[Closed] IE being hijacked on load up to fake google site

Hi

When I load up IE which has a default home site set at Google it gets immediately re-routed to a fake google site as follows;

Link removed: LDT

Have run adaware, pctools spyware doctor, malware bytes antimalware all to no avail. Cannot get ride of it.

I am running sophos and have as my freewall Zonealarm

Have uploaded the hijeck this file.

Is this dangerous and can any one help

Many Thanks

NeilD

Hello and welcome to

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I am checking over your HJT log now, I will post back shortly with instructions.

Hi neild


First you will need to disable Spybot's Teatimer before we begin, as it will interfere with the fix.
To do this can you start Spybot and go to the Mode button and select Advanced.
Go to Tools > Resident and uncheck the box next to Tea-Timer.
Make sure that the icon in the system tray is no longer there.
If it is, just right click on it and select "Exit".

Do the same with Window's Defender:
Open Windows Defender >Tools > General Settings
Scroll down to Real Time Protection Options
Uncheck Turn on Real Time Protection (recommended)
After you uncheck this, click on the Save button
Make sure that the icon in the system tray is no longer there.
If it is, just right click on it and select "Exit".


NEXT

There is a file on your system I would like to get analyzed:

• Make sure to use Internet Explorer for this
• Please go to VirSCAN.org FREE on-line scan service
• Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
  
  
  • c:\program files\google\googletoolbar1.dll
• Click on the Upload button
• If a pop-up appears saying the file has been scanned already, please select the ReScan button.
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
• Paste the contents of the Clipboard in your next reply.

NEXT

Go to Start> Control Panel > Add/Remove Programs

A list of installed programs will populate

locate the below noted program ( if it is there) and select REMOVE

Linc media player

close Add/remove programs

Next

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
• Please click OTMoveIt3 and then click >> run.
• Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg

:Files
C:\Program Files\Linkmediaplayer
C:\Program Files\screensaver

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot

• Return to OTMoveIt3, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt3

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


Next

* Open HiJackThis
* Click on Do a system scan only
* Check the boxes next to ONLY the entries listed below (if present):

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Lincmediaplayer - {fbaa6932-b59b-4854-8041-27a233394ba3} - C:\Program Files\screensaver\screensaver\adxloader.dll
O3 - Toolbar: (no name) - {b6bb2c0a-8d74-4664-a1cd-103bd9a69de9} - C:\Program Files\screensaver\screensaver\adxloader.dll

* Close all windows except Hijackthis and click Fix Checked
* Click Yes when prompted
* Close HijackThis.

Next

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————

Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


In your next post I need

• Confirmation of program removal from add/remove programs
• DDS reports
• OTMoveIt log

• Please also describe how your computer is running now and any other issues you may be having.

Hi Thanks for your help. Have done as asked and - Linc Media player not there when I accessed add/remove programs in control panel - all reports attached in ZIP file - (was it OK to use ZIP rather than cut & paste) - Computer seems to be running fine now and more importantly when I access IE, it just comes up with normal Google page, not fake !!!!! FMI which progream caused this to happen so I can ensure doesn't re-occur ? Very impressed by you guys Thanks NeilD

Hi neild,

Things are looking much better,

FMI which progream caused this to happen so I can ensure doesn't re-occur

C:\Program Files\screensaver\screensaver\adxloader.dll

This was the offending program, which OTMoveIt3 removed -

I suggest you decline any offers of "free screensavers" as they always come bundled with adware/spyware.

NEXT

I suggest you do the following:

Please download Malwarebytes' Anti-Malware

• Double Click mbam-setup.exe to install the application.
• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


In your next response please include

• MBAM Log
• Fresh HJT log
• Advise how your computer is running now.

Hi neild How are you getting on? If the instructions are unclear or you have other issues please advise. Absence of symptoms does not necessarily indicate there are no further problems. We had some remaining cleanup to do,,,,,,

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log