Can't Access Major Search Sites By URL

[Countryside]

Sounds like you're down to a good 'ol nuke & pave.

 

[numnutz]

long shot but, Anvir task manager anything in urlsearchhook?

 

[B Trevathan]

Sounds like you're down to a good 'ol nuke & pave.

uh what about if they just from the recovery console replace the file that the Avria Rescue CD found as a rootkit before N&P everything? I wonder if that might work.

I wonder also if the SFC was run from within the windows where the root kit is active?

 

[allanc]

uh what about if they just from the recovery console replace the file that the Avria Rescue CD found as a rootkit before N&P everything? I wonder if that might work.

I wonder also if the SFC was run from within the windows where the root kit is active?

I wonder if it is a false positive?
I uploaded to VirusTotal.com and it was 100% clean.

I don't follow you on the SFC question.
Sorry.

 

[Xander]

Couldn't you just boot to a recovery console or Bart disk and expand a fresh copy off the install CD?

I just had a system with an infected userinit.exe and that's all I needed to do.

 

[allanc]

long shot but, Anvir task manager anything in urlsearchhook?

Checked and nothing in that area.
Tks for the idea.

 

[allanc]

Couldn't you just boot to a recovery console or Bart disk and expand a fresh copy off the install CD?

I just had a system with an infected userinit.exe and that's all I needed to do.

I am actually running the same O/S on this computer.
I could grab the file from here.
I think it is a red herring though but I am willing to try it in the morning.
It has been a long couple of days.

 

[B Trevathan]

I wonder if it is a false positive?
I uploaded to VirusTotal.com and it was 100% clean.

I don't follow you on the SFC question..

What I was meaning was that it is a basic function of a root kit to load at a low level and hide itself and often hide other malware from checks for its existence. So say you were duing a scan in the Windows environment while a root kit was running (active) in the background that root kit is going to change the data that gets reported back to the scanner program so that scanner reports all clean. This is one reason why I suggested running some offline scans like Avria Rescue CD and Dr. Web Live CD because they run outside of Windows and the root kit therefore isn't loaded so it can't hide itself.

Some antimalware software works better in the Windows environment while the malware is running such as MBAM it works better in normal mode than it does even in safe mode where some of the malware may not be active. Speaking of animalware programs running in Windows did you try running Combofix?

Have you tried OTL by oldtimer instead of Hijackthis? From what I have been reading I think most people here have made the switch to OTL, it provides so much more than Hijackthis. I just wish someone would develop a reader for the OTL logs like the online Hijackthis log readers.

It maybe a false positive but how long does it take to replace a file compared to doing a N&P. If fixing it means doing a N&P than that is what has to be done, but I guess I'm just one of those people that likes to find out why something is not working and fix it and also I've heard "wheres my icons I had them all right here in the middle of the screen" or "wheres my background" or "wheres my screensaver" that I don't want to change anything I just want to remove the malware and go.

One other thing I was wondering in your OP I noticed you mentioned "Avira Free (same results with AVG)" and "Neither AVG or Avira find any issues" there's not two AV's installed on this computer is there?

 

[Martyn]

Install and run Wireshark. Do a capture and check the dns query and see what is happening there and with the other packets going in and out of the nic.

 

[numnutz]

just wondering, is this pc in your shop or onsite? if onsite how many other computers are on the network? any other similar issues on their network pc's? try resetting the router to factory default.


just re-read your first post guess my suggestion does not apply

 

[allanc]

Couldn't you just boot to a recovery console or Bart disk and expand a fresh copy off the install CD?

I just had a system with an infected userinit.exe and that's all I needed to do.

Bingo!
Replacing the ACPI.SYS with that from my XP SP3 computer fixed the problem of not being able to access www.google.com!
Thank you so much.

 

[allanc]

What I was meaning was that it is a basic function of a root kit to load at a low level and hide itself and often hide other malware from checks for its existence. So say you were duing a scan in the Windows environment while a root kit was running (active) in the background that root kit is going to change the data that gets reported back to the scanner program so that scanner reports all clean. This is one reason why I suggested running some offline scans like Avria Rescue CD and Dr. Web Live CD because they run outside of Windows and the root kit therefore isn't loaded so it can't hide itself.

Right.
I was not grasping how 'intelligent' a rootkit could be.
Lesson learned.

Some antimalware software works better in the Windows environment while the malware is running such as MBAM it works better in normal mode than it does even in safe mode where some of the malware may not be active. Speaking of animalware programs running in Windows did you try running Combofix?

Yes, I ran it in normal mode and nothing extraordinary was found.

Have you tried OTL by oldtimer instead of Hijackthis? From what I have been reading I think most people here have made the switch to OTL, it provides so much more than Hijackthis. I just wish someone would develop a reader for the OTL logs like the online Hijackthis log readers.

I looked at their Web site but did not spend a lot of time on it, yet.
Do you know of any in-depth tutorials?

It maybe a false positive but how long does it take to replace a file compared to doing a N&P. If fixing it means doing a N&P than that is what has to be done, but I guess I'm just one of those people that likes to find out why something is not working and fix it and also I've heard "wheres my icons I had them all right here in the middle of the screen" or "wheres my background" or "wheres my screensaver" that I don't want to change anything I just want to remove the malware and go.

Agreed. I am not a 'nuke & pave' type of guy

One other thing I was wondering in your OP I noticed you mentioned "Avira Free (same results with AVG)" and "Neither AVG or Avira find any issues" there's not two AV's installed on this computer is there?

No, I only had one installed at any given time.

 

[B Trevathan]

I'm glad you fixed it without having to N&P, to me it seems finding the malware and replacing the infected files is a lot more interesting than just doing a N&P that is why I suggested it:

from the recovery console replace the file that the Avria Rescue CD found as a rootkit before N&P everything

I know that doing a N&P would proably make it more secure but it just seems fixing it that way would be so boring.

Now that the root kit is not running it can't hide malware anymore, have you done any more checks. In the future you might want to run anti root kit programs as one of the first things you do in malware removal, they don't take very long for example TDSSKiller only take a few minutes, by the way does it still result in a BSOD?

I looked at their Web site but did not spend a lot of time on it, yet.
Do you know of any in-depth tutorials?

From the geekstogo website: http://www.geekstogo.com/forum/topic/277391-otl-tutorial-how-to-use-oldtimer-listit/

A complete and detailed OTL tutorial has just been made public. It has been available to experts and forum helpers for some time. While most people will never use all the features of OTL, or only use it to create a log, others will find all the information offered in the tutorial helpful.

 

[allanc]

I'm glad you fixed it without having to N&P, to me it seems finding the malware and replacing the infected files is a lot more interesting than just doing a N&P that is why I suggested it:
I know that doing a N&P would proably make it more secure but it just seems fixing it that way would be so boring.

Correct.

Now that the root kit is not running it can't hide malware anymore, have you done any more checks. In the future you might want to run anti root kit programs as one of the first things you do in malware removal, they don't take very long for example TDSSKiller only take a few minutes, by the way does it still result in a BSOD?

The TDDSKiller is near the top of my list.
When it resulted in the BSOD I resorted to Gmer (which takes longer).
Gmer was clean.

After removing the rootkit, TDDSKiller ran to completion (no BSOD) and was clean.

From the geekstogo website: http://www.geekstogo.com/forum/topic/277391-otl-tutorial-how-to-use-oldtimer-listit/

I will read this.
Thank you.

 

[ZenTree]

Congrats on finding the culprit

I've been using rootkithooker alongside gmer and tdsskiller recently as the latter two keep getting hooked themselves by the rootkit. Rootkitunhooker seems able to see this and then you can unhook your rootkit scanner.

Things are getting far more complicated these days

edit: but weirdly I can often not clear a rootkit with just rootkitunhooker, probably just need to learn more about it though.

 

[allanc]

Congrats on finding the culprit

I've been using rootkithooker alongside gmer and tdsskiller recently as the latter two keep getting hooked themselves by the rootkit. Rootkitunhooker seems able to see this and then you can unhook your rootkit scanner.

Things are getting far more complicated these days

edit: but weirdly I can often not clear a rootkit with just rootkitunhooker, probably just need to learn more about it though.

I will add rootkithooker to my kit.

Thanks to all for their assistance.

 

[Xander]

Originally Posted by eHousecalls.ca
Couldn't you just boot to a recovery console or Bart disk and expand a fresh copy off the install CD?

I just had a system with an infected userinit.exe and that's all I needed to do.

Bingo!

Replacing the ACPI.SYS with that from my XP SP3 computer fixed the problem of not being able to access www.google.com!
Thank you so much.

Wooooooooooooooooooooo!

Edit: What do you do when you think a part might be bad? Two words: Known Good.

 

[allanc]

Wooooooooooooooooooooo!

Edit: What do you do when you think a part might be bad? Two words: Known Good.

Of course, I agree.
However ... like I said above ...
I assumed it was a false positive because I u/l to virustotal and all of the virus checks were negative.