Google Replacement, Redirect, and Spyware

[L337Weed]

Whenever I navigate to www.google.com.au, I see a site that SAYS it is google, but it isn't.

It looks almost the same as the new google, but this one is a bit older. For example it shows: Maps New! and the links are only just above the text. I also noticed some extra HTML stuffed into the index.

The following is for the google search form.

<input type=hidden name=tabs value="ca">
<input type="hidden" name="newwindow" value="1"/>

This makes it so that when I search, it takes me to a URL like this:
http://www.google.com.au/search?hl=en&hl=en&q=TEST&oe=UTF-8&um=1&ie=UTF-8&meta=&tabs=ca&newwindow=1
Disabled.

When i do a google search with this, it comes up with normal results. But if I was to click one, it would first open a new browser window and direct me to
[php]http://www.google.com.au/click?sa=T&ct=res&cd=1&url=http%3A%2F%2Fen.wikipedia.org%2Fwiki%2FAF&q=af&pid=0&u=aHR0cDovLzcyLjIzMy43NS4xOTMvY2xpY2sucGhwP2M9ZWI3MTFjNjgwZDdkOGVmMDcyNmYyYTY2MzMwMQ==&xr=[/php]Disabled. Obviously, the URL and some stuff changes per link.

That page redirects me to various others, before POSSIBLY being put through to the correct site. These are some of the URLs which I have been redirected to (in no order):
http://hitsearch.com.au/zwqo/search.asp?q=a&cCde=srch&sCde=7

http://64.5.219.20/yz/Monitor?enc=qJVkqWYflZIDacrZaQ9NstpfuRYH6SwKQMNelWnakzgVRAWwlByD%2Fhk460PP7A6ecg8Yd6NKaZJPpUxtovXY%2BSE3AZJkuIOtTN6QTRGN5ZAyt3mHjwetzpb3OSj8uFsHaVN4qQzj6jB3jSKvHtqRxZGzy2G7QA10JxtXamA7G%2FnbQO%2BtdB3mS3bK0QxRE9yiLIsX8ErV3v90B1AOX5i1sUX%2FSo0G88FaIUGfOgW8ybTc%2BFwEaH%2B5mnqx%2Fx%2BObCLeZy7j291heAg3BlzqrYzonhjgIL9ZomnDIJpiHhG1sbXrJhNqtug%2BWZ1qnZEh4txsPSmue0GMzGjiiRM2W0HGXFVNH0mfzD8DZHP%2BCaus7nRfd%2Bg7IZT7i8m7BoffpTI7Al%2FkZoqaWIsBbaqpGDft9sTIUIVhGxDUhnmg7mt5pExdLaiHi%2FcTCjsA7iFpDUxCGb3vZac2VYNi4Pz%2FFRTI70JjFDbgYROu9iuz2wo%2B31wK6VOOSD%2BlsCVqRHf3ZirUtwTIVDo5EUVcFvum%2BrpTlsoIprCrAaWvJMcrsrhhxuxyksltb6Oz4wGMNNsfAGktIOa617NxW%2FyG8yXXf69j6ZlKKl%2BUcxhjKL9ZyMtCNlVRX1T5cMRMUlHmrY8TJjBc%2FwYPxsxCsiD5MVgxRSRHRSuBlou%2F6awFXLkvky01gHMhRFkrw1KLJu74xkM6eZKzbh8wUmhnbGc%2BD2HEByOEFHTdxt%2BOxV7HR1m6Zky4yMkOW5x431LrcFlsUWLiQy8M2KZcBydKeR4MPOEmQRNw%2FcQHtMBBYP7f3YH13oyBqFcr8F%2BHePXZqhuuOv5fXtodeQ%3D%3D&geniecid=1388244354

http://btcar.com/search.cfm?pt=2&rpt=1&kt=1

http://72.233.118.68/click.php?c=e698d6400302e8b5f3a90d4f1a02&d=123514712782753

http://p.tribalfusion.com/popup.php?r=t%23g%23%7E4P%3EQ%7E%3E%408E%3EPQQx%3EeF%60%60%7E%27%60TQ%7En%60x%3EeEgb%7EgZ%7DxUnQ

http://c.globe7.com/popup.php?r=%7Exq%60TExxe%40%3B%7D64.%60e%23%604W%5DPQZ%7DxP%5DE%5C%3BeTUU%60ngnZ%27%274V%7D%5DPQ%26Q%27E%7EPgFx%7EZQ%23%3B%23Pe%60%7DEQ%23x%23

http://directorysearchlist.com/zwqo/search.asp?q=search&cCde=srch&sCde=7

http://www.freeindexsearch.com/zwqo/search.asp?q=combofix&cCde=srch&sCde=7
Disabled. It is obviously a marketing scheme.

I also cannot double click the icon of my C drive in My Computer, or I receive an error that a non-existent (to me) exe file had caused a win32 exception and wants debugging.

C:\RECYCLER>dir
 Volume in drive C is System
 Volume Serial Number is 6CE6-B0F3

 Directory of C:\RECYCLER

File Not Found 

I found the malicious exe "install" file which caused this. I have placed it at REMOVED and hope it helps.

OBVIOUSLY I RECOMMEND YOU DO NOT OPEN OR DOWNLOAD THE FILE UNLESS YOU KNOW WHAT YOU'RE DOING!!



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:35:21 AM, on 21/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Hide My IP 2008\SecureSrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\DOCUME~1\Michael\LOCALS~1\Temp\Saf6B.tmp\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1232209352740
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D5C6BE4F-035D-4D57-B44C-1CBE00D8430B}: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2.2 - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SecureSrv - Unknown owner - C:\Program Files\Hide My IP 2008\SecureSrv.exe

--
End of file - 7981 bytes

I forgot to add this..

I was browsing registry looking for recent changes and odd keys, and came across this.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer

Is this supposed to equal 85.255.112.39,85.255.112.40?

Don't worry about the Apache and PHP stuff.

------------------------------

"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

[Blade81]

Hi

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop. Post them back to your topic.

[Blade81]

Due to inactivity, this thread will now be closed.

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.