Windows 7, Firefox hijacked by http://www.searchnu.com/406 [Closed]

Firefox is hijacked by Searchnu.com/406, i do not have utorrent… i have downloaded aswMBR results below aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-04-12 13:20:02 —————————– 13:20:02.085 OS Version: Windows 6.1.7601 Service Pack 1 13:20:02.085 Number of processors: 1 586 0x603 13:20:02.088 ComputerName: COWBELL-PC UserName: cowbell 13:20:24.178 Initialize success 13:20:50.914 The log file has been saved successfully to "C:\Users\cowbell\Documents\aswMBR.txt" aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-04-12 13:20:02 —————————– 13:20:02.085 OS Version: Windows 6.1.7601 Service Pack 1 13:20:02.085 Number of processors: 1 586 0x603 13:20:02.088 ComputerName: COWBELL-PC UserName: cowbell 13:20:24.178 Initialize success 13:20:50.914 The log file has been saved successfully to "C:\Users\cowbell\Documents\aswMBR.txt" 13:21:33.293 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 13:21:33.307 Disk 0 Vendor: Hitachi_HTS545032B9A300 PB3OC64G Size: 305245MB BusType: 11 13:21:33.322 Disk 0 MBR read successfully 13:21:33.325 Disk 0 MBR scan 13:21:33.328 Disk 0 Windows VISTA default MBR code 13:21:33.335 Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS 1500 MB offset 2048 13:21:33.352 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 293180 MB offset 3074048 13:21:33.384 Disk 0 Partition 3 00 17 Hidd HPFS/NTFS NTFS 10564 MB offset 603506688 13:21:33.390 Disk 0 scanning sectors +625141760 13:21:33.441 Disk 0 scanning C:\windows\system32\drivers 13:21:39.511 Service scanning 13:21:50.634 Service MpKsl1e606e6c c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7A47EC42-065C-4807-B517-C72FD08886ED}\MpKsl1e606e6c.sys **LOCKED** 32 13:21:51.061 Service MpNWMon C:\windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32 13:22:06.951 Modules scanning 13:22:23.320 Disk 0 trace - called modules: 13:22:23.359 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll PCIIDEX.SYS msahci.sys 13:22:23.368 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x854a3890] 13:22:23.379 3 CLASSPNP.SYS[883ad59e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85450908] 13:22:23.389 Scan finished successfully 13:25:30.388 Disk 0 MBR has been saved successfully to "C:\Users\cowbell\Documents\MBR.dat" 13:25:30.469 The log file has been saved successfully to "C:\Users\cowbell\Documents\aswMBR.txt"

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  
• Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
  
• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

• Download OTL to your desktop.
• Right-click and Run as Administrator on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
  Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

———-

Hi, Do you still need help?

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic