What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Google and Yahoo Re-directs

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
When I use Google or Yahoo to search for something I get good results. If I click on one it re-directs to some other site trying to sell me something completely unrelated. (I can cut and paste the link to see the google or yahoo result page.) I have cleared the cache and disabled some browser add-ons. I have run Spy sweeper and free AVG which found and removed some infections. But the problem persists. Any suggestions? DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 11:05:51.16 on Thu 05/13/2010 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_20 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1322 [GMT 2:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\system32\acs.exe C:\WINDOWS\system32\svchost.exe -k NetworkService C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe -k bthsvcs C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\AVG\AVG9\avgnsx.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\WINDOWS\system32\wentxp.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ASUS\Asus Probe\AsusProb.exe C:\PROGRA~1\AVG\AVG9\avgtray.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\POP Peeper\POPPeeper.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe H:\Data\Downloads\dds.scr C:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://my.yahoo.com/ uSearch Page = hxxp://www.google.com uDefault_Search_URL = hxxp://www.google.com/ie uSearch Bar = hxxp://www.google.com/ie uInternet Settings,ProxyOverride = ;*.local uInternet Settings,ProxyServer = 150.176.182.32:80 uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuz1.dll BHO: {048bafda-3580-4eee-a7a4-f6880e761cdc} - c:\windows\system32\dnssd32.dll BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: Windows Live Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - c:\program files\windows live\family safety\fssbho.dll BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuz1.dll BHO: QUICKfind BHO Object: {c08df07a-3e49-4e25-9ab0-d3882835f153} - c:\progra~1\idm\quickf~1\plugins\IEHelp.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll TB: LEC: {1dbab667-a486-421e-afe4-cf07dd0088e5} - c:\program files\power translator\applications\LEC IE Translation Extension.dll TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuz1.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [POP Peeper] "c:\program files\pop peeper\POPPeeper.exe" -min uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\dan\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [] mRun: [ASUS Probe] "c:\program files\asus\asus probe\AsusProb.exe" mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup mRun: [AVG9_TRAY] "c:\progra~1\avg\avg9\avgtray.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [NokiaMServer] "c:\program files\common files\nokia\mplatform\NokiaMServer" /watchfiles startup mRun: [SpySweeper] "c:\program files\webroot\spy sweeper\SpySweeperUI.exe" /startintray mRunOnce: [wextract_cleanup1] "rundll32.exe" c:\windows\system32\advpack.dll,delnoderundll32 "c:\docume~1\dan\locals~1\temp\ixp001.tmp\" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: Send to &Bluetooth Device… - c:\program files\belkin\bluetooth software\btsendto_ie_ctx.htm IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F54} - c:\program files\siber systems\ai roboform\RoboFormComClearFields.html IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\belkin\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll Trusted Zone: macromedia.com\www DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {2D337EB0-3BFB-42A3-B314-A24BBA8C085B} - hxxp://download.yahoo.com/dl/mail/yautoiol1.cab DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187595567843 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://213.96.236.73:8000//activex/AxisCamControl.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab Filter: text/x-mrml - {C51721BE-858B-4A66-A8BF-D2882FF49820} - c:\program files\common files\a&w\MidRadio.ocx Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: 6459bd1b899 - c:\windows\system32\dmusic32.dll Notify: avgrsstarter - avgrsstx.dll AppInit_DLLs: c:\windows\system32\dmusic32.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\dan\applic~1\mozilla\firefox\profiles\19d6pgzq.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms} FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/ FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&q= FF - component: c:\documents and settings\dan\application data\mozilla\firefox\profiles\19d6pgzq.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\FFExternalAlert.dll FF - component: c:\documents and settings\dan\application data\mozilla\firefox\profiles\19d6pgzq.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\RadioWMPCore.dll FF - component: c:\documents and settings\dan\application data\mozilla\firefox\profiles\19d6pgzq.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll FF - plugin: c:\documents and settings\dan\application data\mozilla\firefox\profiles\19d6pgzq.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll FF - plugin: c:\documents and settings\dan\application data\mozilla\firefox\profiles\19d6pgzq.default\extensions\[removed]\plugins\npNMapNPR.dll FF - plugin: c:\documents and settings\dan\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 FF - user.js: yahoo.homepage.dontask - true ============= SERVICES / DRIVERS =============== R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2008-8-9 29808] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-26 216200] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2006-11-10 29512] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-5-26 242896] R1 FAMv4;FAMv4;c:\windows\system32\drivers\FAMv4.sys [2008-4-9 97816] R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-5-5 308064] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-12-4 54752] R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\spy sweeper\SpySweeper.exe [2009-11-6 4048240] R2 WENCRNT4;WENCRNT4;c:\windows\system32\drivers\WENCRNT4.sys [2006-12-21 114944] R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\spy sweeper\WRConsumerService.exe [2009-3-16 1201640] S2 gupdate1c9d8c4a1f1518a;Google Update Service (gupdate1c9d8c4a1f1518a);c:\program files\google\update\GoogleUpdate.exe [2009-5-19 133104] S3 ADM8511;%ADM8511.Service.DispName%;c:\windows\system32\drivers\ADM8511.SYS [2001-8-17 20160] S3 ATHFMWDL;Atheros USB Wireless Adapter Bootloader driver;c:\windows\system32\drivers\Athfmwdl.sys [2006-9-28 43392] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864] S3 getPlus® Helper;getPlus® Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-4-7 33176] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064] S3 SCDELUXES;SiPix StyleCam Deluxe (still);c:\windows\system32\drivers\se402sc.sys –> c:\windows\system32\drivers\se402sc.sys [?] S3 SCDELUXEV;SiPix StyleCam Deluxe (video);c:\windows\system32\drivers\se402vc.sys –> c:\windows\system32\drivers\se402vc.sys [?] S3 siusbmod;siusbmod;c:\windows\system32\drivers\siusbmod.sys –> c:\windows\system32\drivers\siusbmod.sys [?] S3 STVqx5;Digital Blue QX5™ Microscope;c:\windows\system32\drivers\STVqx5.sys [2006-9-30 64512] S3 STVqx5m;Digital Blue QX5™ Microscopem;c:\windows\system32\drivers\STVqx5m.sys [2006-9-30 6144] =============== Created Last 30 ================ 2010-05-13 11:04 528,216 a——- c:\windows\system32\XAudio2_6.dll 2010-05-13 11:04 74,072 a——- c:\windows\system32\XAPOFX1_4.dll 2010-05-13 11:04 238,936 a——- c:\windows\system32\xactengine3_6.dll 2010-05-13 11:04 22,360 a——- c:\windows\system32\X3DAudio1_7.dll 2010-05-13 11:02 507,400 a——- c:\windows\system32\XAudio2_1.dll 2010-05-13 11:02 65,032 a——- c:\windows\system32\XAPOFX1_0.dll 2010-05-13 11:02 238,088 a——- c:\windows\system32\xactengine3_1.dll 2010-05-13 11:01 25,608 a——- c:\windows\system32\X3DAudio1_4.dll 2010-05-13 11:00 1,491,992 a——- c:\windows\system32\D3DCompiler_38.dll 2010-05-13 11:00 467,984 a——- c:\windows\system32\d3dx10_38.dll 2010-05-13 10:59 3,850,760 a——- c:\windows\system32\D3DX9_38.dll 2010-05-13 10:58 479,752 a——- c:\windows\system32\XAudio2_0.dll 2010-05-13 10:58 238,088 a——- c:\windows\system32\xactengine3_0.dll 2010-05-13 10:57 25,608 a——- c:\windows\system32\X3DAudio1_3.dll 2010-05-13 10:56 1,420,824 a——- c:\windows\system32\D3DCompiler_37.dll 2010-05-13 10:56 462,864 a——- c:\windows\system32\d3dx10_37.dll 2010-05-13 10:55 3,786,760 a——- c:\windows\system32\D3DX9_37.dll 2010-05-13 10:55 267,272 a——- c:\windows\system32\xactengine2_10.dll 2010-05-13 10:53 1,374,232 a——- c:\windows\system32\D3DCompiler_36.dll 2010-05-13 10:53 444,776 a——- c:\windows\system32\d3dx10_36.dll 2010-05-13 10:52 3,734,536 a——- c:\windows\system32\d3dx9_36.dll 2010-05-13 10:51 267,112 a——- c:\windows\system32\xactengine2_9.dll 2010-05-13 10:50 1,358,192 a——- c:\windows\system32\D3DCompiler_35.dll 2010-05-13 10:50 444,776 a——- c:\windows\system32\d3dx10_35.dll 2010-05-13 10:49 3,727,720 a——- c:\windows\system32\d3dx9_35.dll 2010-05-13 10:48 266,088 a——- c:\windows\system32\xactengine2_8.dll 2010-05-13 10:48 17,928 a——- c:\windows\system32\X3DAudio1_2.dll 2010-05-13 10:47 1,124,720 a——- c:\windows\system32\D3DCompiler_34.dll 2010-05-13 10:47 443,752 a——- c:\windows\system32\d3dx10_34.dll 2010-05-13 10:47 3,497,832 a——- c:\windows\system32\d3dx9_34.dll 2010-05-13 10:46 81,768 a——- c:\windows\system32\xinput1_3.dll 2010-05-13 10:45 261,480 a——- c:\windows\system32\xactengine2_7.dll 2010-05-13 10:44 1,123,696 a——- c:\windows\system32\D3DCompiler_33.dll 2010-05-13 10:44 443,752 a——- c:\windows\system32\d3dx10_33.dll 2010-05-13 10:42 2,297,552 a——- c:\windows\system32\d3dx9_26.dll 2010-05-13 10:29 –d—– c:\windows\Logs 2010-05-13 10:07 –d—– c:\docume~1\dan\applic~1\QuickScan 2010-05-13 09:26 284,160 a——- c:\windows\system32\dnssd32.dll 2010-05-12 15:52 284,160 a——- c:\windows\system32\dxtrans32.dll 2010-05-12 08:21 284,160 a——- c:\windows\system32\comsvcs32.dll 2010-05-10 16:19 20 a——- c:\windows\system32\34d9ba1c 2010-05-09 18:27 4,776 a——- c:\windows\GnuHashes.ini 2010-05-09 18:20 249 a–sh— c:\windows\system32\873065803 2010-05-09 18:20 817 a——- c:\windows\system32\1683602715 2010-05-09 18:19 113 a——- c:\windows\system32\sl1441300441 2010-05-09 18:19 –dsh— c:\windows\system32\SysWoW32 2010-05-09 18:19 –dsh— c:\docume~1\dan\applic~1\SystemProc 2010-05-09 18:19 –d—– c:\windows\system32\1449908860 2010-05-09 18:19 203,776 —sh— c:\windows\system32\unrar.exe 2010-05-09 18:18 1,081,856 a–sh— c:\windows\system32\3.tmp 2010-05-06 12:29 284,672 a——- c:\windows\system32\DOCOBJ32.dll 2010-05-06 12:29 177,664 a——- c:\windows\system32\dmusic32.dll 2010-05-05 22:53 12,464 a——- c:\windows\system32\avgrsstx.dll 2010-05-03 20:09 0 a—h— c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01009.Wdf 2010-05-03 20:09 0 a—h— c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf 2010-05-03 20:01 18,816 a——- c:\windows\system32\drivers\pccsmcfd.sys 2010-05-03 20:00 –d—– c:\program files\PC Connectivity Solution 2010-05-03 19:59 8,192 a——- c:\windows\system32\drivers\usbser_lowerfltj.sys 2010-05-03 19:59 8,192 a——- c:\windows\system32\drivers\usbser_lowerflt.sys 2010-05-03 19:59 22,528 a——- c:\windows\system32\drivers\ccdcmbo.sys 2010-05-03 19:59 1,461,992 a——- c:\windows\system32\wdfcoinstaller01009.dll 2010-05-03 19:59 662,016 a——- c:\windows\system32\nmwcdcocls.dll 2010-05-03 19:59 18,176 a——- c:\windows\system32\drivers\ccdcmb.sys 2010-04-30 16:51 –d—– c:\documents and settings\dan\Tracing 2010-04-26 15:27 411,368 a——- c:\windows\system32\deployJava1.dll 2010-04-26 15:27 73,728 a——- c:\windows\system32\javacpl.cpl ==================== Find3M ==================== 2010-05-05 22:53 242,896 a——- c:\windows\system32\drivers\avgtdix.sys 2010-05-05 22:53 216,200 a——- c:\windows\system32\drivers\avgldx86.sys 2010-05-04 15:53 39,768 a——- c:\docume~1\dan\applic~1\GDIPFONTCACHEV1.DAT 2010-04-13 10:38 2,395 a——- c:\docume~1\dan\applic~1\SAS7_000.DAT 2010-03-09 13:09 430,080 ——– c:\windows\system32\vbscript.dll 2010-02-26 14:32 92,672 a——- c:\windows\system32\nmwcdcls.dll 2010-02-26 07:43 667,136 a——- c:\windows\system32\wininet.dll 2010-02-26 07:43 81,920 ——– c:\windows\system32\ieencode.dll 2010-02-23 12:15 81,920 a——- c:\windows\VPlay801.exe 2010-02-16 16:08 2,146,304 ——– c:\windows\system32\ntoskrnl.exe 2010-02-16 15:25 2,024,448 ——– c:\windows\system32\ntkrnlpa.exe 2007-05-23 20:26 4 a——- c:\docume~1\dan\applic~1\mclip.dat 2007-05-23 20:26 928 a——- c:\docume~1\dan\applic~1\hexplorer.dat 1998-06-16 23:00 254,005 ——– c:\program files\Msvcrt.dll 1998-02-10 17:34 128,000 ——– c:\program files\UNWISE.EXE 1996-10-14 00:38 924,432 ——– c:\program files\Mfc40.dll 2006-05-03 11:06 163,328 —shr– c:\windows\system32\flvDX.dll 2007-02-21 12:47 31,232 —shr– c:\windows\system32\msfDX.dll 2008-03-16 14:30 216,064 —shr– c:\windows\system32\nbDX.dll 2008-02-04 21:26 151,040 —sh— c:\windows\system32\VistaUltm.dll ============= FINISH: 11:07:35.09 ===============
Post #2
Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 5 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post
•Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
•This may cause a delay in response time, but I will do my best to keep it as short as possible.
•I will reply back shortly with instructions.
Post #4
Hello BiggDan,please do the following.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #5
Mowman, I tried to run GMER at least 5 times. The computer and the program stopped responding the first few times after running for an hour or two. Now it runs for an hour or two and then the computer restarts and when it comes up I get a notice that it has just recovered from a serious error / do I want to send a report to Microsoft. I could try running it with only one block checked at a time to see if I can get some results to send you. A note about the computer problem of redirecting my search replies, more often than not the web site it tries to send me to is blocked by Spy Sweeper as a known spyware site. However, sometimes when I am not using the browser at all Spy Sweeper pops up and says it blocked access to a site. I assume some program in the computer randomly, or at a certain interval, attempts to connect to the internet. Dan
Post #7
I had an older version of GMER (v. 1.0.15.15252) and used it to check everything EXCEPT "files". It worked and the report is attached. I was not able to to that with the version I downloaded this time. Then I used it to check only "files" on the "C" drive and it locked up the computer when checking the "Temporary Internet files" so I went into the browser and cleared all the temporary internet files and ran the program again. (I know you said not to delete stuff while we are testing but this didn't occur to me at that time, sorry). This time the test finished with nothing to copy, nothing in the report at all and just a pop-up that said "GMER didn't find any changes to the system" and an OK button to click. Here is the kicker, the google search now works! I don't know what I deleted from the temporary internet files but whatever it was is seems to be gone now. What next? Dan
Post #8
Hello BiggDan,please do the following.

Download Combofix from either of the links below. You must rename it to combo.com before saving it.
Save it to your desktop. Change the save as file type to "all files"

**Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".

Link 1
Link 2



  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.


  • NOTE: If ComboFix asks to install the Recovery Console, please ALLOW it to do so.
  • Double click on the renamed ComboFix.exe & follow the prompts. When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.
Post #10
Hello BiggDan.Please do not attach any logs unless requested,use copy/paste

Please do the following

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    http://forums.whatthetech.com/Google_Yahoo_Re_directs_t112036.html

Collect::
C:\WINDOWS\system32\3.tmp 
c:\windows\system32\873065803
c:\windows\system32\1683602715
c:\windows\system32\sl1441300441
c:\windows\system32\34d9ba1c
c:\windows\system32\dxtrans32.dll
c:\windows\system32\comsvcs32.dll
c:\windows\system32\dnssd32.dll

DDS::
BHO: {048bafda-3580-4eee-a7a4-f6880e761cdc} - c:\windows\system32\dnssd32.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: []
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.



Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the log please

In your next reply please post the following.
  • Combofix log
  • Malwarebytes log
  • How is it running now
Post #11
The logs are posted. Malwarebytes didn't find anything to remove. The problem of the searches being redirected seems to have been solved when I deleted the temp internet files. The computer freezes-up regularly now. It had been giving a warning that 16 bit programs couldn't run with an option to continue or ignore. Now I don't see any warnings, the computer just stops responding. On the last reboot I started in safe mode. It is now in normal mode and hasn't locked up for a while. Fingers crossed. I had a hardware monitoring program ASUS Probe that is now missing a file and fails to start. It suggests I reload the program, I have to find it first!

Attachments:

Post #12
COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    FixCSet::
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
Post #14
Sorry, I didn't see your post of the 17th. I didn't get an e-mail notification either. :-( I will run the script and post the results. How does it look. Do I have malware? Dan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI