IE7 and Chrome redirect hijack


Ladies and Gents,



I would appreciate your help solving a problem with an XP laptop I have been asked to clean up. It was riddled with Malware and Spyware including various fake scanners asking the user to upgrade to pro.



I have been running malwarebytes and avg 2011 on it, which has shifted all but the redirect issue. I have followed the instructions on posting and have the various scan logs to show you. I was not able to download one of them as the bleepingcomputer website where the file is located is down.



I would be very grateful for any assistance!



J



Spec: Windows XP Pro, SP3, 1.6GHz AMD Turion, 2GB RAM, AVG 2011, IE7, Google Chrome



  
**GMER One**  

GMER 1.0.15.15530 - [http://www.gmer.net](http://www.gmer.net/)  

Rootkit quick scan 2011-02-04 10:27:45  

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort2 WDC\_WD3200BEVT-00ZAT0 rev.01.01A01  

Running: bjsos24r.exe; Driver: C:\DOCUME~1\HELENA~1\LOCALS~1\Temp\awliqkog.sys



  

 Disk sectors - GMER 1.0.15 



Disk \Device\Harddisk0\DR0 sector 10: rootkit-like behavior;  

Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;



 Devices - GMER 1.0.15 



Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8A4AB3E5  

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8A4AB3E5  

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort2 8A4AB3E5  

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort3 8A4AB3E5  

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-12 8A4AB3E5



AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )  

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)  

AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )  

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)  

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)  

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)  

AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)  

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)  

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)



Device \Device\Ide\IdeDeviceP2T0L0-3 -> \??\IDE#DiskWDC\_WD3200BEVT-00ZAT0\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_01.01A01#5&24cbc6ab&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found



 EOF - GMER 1.0.15 



  
**GMER Two**  

GMER 1.0.15.15530 - [http://www.gmer.net](http://www.gmer.net/)  

Rootkit scan 2011-02-04 10:43:37  

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort2 WDC\_WD3200BEVT-00ZAT0 rev.01.01A01  

Running: bjsos24r.exe; Driver: C:\DOCUME~1\HELENA~1\LOCALS~1\Temp\awliqkog.sys



  

 System - GMER 1.0.15 



SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xBA27A6C0]  

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xBA27A770]  

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xBA27A810]  

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xBA27A8B0]



 Devices - GMER 1.0.15 



AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )  

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)  

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)  

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)  

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)  

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)  

AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)  

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)  

AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )



Device \FileSystem\Cdfs \Cdfs DLAIFS\_M.SYS (Drive Letter Access Component/Roxio)  

Device \Device\Ide\IdeDeviceP2T0L0-3 -> \??\IDE#DiskWDC\_WD3200BEVT-00ZAT0\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_01.01A01#5&24cbc6ab&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found



 Registry - GMER 1.0.15 



Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit\_DLLs  

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15  

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000  

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes  

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk  

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90  

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000  

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@LoadAppInit\_DLLs 1



 Disk sectors - GMER 1.0.15 



Disk \Device\Harddisk0\DR0 sector 10: rootkit-like behavior;  

Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;



 Files - GMER 1.0.15 



File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\6WFH7ONI\google\_co\_uk[1].htm 0 bytes  

File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\6WFH7ONI\AdManager[1].swf 0 bytes



 EOF - GMER 1.0.15 



  
**Hijack this**
Hi, welcome to daniweb. Right of the bat I can tell you that this AVG2011 is **NOT** really AVG it is a new fake removal program, masking itself as the AVG anti-virus program.



You need to follow these steps, given in depth at  
<http://www.bleepingcomputer.com/virus-removal/remove-avg-antivirus-2011>



Reboot your computer into Safe Mode with Networking. To do this, turn your computer off and then back on and immediately when you see anything on the screen, start tapping the F8 key on your keyboard. Once you get to the black DOS screen use your arrow keys to go to Safe Mode with Networking. Hit Enter to boot the computer to Safe Mode with Networking.  

Once fully booted into Safe Mode with Networking you are going to have to end the processes that belong to AVG Antivirus 2011 and clean up some Registry settings so they do not interfere with the cleaning procedure. To do this, please download RKill to your desktop from the following link.



[http://www.bleepingcomputer.com/download/anti-virus/rkill](/posts/bad_link/1463811?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fdownload%2Fanti-virus%2Frkill)



(Download page will open in a new tab or browser window.)



When at the download page, scroll down and click on the click on the link labeled eXplorer.exe download link. When you are prompted where to save it, **please save it on your desktop.**



Once it is downloaded, double-click on the eXplorer.exe icon in order to automatically attempt to stop any processes associated with AVG Antivirus 2011 and other Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that RKill is an infection, do not be concerned. This message is just a fake warning given by AVG Antivirus 2011 when it terminates programs that may potentially remove it. If you run into these infections warnings that close RKill, a trick is to leave the warning on the screen and then run RKill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate AVG Antivirus 2011 . So, please try running RKill until the malware is no longer running. You will then be able to proceed with the rest of the guide. **If you continue having problems running RKill, you can download the other renamed versions of RKill from the rkill download page. All of the files are renamed copies of RKill, which you can try instead. Please note that the download page will open in a new browser window or tab.**



[http://www.bleepingcomputer.com/download/anti-virus/rkill](/posts/bad_link/1463811?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fdownload%2Fanti-virus%2Frkill)



**Do not reboot your computer after running RKill as the malware programs will start again.**



Next Update MBA-M and run a Full Scan with it, allow it to Remove Everything found.  

When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so. Once your computer has rebooted, and you are logged in, please continue with the rest of the steps.



Once the computer reboots to normal mode please again update MBA-M and run another Full Scan with it. If other files are found please have the program Remove them, Reboot again.



Next follow the instruction on our Read Me sticky for downloading and running the DDS Scanner.



[http://www.daniweb.com/forums/thread134865.html](/forums/thread134865.html)



After you have done that come back here and post the new MBA-M logs and both logs from the DDS scanner. Note, on of those logs, Attach.txt will tell you to Attach that log, please don't do that, please also copy/paste that log back here along with the others.
Hello Nanda, Basically you need to include the network drivers and the storage drivers.

+ You can find the drivers from Manufacturer site where you can filter the Category and download –

Like this – <https://snipboard.io/bQt5ER.jpg> this issue is now confirmed fixed by a large percentage of our user base. if you're still having issues, please make sure you on the latest version of malwarebytes (at the time of this article, it's malwarebytes 3.5.1.2522 with component package version 1.0.441).
 


 


 if you continue to have issues after that, please make a new post using the following as a guideline Hello, 
  

  
Try this 1 
  

  
Click on the below hyperlink "Download" and download the file 
  

  
**Download**
  

  
First backup your registry by following the below instruction 
  

  
Click on Start --> In search box, type regedt32 and press Enter. 
  

  
"Registry Editor" will be opened. Click on File --> Export 
  

  
Now extract the downloaded file --> Double click on that file --> Click on "Yes" 
  

  
Now restart your PC 
  

  
Good Luck Hi,
  

  
Try to use HDD Regenerator, it is free for the first bad sector, sometimes that happen due to hard drive failure in the PCB (board) or due to excessive heat inside the laptop and it damage the disk, I had a lot of clients with this problem and unfortunately the most of the times, we can not recover nothing because the surface of the hard disk is really damaged, I expect you can solve your problem. 
  

  
Andro Jesus.
  
<https://www.mileniumcomputers.com/> This is a site for helping people with computers, programming and networking issues. If you need assistance you need to provide as much detail as you can as we cover a wide range of knowledge. List your device, operating system like Windows, Linux or Mac, the program or application and any error messages. This will help us in getting  you a faster and more accurate response. We all have areas of different expertise , otherwise all we can provide is our best guess answer. You would be better off contacting Bissel for support. You may also want to check out YouTube.. They have lots of [repair videos](https://www.youtube.com/watch?v=56IPl2r-Wks) I had the same problem a couple of months back. Now if this is happening only with Chrome and not with other browsers, then the problem cannot be a virus. But it can be a virus if other browsers and programs are facing equal problems.  
  
So, with chrome as we all know there is a memory problem. So to solve that follow these simple steps.  
  
1. On the top right menu icon, select History  
2. From there select "clear browsing data"  
3. It will prompt for the time span, there you select "beginning of time"  
4. You might lose few data like saved passwords, favorites, but no data will be removed which are saved properly.  
  
After you are done with this, clean your system with Disk Cleaning Software. While doing this don't keep any browser window open especially Chrome.  
If you notice, it is skipping out the Chrome from the list, you have to select the program manually and click on "clear".  
  
After this restart your system and see if it works. If it doesn't then you have to undergo the entire process of uninstalling and re-installing Chrome. It seems that updating Windows 7 has become a task that tests our patience and is accompanied by many unforeseen events.
**If you have installed Windows 7 and you are not able to update it because Windows Update is constantly looking for updates, here you will find the solution.**




![image](https://technowikis.com/sites/technowikis.com/uploads/084/8408675506832124429.jpg)




The problem of the search for updates is accompanied by a high consumption of RAM and CPU that does not allow even a good use of the PC while looking for updates. The problem is with Windows Update and how Microsoft has implemented the updates.




Windows 7 does not update, it keeps looking for updates forever and finds nothing.




**The first thing you need to know is if you are installing Windows 7 32bit or 64bit.**
Once we have this information, we can begin the process.



 
Disable Windows Update to make the update process faster.



First
[we open a terminal with administrator permissions](https://translate.googleusercontent.com/translate_c?act=url&depth=2&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=es&sp=nmt4&tl=en&u=https://www.vozidea.com/abrir-consola-comandos-terminal-windows&xid=17259,15700023,15700186,15700190,15700256,15700259,15700262,15700265&usg=ALkJrhhqpP0r1As5JhHykWgqvcIjB7PXng)
to
**stop the Windows Update service**
with the command:
  

`net stop wuauserv`




![image](https://technowikis.com/sites/technowikis.com/uploads/133/13323206954024179447.jpg)



 
Manually install update KB3020369.



**Installing this update is an essential requirement to solve this problem.**
It is the first step and if we do not install this update first, we will not be able to follow all the steps in this tutorial.




We know that the error is generated by a Windows Update client error, which hangs when scanning new updates. Microsoft released a patch that solves the problem, but in order to install it, it requires that we download and install the KB3020369
*"April 2015 servicing stack update" update first*
:



* KB3020369 for Windows 7
**32bit**
:
<https://www.microsoft.com/es-ES/download/details.aspx?id=46827>
* KB3020369 for Windows 7
**64bit**
:
<https://www.microsoft.com/es-ES/download/details.aspx?id=46817>



Two options to finish solving the Windows Update error in Windows 7.




At this point we have two options:



* **Download and manually install updates KB3172605 and KB3138612.**
Once installed, Windows Update should work correctly and we could update Windows 7 without problems.
* **Download and install the KB3125574 package released by Microsoft with all security updates until April 2016 and that allows you to update a Windows 7 installation faster.**
This package occupies more than 316MB in 32bit systems and 476.9MB in 64bit systems.



Both options work correctly, but it is true that
**downloading and installing the cumulative update KB3125574 is a more convenient and faster process, so it is the option I recommend for most users**
. Even so, I will explain both options.



 
Recommended option, download and install the KB3125574 package released by Microsoft with all security updates until April 2016.



![image](https://technowikis.com/sites/technowikis.com/uploads/171/17135527325084971355.jpg)




This update package can be found through the
[Microsoft Update Catalog](https://translate.googleusercontent.com/translate_c?act=url&depth=2&hl=en&ie=UTF8&prev=_t&rurl=translate.google.com&sl=es&sp=nmt4&tl=en&u=http://www.catalog.update.microsoft.com/Search.aspx%3Fq%3D3125574&xid=17259,15700023,15700186,15700190,15700256,15700259,15700262,15700265&usg=ALkJrhgYZAtq0r4K4ryYk_7h4_sjeQs_-A)
or you can download it directly from the following links:



* Update package for Windows 7
**32bit**
:
[windows6.1-kb3125574-v4-x86\_ba1ff5537312561795cc04db0b02fbb0a74b2cbd.msu](http://download.windowsupdate.com/d/msdownload/update/software/updt/2016/05/windows6.1-kb3125574-v4-x86_ba1ff5537312561795cc04db0b02fbb0a74b2cbd.msu)
* Update package for Windows 7
**64bit**
:
[windows6.1-kb3125574-v4-x64\_2dafb1d203c8964239af3048b5dd4b1264cd93b9.msu](http://download.windowsupdate.com/d/msdownload/update/software/updt/2016/05/windows6.1-kb3125574-v4-x64_2dafb1d203c8964239af3048b5dd4b1264cd93b9.msu)



Once the system is installed and restarted, we can now run Windows Update normally that will detect the remaining updates without problems.



 
Alternative option, manually download and install updates KB3172605 and KB3138612.



Next
**we download and install the KB3172605 patch**
:



* Download for Windows 7
**32bit**
:
<https://www.microsoft.com/es-ES/download/details.aspx?id=53335>
* Download for Windows 7
**64bit**
:
<https://www.microsoft.com/es-ES/download/details.aspx?id=53332>



Finally,
**we download and install the update for the Windows Update client of March 2016 (KB3138612)**
:



* For Windows 7
**32bit**
:
<https://www.microsoft.com/en-us/download/details.aspx?id=51208>
* For Windows 7
**64bit**
:
<https://www.microsoft.com/en-us/download/details.aspx?id=51212>



**Now we restart Windows 7 and rerun Windows Update to search for all available updates.**
In my case it has been a little more than 20 minutes looking for updates until it finally allowed me to install all the updates. upgrade revit to 2018.3. that will fix it. Have you tried restarting your browser? sometimes one or both of these patches help, especially if the system is showing high ram and/or cpu usage when checking updates:
https://support.microsoft.com/en-us/kb/3050265




https://support.microsoft.com/en-us/kb/3102810﻿﻿
﻿