. Is the MS original acpi.sys file in the drivers folder, I think it should be around 179 to 187 KB in size?

Avria Rescue CD and Dr. Web Live CD are set by default to scan only, I always check the Avria Rescue CD option to rename the malware files that it finds instead of deleting the malware so that if I ever have to back track I can go back and rename the malware to its original name.

Oops.
My typo
The file is in the drivers folder.
Good eye on you though.
Tks.

 

[allanc]

Do you get a reply?

Filler text.

Yes, and I ran a sfc /scannow ... just in case it might restore something back to original state.
SFC did not fix the problem either.