Malware causing browser hijack [Solved]

• Go to Start->Run and type in notepad and hit OK.
• Then copy and paste the content of the following codebox into Notepad:
  
  

  @echo off
  copy /y C:\I386\IASTOR.SYS c:\
  del %0

• Save the file to your DESKTOP as "fix.bat". Make sure to save it with the quotes.
• Once saved, the icon to click should look like this on your desktop:
  
  
  
• Double click fix.bat. to run it. A small black box should open and close - this is normal.

• Restart your computer.
• Before Windows loads, you will be prompted to choose which Operating System to start.
• Use the up and down arrow key to select Microsoft Windows Recovery Console
• You must enter which Windows installation to log onto. Type 1 and press 'Enter'.
• At the C:\Windows prompt, type the following bolded entries, and press 'Enter' (note the spaces):
  
  cd c:\windows\system32\drivers
  ren iastor.sys iastor.old
  copy c:\iastor.sys c:\windows\system32\drivers
  exit
  
  You should see a message '1 file copied'. If you did not see that message, try again and ensure there is a space after the word copy and another space between the file paths.
  (if you do not see 1 file copied on the screen, even after ensuring the commands are correct, rename the file back to it's original name by typing the following command then hitting Enter.
  ren iastor.old iastor.sys
  you should NOT be prompted to overwrite an existing file, but if you are, select No then type exit to restart and notify me of your results)
  
• Type exit and press 'Enter'. Your computer should reboot. Boot into Normal mode.

• Double click on ComboFix.exe & follow the prompts.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
• Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.
  "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v
• If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
• When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  

  :filefind
  *iastor*

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  
  
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

Edited by CatByte, 20 December 2009 - 07:18 AM.