Google redirects, cmd.exe and regedit don't work, can n
by rd25
10 months ago

Hi,
I can not run cmd.exe and regedit.exe and can not update Antispy software. Additionally earlier I could not stop rasman.dll service. This is remote connection service. Now I have blocked it using firewall software. When I search(google or yahoo) in the browser window and click on the results I am redirected to some other site.
Here is firefox history on how the Google redirect works.
First line is google query
http://209.85.171.80/x/?i=g0ccb403911eed1705a572468ddae0503eZm9ydW1zLnNweWJvdC5pbmZvL3Nob3d0aHJlYWQucGhwP3Q9MzE3Ng==

http://c.incomeppc.com/?d=rAbyIZzhtmtD_PPxM4lkfD9mFO5WFAuWJP8w9w3jfeORsCkRzxhK1SIqsnddAjtyFqltVXWAo86P_fiQws_u0s9Q4UaTLltXPWRiRDeUq9Vm_dkpLSYiz8F3l7G37cUiwAaha382xtzSXRPXpctaXZxbYQWr-SdxTpctDs_StxQFGOWFyhFvkXvRZxojq5RjRJIL2uQM4WLoL9pquqgsH9eIESJCl1naogj-SgMosFw4nl3iQ-eBKBGhCO_er76JLObZf6hyI5EyrGXAksDn1IbENj5ZzWywoe7I4QSaURwLnt6AyTSkPovPDgsKs03hV7memu3AcxfCj8JY4tHH-mGqnp7rcyQ_UUaidp7gQpEUm1mlcuLzp182SQ7ZlezJ1joZ4Lb-3hI9bcI6-dm5Nfyjtb5qq9c7i3pfqAeubQXN7cbBsI6D40QeMx3NkqNArghPZ7rHsrSUc_zrutl-rAAgiaNMs7feA89yTi9S9lL9BM2COG2u5FC-f5hYBHrb5jAUUXVHxSryyIx0Ie9JTBh0sGaBGvGkNso718SXmdz5SxAoaJQqp45d7DIue_w20xzM7FjtdtXtsrDcpl1rJ_1Uv-QUVcRS5tMmJIxDbZYQXw-C0DqlvpN6PH4wC5vtL74Yya7dGHBMo_dB2U39gjMiGb5UbjaaH8CHIuaqp-0OLmsuud6uHG00JvoTBmikhFMuhbA8H-wwICZkvN97ftiGZYHjCXdazGh2tJMjhfGKnc5SiwlV9Se5GmOanofePWXBIUbqTvuc12fklP4bOkaKRxdw21Zfl_XEBDJ3OtWabGErU5MY-zhinRKsC86tyhBejfz288WeiBXGuKGl6gM6lchWXy6aCYe6Ajqez7CPKgugy7VLNvx3x1f4ayQugXGIzdph7cXEGeZ3TK0kMABGah5FqIRVA96aqD3Npjm7KZfTkxKAL3FCdhBJGmUXinAqJw1hNGmVTUgejXyTRHlYuqs0XOk8VKfAe3nheNQPRYDspWa48O20owL8etQ0BDCSF1ahGIEblGh1MJbQ8kb11vrc81gO4bl-CFdSURTR2SCj53O6NdIuLpn7dDDpCUBiVic9jaXr0YoryJhD9cKevTUBso8cYsZw8CgRexOi1ddOaykUlobOSPhJi97RfI-zK3Riwqx63HhXFICpM2P44I2P0CVaWx1JStoEWYzUQ-pIS3N-C4MH0eHyel02_g2iHGDfqM4e4VJ5o0vTzSiy4ZegY-Arnyklp5gwldznYFYKIl36ZE0zUv47Jr3DmWLC1zLGtAI7jBJzfXI6SL-wE8wvG7k8qCgfYY_9WZRsvAtCMCjC5Bz2HscQ8D9QC9YTo5hjsIfXno23cw1ob74Ggq6LRig7vNa56dyNXpMsXo-umIPZYtjhGnj4L6eb7jEq7ygZJPUzTH8cakVE8EXPATrfXUXJWcwU_jRoSfYA-=-=-AmLhBF4kAv4kAGpiLl5jnUN/p3jlZwLjsQI8ZwDkZUkwLJ5ho3DtpaIhVTAgMPOlMJqyMTy0sQRjZGL3AKj1sQO8ATRjL2HmZwW8AGt1AGIxZQq8ZUj1ZJMwLmquA3j0AmuvLzH2L3j0p2IupzAbqTyjpl5ipzp=-=-=-2b00cdb7a76d

http://76.9.16.157/c.php?s=eNolVMmugzgQ_CCkZ4yxsQ9zSB5JSNhJWC8j9j3wsrBEfPxEmkuX1FVdfaqqNwglSdygIKJNb86C_svDjf_h0f9D4HnGYygKCJEvEQrHd9Iz_qxcYFLvm8S3y7T37pHvjNnun382kgmFKECKcpgnKMkoLDJe-FqkGcpgQf_FgkDSTBJSluSixKiEMkbwd5EwEWVY2hDZ4JYbY9cdhdtfU9rVRFWPy1anbtw-FtZbfSj4ay3vD-rOXOTuPB_re76WYBoMs6ulV5RleTKNxfQa1VoRAw5MmJljbr7V4DFnHEjYag6NlGFxCbiCQtfXf03uI7zrzh3NpksPw8WL4gUU-zTdac7eplD_HHnvqc7tDcRHz1zyphYmc182FD7MyrmW1wbM4Yo-3uV9opV6-qz5Aslwgo5dd9p7v3csdNrhoDKA7poOfV6Q40DrZk3AxdANetuCM7eUfeFHp_mehgy-eNNtvnAZf7srN89lGv9F9yY9OZ2PBT2h5SP-s5uLOUeo5wNHHKIUkFellVk0Vr9WGOu0fTnOTiTxAfb718FKzqm5FkNbnWDdc45q7QVhr_j20kmZ7SwgqgKgfeQpcy1eW_1Hi-DHIpEF5gZzWVkQoMLDKj-P0QdyicA6CU4jP5igY74Lln7qTUOZb_qO2H39twZvTo5HownnU8PUVhndc-0BYzfhhq6hUT00WibGOzvxuSZhuoN8U-jjVPMxiA97sgvTMLUwPKqnmTu2gWZwusTXap5FvjyI9Fr5TzBnabsrCJKOVHodGihp12sxyC4oBxnXEkqj21Msy_KROQW3BgJnoTReH5ZL-muvaEXfP86gluOrwsm288JrvOKThXTy6tZ6ypuJKl6nPLr6Nwdrm7PCXthtl7IYAik3k1s4nlDhtKTVmqcu7pKRTrM3GX0xZNOTnu5SdVEIN96ndQ3Acwz7XMsGxkXNY3SPquOWTzHKvaNdWj1uATzIGHtrwKlGEUyLhdf0KBx8IXsNr3aurADCELQfcJn48B20bjY8rgD0OQPFS1nuTVRoyTu1ZWoD8xo11iep81tB4oy-PSqFHEGE2FPw53B6AqVhYca7qQQcPHOvIvp9wnKe0LbelWuQ9pXriGHOfb8pLfMj8PtErkBv1qqBnlxHyboBFCuWv97EsV-mX3Evjdk63UuKSVPcZ2C44V2C0PInJk1WFgbRJLmHD-cVF3A-P4ZU0rUlry02_t2vUTQsdZ4r4IW5b0iGmFvl4MrtL-Nealxyc5tjyqmaLSLXVy36MR0mHi47We3QzJYP1mYTgNV7wOWmsKV6FY-jR8jiT7x8dPtsLL_9JMEfiNgPZPwP5Om2UfpD8Q9DP9LGb5uwfVsKab23pj1bo74Ttd6YEvt7iAn56qlAKcZfKb-hzVCMLgwuTaw4Y6ro7wRd7ltMWCHmGU8pnxIR8RKCNGesKHKWJpjH_wEbFsLN

http://76.9.16.157/c.php?re=1&r=eNolVMmugzgQ_CCkZ4yxsQ9zSB5JSNhJWC8j9j3wsrBEfPxEmkuX1FVdfaqqNwglSdygIKJNb86C_svDjf_h0f9D4HnGYygKCJEvEQrHd9Iz_qxcYFLvm8S3y7T37pHvjNnun382kgmFKECKcpgnKMkoLDJe-FqkGcpgQf_FgkDSTBJSluSixKiEMkbwd5EwEWVY2hDZ4JYbY9cdhdtfU9rVRFWPy1anbtw-FtZbfSj4ay3vD-rOXOTuPB_re76WYBoMs6ulV5RleTKNxfQa1VoRAw5MmJljbr7V4DFnHEjYag6NlGFxCbiCQtfXf03uI7zrzh3NpksPw8WL4gUU-zTdac7eplD_HHnvqc7tDcRHz1zyphYmc182FD7MyrmW1wbM4Yo-3uV9opV6-qz5Aslwgo5dd9p7v3csdNrhoDKA7poOfV6Q40DrZk3AxdANetuCM7eUfeFHp_mehgy-eNNtvnAZf7srN89lGv9F9yY9OZ2PBT2h5SP-s5uLOUeo5wNHHKIUkFellVk0Vr9WGOu0fTnOTiTxAfb718FKzqm5FkNbnWDdc45q7QVhr_j20kmZ7SwgqgKgfeQpcy1eW_1Hi-DHIpEF5gZzWVkQoMLDKj-P0QdyicA6CU4jP5igY74Lln7qTUOZb_qO2H39twZvTo5HownnU8PUVhndc-0BYzfhhq6hUT00WibGOzvxuSZhuoN8U-jjVPMxiA97sgvTMLUwPKqnmTu2gWZwusTXap5FvjyI9Fr5TzBnabsrCJKOVHodGihp12sxyC4oBxnXEkqj21Msy_KROQW3BgJnoTReH5ZL-muvaEXfP86gluOrwsm288JrvOKThXTy6tZ6ypuJKl6nPLr6Nwdrm7PCXthtl7IYAik3k1s4nlDhtKTVmqcu7pKRTrM3GX0xZNOTnu5SdVEIN96ndQ3Acwz7XMsGxkXNY3SPquOWTzHKvaNdWj1uATzIGHtrwKlGEUyLhdf0KBx8IXsNr3aurADCELQfcJn48B20bjY8rgD0OQPFS1nuTVRoyTu1ZWoD8xo11iep81tB4oy-PSqFHEGE2FPw53B6AqVhYca7qQQcPHOvIvp9wnKe0LbelWuQ9pXriGHOfb8pLfMj8PtErkBv1qqBnlxHyboBFCuWv97EsV-mX3Evjdk63UuKSVPcZ2C44V2C0PInJk1WFgbRJLmHD-cVF3A-P4ZU0rUlry02_t2vUTQsdZ4r4IW5b0iGmFvl4MrtL-Nealxyc5tjyqmaLSLXVy36MR0mHi47We3QzJYP1mYTgNV7wOWmsKV6FY-jR8jiT7x8dPtsLL_9JMEfiNgPZPwP5Om2UfpD8Q9DP9LGb5uwfVsKab23pj1bo74Ttd6YEvt7iAn56qlAKcZfKb-hzVCMLgwuTaw4Y6ro7wRd7ltMWCHmGU8pnxIR8RKCNGesKHKWJpjH_wEbFsLN&u=d5e57906e0f435e3b0d5ecf5af1de699&cid=84c592afd3501ba2948b3ab3d1f34f3a&rc=0&pa=&ref1=&ref2=

http://feed.ndot.com/clickn.php?fb=aSlAXz5iW2g%20bWcxRGJDaDBQUztpUGR6RG1bej5tdXE%20YltoPm1nMURqMC0wJGQmOEJDWkRtW2g%20bXUxRG1EWT5gJTFHaEBZOGBDWWkkMGpSVkQjOGhAQj5ZRF8lbWk6diksWT5gJTFHaEBZbk4taFJ4Py8wVkQjOGhAaCVtQFlpQmRqPiksID4kZG1pKURGPil4ajApRDZHKXpqR2hhRjApYTolbVI7PkklWT5gJTE%20SUBZaUJGL2lCWyZRJGFZPmAlMSVoRDFEbWRqaW1hXyVtdUIwKWloJW1hOiVJUi0wJGQtaW1hXyVJLDowJCxgMEk4aERtW2g%20bTsxRGpGLzhgZCZSTi1bMEpEIzhoQEY%20KUBZJW1%20Oj5KWjpHSlpGR1Z%20XyVoQGhHbUA6JVZEIzhoQGg%20WVM2OGo6WT5gJTFHbSwxRGp6WlInfjF2Xz9GUiR4IlEkUy8wViAtOGJTalFQZ0VRTj86dmpHIlEkR2VpanhFUV8gRTBQYUxYYGQvMEk2PmR1OEZhJGFGZENTSlM7LXVYKXVGR2g4WkRtW2g%20bWExRGpbOjhOO1k%20YCUxR21AWT5JRHE%20SSw2RG1baD5tRDFEai07RG1baD5tLDFEbSxCR21%20cURtW2g%20bTgxRGpbLXJQUkw4amFZPmAlMSVtRDFEakd6bmogTFJWMl9SJHFnaUI2O0QnUy0wQkM7UVBhWT5gJTElbUBZUVB%20WT5gJTElKWExRG04RnZtdWg%20SnFGPil%20RSUpfnFEbVtoPm11Xz5ZU21uYENFUidTIFBCR0wwTixZPmAlMSVtQFlDQyVZPmAlMSVoQFlpJDBqRG1baD5tLDFEbXVGR2g4WkRtW2g%20bWkxRGJHNmlqeGowWUQjOGhAWj5ZREYlbWFoRG1baD5tJTFEalMvMFZEIzhoQEY%20WUQ6RG1baD5tODFEajZ6cng/bThOJVk%20YCUxJSlAWSVWRCM4aEAgPllTalFQei0weD9tOE4lWT5gJTFHSUBZJVZxOiVfRCM4aEBCPllTbWkkR0AwJGFZPkI7MSVJW2g%20bXVoPllTejAnMC04YmQvOEJDX1BCLTtEbVtoPm1hMURtdV9HKTtZPmA2aD5tJTFEajY7R0pEIzhoQGglbUBZPil%20Rj5JQ1lHJFNtR0JpOj4kYWhpbWQtPiR1X2kpflpHSUdtJUJkOyUpOFk%20YFp9&b=MC4wMw==&p=MA==

http://qualibid.errfix.hop.clickbank.net/?tid=NDG1Ad1ERR&ID=11774&fb=aSlAXz5iW2g%2BbWcxRGJDaDBQUztpUGR6RG1bej5tJTFyYCUxJW1AWVEkYVk%2BYCUxPklAWUdJYXFHbThxJWg4WT5gJTElKUQxRGp4O1JqQ19STi1oMEM%2FLzBWRCM4aEA2PllENkdtaTo%2BVkQjOGhAWj5ZU2U4JzIvRG1baD5taTFEbWdfPklnNkdKRCMmUCUxJWhAWW4kYTZEbVtoPm0lXz5ZRDpHQnVaR0lnOiUkYWBpaGR6JSl%2BOiUpaUYlaHo7MCl1YEdoYSBpbTBtaV9EIyZhfX0%3D

http://qualibid.errfix.hop.clickbank.net/hop/?CBRehoppp2=http%3A%2F%2Fwww.errorfix.com%2Flp1.php%3Fhop%3Dqualibid&vend=errfix&code=000000000000000&affi=qualibid.ndg1ad1err&hfid=&parms=ID%3D11774%26fb%3DaSlAXz5iW2g%252BbWcxRGJDaDBQUztpUGR6RG1bej5tJTFyYCUxJW1AWVEkYVk%252BYCUxPklAWUdJYXFHbThxJWg4WT5gJTElKUQxRGp4O1JqQ19STi1oMEM%252FLzBWRCM4aEA2PllENkdtaTo%252BVkQjOGhAWj5ZU2U4JzIvRG1baD5taTFEbWdfPklnNkdKRCMmUCUxJWhAWW4kYTZEbVtoPm0lXz5ZRDpHQnVaR0lnOiUkYWBpaGR6JSl%252BOiUpaUYlaHo7MCl1YEdoYSBpbTBtaV9EIyZhfX0%253D&key=7F6D878E311685F123DE014AD148F329

It redirected me to errorfix.com.

I have found some of the IP addresses from above and who they belong to.
76.9.16.157 belongs to ISPrime, Inc.
Address: 300 Boulevard East Suite 100
City: Weehawken NJ

c.incomeppc.com is 88.85.93.34
OrgName: RIPE Network Coordination Centre
Address: P.O. Box 10096
City: Amsterdam
PostalCode: 1001EB
Country: NL

qualibid.errfix.hop.clickbank.net belongs to via.net
ViaNet Communications VIANETCO
IP addresses 209.81.0.0 – 209.81.63.255 Address:Palo Alto CA

Now I have noscript addon for firefox with XSS disbled for even google.com

Thank you.

by Kaleh
10 months ago

Can you get to any of the following to try scanning your system with several of them?

MS Malicious Software Removal Tool
http://www.microsoft.com/security/malwareremove/default.mspx

Windows Live OneCare
http://onecare.live.com/site/en-us/default.htm

Malwarebytes’ Anti-Malware
http://www.malwarebytes.org/mbam.php

Spybot Search & Destroy
http://www.safer-networking.org/en/download/index.html

LavaSoft Ad-Aware
http://www.lavasoft.com/products/ad-aware_se_personal.php

SuperAntiSpyware
http://www.superantispyware.com/
by rd25
10 months ago

Thank you for the reply. I have windows defender, lavasoft adaware, malwarebytes. But they show no traces of the malware. Also I can not update malwarebytes. Looks like I am a victim of the cross-scripting attack.
BTW: how to modify tag for the post? It looks messed up.

by Kaleh
10 months ago

It is a trial and error process to find a product that will detect and remove any specific problem. It is also possible that if you could get malwarebytes updated that it would be able to find the problem.

However, in the event that you can’t find this with a variety of products, you may want to go to a malware removal forum where they specialize in customized assistance.

As far as I know, you can’t modify your tags once you’ve posted, but I did that for you.
by Cometcom1
10 months ago

You’re not the only one seeing this behavior. I’ve had reports of this for a couple of weeks locally here in my country/town.

I suggest you try this little gem from symantec which is a registry fix as an inf file. This should reset your file execution parameters and allow access to registry tools and more. – The tool is made for Windows XP and earlier, and I have no clue if it will actually work or even install on the Vista systems.

http://securityresponse.symantec.com/avcenter/UnHookExec.inf

Download and save, then right click and select install.

Not sure if this fixes the problem, but you should be able to execute files/programs and perform registry functions after installation.
by rd25
10 months ago

Thank you. I will try it. Meanwhile I have renamed both regedit and cmd.exe and they are working.
by rd25
10 months ago

My antivirus software(Mcfee) doesn’t like Spybot. SuperAntispyware detected few cookies. I tried the symantec patch too. Problem is still there. So I am doing a backup and system restore. I have my OS on partitioned drive, so hope it works with minimal data loss. Thank you for helping me.
by Cometcom1
10 months ago

Couple of explanations:

RIPE is the european registry and address asignment organization.

88.85.93.34 points to Incomeproject B.V. Netherlands

This looks like a click for money scheme that has gone crazy. At least the domains/IP’s suggest that.

Try to get to some or all of the scanners Kaleh suggested and run these to clean up the PC.