Well hidden redirect virus...

[jaberwacky]

As the title suggests I am trying to remove a particularly well hidden redirect virus on my sister's computer. I looked to see if IE were set up to use a proxy, performed a malwarebytes scan, and a MSSE scan. I looked through the program files and other various folders for anything suspicious. Anyone care to hint how I might find this malware?

Oops, forgot info: Eee PC, WindowsXP 32, need more?

Edited September 3, 2012 by LaCastiglione

[dany]

You could try HijackThis and submit the log at their forum for analysis.

[jaberwacky]

Great Scott! I'll try it now. Thanks.

[kaotkbliss]

I can't remember what I had used on my GF's pc not that long ago, but it led me to check the partitions on her HDs

Sure enough, there was a seperate 10MB partition on the main HD that was set to active and boot and this is where the virus resided.

I had to delete that partition, re-adjust the old partition, then reinstall windows to fix it to boot correctly.

[jaberwacky]

Oh sweet geebus. I hope that aint it but thanks for the heads up!

That reminded me that when this comp boots up it says "Atheros boot agent". That might be it. Never heard of this Atheros stuff.

Edited September 4, 2012 by LaCastiglione

[kaotkbliss]

Just googled Atheros boot agent, apparently it's for wireless laptop cards.

[dany]

Atheros is the company that produced the wireless chipset. I've got an Atheros WiFi as well, but Atheros boot agent is afaik only common in Linux distro's... WindowsXP 32 you said? I'd definetely check this out.

[jaberwacky]

I have three partitions on this machine. ONe is the C: drive that we all know and love. The other two are an unlabeled EFI system Partition and the other is an Unknown Partition labeled PE. I think these are common on the Eee PCs. Could there be hidden partitions?

[jaberwacky]

OK, Power Quest Partition Table Editor says that the c: drive is the boot drive. So, I think the problem isn't due to a malicious partition.

[jaberwacky]

ComboFix.exe has taken care of the issue. It was suggested that a rootkit had taken hold of the computer but I'm not sure since I didn't go through every line of the log file! Thanks for the suggestions!

[jaberwacky]

Nope, no it didn't. Oh well. Will pick back up later on.

[jaberwacky]

Nope, back again. Seems like combofix really did root it out. I reinstalled Firefox and it hasn't happened in a while. So here's to hoping.

[trancexx]

Redirecting to what, if it's not secret?

[JohnOne]

Certainly does just sound like a browser hijacking.

Did you even run hijackthis?

[jaberwacky]

Certainly does just sound like a browser hijacking.

Did you even run hijackthis?

Yes.

Redirecting to what, if it's not secret?

The websites were different every time.

[JohnOne]

How about posting your logfile?

[jaberwacky]

How about posting your logfile?

Because I went through it and nothing stood out. Besides, I think the problem has been fixed. Thanks for offering to research my logfile though. I really do appreciate it.

[Chimaera]

Have you run Spybot Or Avira Antivirus both are fairly agressive.

We generally run spybot scans with malwarebytes to get the stubborn ones

[Tripredacus]

I can't remember what I had used on my GF's pc not that long ago, but it led me to check the partitions on her HDs

Sure enough, there was a seperate 10MB partition on the main HD that was set to active and boot and this is where the virus resided.

I had to delete that partition, re-adjust the old partition, then reinstall windows to fix it to boot correctly.

I fixed an XP system with that type of virus about a month ago. This particular one eventually replaced his shell with some FBI warning screen, and the Safe Mode shell led to a false 0x7B stop error. I ended up removing it mostly from WinPE, but checking the registry's Shell item, as well as some items in Startup. Then I found all the files and deleted them all. After I was able to get into XP again, I only used HJT and Malwarebytes until it was gone. I didn't do anything with the 8MB partition (it was empty) so I just left it.

[Emiel Wieldraaijer]

I use the following utils

TDSSKiller

Combofix