Ran Gmer.exe again. Amazingly, it behaved faultlessly (must have been the forced cold reboot following the previous freeze up).

I have added ark.txt to the original Attach.zip, which now contains 'attach.txt' and 'ark.txt'.

Aris

 

I have waited patiently for a week for a response to my original question:-

Is there a known tool or technique to detect and remove a piece of malware that redirects browsers to parking pages or link farms generated at i.nuseek.com?

I was hoping for at least one of the following responses:-

(A) Yes, we can remove the malware.
(B) Yes, here is a link to a solution...
(C) No, there is no known technique for this one.
(D) No established technique, each infection must be hunted individually.
(E) This is recent and new, and none of our helpers has any experience of it.
(F) This is recent and new, and none of our helpers has any experience of it - but we are willing to try.
(G) This is recent and new, and none of our helpers has any experience of it. Unfortunately, we do not have the capacity to explore new territory.
(H) The payload of this malware is nuisance only (i.e. nothing aimed at identity theft, or financial data detail).

Any response similar to one of the above would have been fine. As a systems analyst/programmer, I am used to making things happen on a computer and resolving any problems. In this case, I think I will have to accept that this topic will gradually drift into oblivion.

I will just have to wait until this malware has grown into a common and frequent infection...and solutions start to appear.

So be it.

Aris

 

Hello Aris,

What you're asking for, is not realistic. Unlike the programming world, the world of malware recognition and removal is not 'black and white'. It is fluid - ever changing. Take a look around this forum and you'll see we deal with it all the time, and in various ways.

There are many infections that can cause this problem, and depending on which one it is, there are commercial apps such as Malwarebyte's Anti-Malware that can handle it. But lately, for most of them, specialty tools are required - and sometimes in conjunction with MBAM. Again, this requires knowledge of what infection(s) are present - they rarely come alone. The initial logs we ask for, usually provide what we need in order to determine the tool of choice.

 

Thank you for your reply.

It is fluid - ever changing. Take a look around this forum and you'll see we deal with it all the time, and in various ways.

I appreciate that. I spent a considerable while browsing before deciding to join and post my problem. What I saw was a truly remarkable set of skills and experience in action.

I am an active helper in a technical forum for a C/C++ development tool, so am familiar with the steps from diagnosis to a solution. You guys are altogether on another level.

I even considered applying to join the TSF Academy, but that is full at the moment.

Back to my infections. Thanks to some blind luck events, I do not have active redirection at present, so presumably, there was insufficient evidence in the preliminary logs to provide a lead for the next diagnostic step.

If that is the case, it will be quite in order to erase or archive this topic, and I will post afresh if I get infected again.

If there were leads to follow in the preliminary logs, or you consider it worthwhile to pursue this case further, I will be happy to cooperate at whatever pace it proceeds.

Thanks again,
Aris

 

You're welcome.

No, I see nothing in your logs to suggest any problems at all. I do find it odd though, that you have absolutely no files or folders that have been modified in the last 90 days. Did you edit the report?

 

Did you edit the report?

Nope. You got all the logs as they came straight off the press.

However, I have no auto updates permitted for any package on my system, including Windows. There are occasions when I am forced into an update - Spybot definitions at the second malware infection, and from IE6 to IE7 by a frequently used website (but that was more than 90 days ago).

Everything works as I want it, and I am a firm believer in the well established principle "If it ain't broke, don't fix it.".

Mine is a working machine, and most of my time is spent in a development environment, creating, testing and debugging C/C++ packages.

Now, a shocking confession with a decades long history - I have no active antivirus packages. In fact, there are none installed (there may be remnants of bundled packages in the logs)..There are reasons for this, but I will not bore you with the details (another time maybe).

I do have a firewall, and have had one since they first became available.

Finally, my hard drive is partitioned. C:\ has nothing on it but Windows (and the odd package where the programmers did not allow choice of drive for installation).

No, I see nothing in your logs to suggest any problems at all.

Thanks for the inspection. So, the redirection malware is either very craftily hidden, or outside the inspection scope of DDS and Gmer.

In either case, I think that this thread is terminated, and I will have to return with an active infection.

We cannot mark it Solved - 'False Alarm' might be more appropriate. I will leave the disposition of the thread in your good hands.

Incidentally, the steps taken to get from an active malware redirection status to a normal behaviour status are pretty straightforward, even if they do not indicate how it was done or what actually happened. If you are interested, I can list the steps for your future reference.

Let me kniow, and I will send you a PM with the details.

Thanks again for your time and effort - very much appreciated.
Aris

 

Once again, you're welcome.

Everything works as I want it, and I am a firm believer in the well established principle "If it ain't broke, don't fix it.".

For the most part, this is a very good philosophy, but critical updates are just that - critical. As vulnerabilities are found in the OS, MS patches them and it's a good idea to download and install them. That could also be considered part of the 'tools' out there that protect the system. :wink:

I would very much like to know the steps you took. Often times, steps that are taken, or commercial apps that have been run are enough to knock down the infection for a bit which of course, keeps it from showing up in scanning tools that we use until it rears its ugly head again.

 

...but critical updates are just that - critical. As vulnerabilities are found in the OS, MS patches them and it's a good idea to download and install them. That could also be considered part of the 'tools' out there that protect the system.

I cannot argue with the logic of that. As a freelance software contractor, my clients all get an unmerciful and continuous nagging about backups, security, updates, caution with e-mail attachments, Office macros, ActiveX docs, etc., etc.

I would very much like to know the steps you took.

On the way to you in the next couple of days - I need to gather the precise details from the exchange of private e-mails that took place after the first infection in 2009.

Aris

 

Thanks, I appreciate the effort and time. :smile: