Search Engine Redirection

[anduajar]

Lately, every time I perform a search within Yahoo or Google I get redirected to other sites that I did not request (this is happening with both Firefox and IE. Most of the time it redirects to a site called SearchThisSite. I have run Malwarebytes and it found some infections a few days ago, however the problem is still occurring and the newest scan is not turning up any infections.

Prior to cleaning a few of these items the infection had deleted my mbam.exe file, which required a work around to fix. I also use AVG for anti-virus. Can you please help me.

I am posting the latest MBAM Log.

Malwarebytes' Anti-Malware 1.42

Database version: 3442

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/27/2009 11:56:12 PM

mbam-log-2009-12-27 (23-56-12).txt

Scan type: Full Scan (C:\|)

Objects scanned: 176509

Time elapsed: 32 minute(s), 27 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

This was the MBAM log file from the cleaning a few days ago:

Malwarebytes' Anti-Malware 1.42

Database version: 3414

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/23/2009 12:17:40 AM

mbam-log-2009-12-23 (00-17-40).txt

Scan type: Quick Scan

Objects scanned: 110413

Time elapsed: 7 minute(s), 46 second(s)

Memory Processes Infected: 2

Memory Modules Infected: 4

Registry Keys Infected: 6

Registry Values Infected: 11

Registry Data Items Infected: 4

Folders Infected: 0

Files Infected: 20

Memory Processes Infected:

C:\WINDOWS\system32\opeia.exe (Backdoor.Bot) -> Unloaded process successfully.

C:\WINDOWS\system32\lsm32.sys (Backdoor.Bot) -> Unloaded process successfully.

Memory Modules Infected:

C:\WINDOWS\system32\kafudera.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\pubegadi.dll (Trojan.Vundo.H) -> Delete on reboot.

c:\WINDOWS\system32\Iasv32.dll (Backdoor.Bot) -> Delete on reboot.

C:\WINDOWS\system32\BtwSrv.dll (Backdoor.Bot) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ias (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwsrv (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fastnetsrv (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_BTWSRV (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_FASTNETSRV (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\winsts (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\buildw (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\firstinstallflag (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\guid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\i (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\uid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ulrn (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\update (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\updatenew (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mbt (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udfa (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mfa (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: kafudera.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7c89d47e-4eea-49d4-b6d9-fb52f054777c}\NameServer (Trojan.DNSChanger) -> Data: 193.104.110.38,4.2.2.1,192.168.1.1 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{88e9e98c-5c88-498e-a2ed-56f91afd58d3}\NameServer (Trojan.DNSChanger) -> Data: 193.104.110.38,4.2.2.1 -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\pufupode.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kafudera.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\pubegadi.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\rowabera.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\lefekeku.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rifabana.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\Iasv32.dll (Backdoor.Bot) -> Delete on reboot.

C:\WINDOWS\system32\opeia.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\BtwSrv.dll (Backdoor.Bot) -> Delete on reboot.

C:\WINDOWS\system32\lsm32.sys (Backdoor.Bot) -> Delete on reboot.

C:\haypsixd.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\uwlwfa.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\msaouahn.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\winsts.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\6to4v32.dll (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\wmdtc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ndisdrv.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\FastNetSrv.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\certstore.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully.

[Maurice Naggar]

Hello anduajar,

A number of malwares, (trojans & Vundo) were on this system. Most worrisome are the backdoor bots.

A wipe / pave/ and re-install of Windows is the safest longterm & also fastest to solve your issues.

I suggest you disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though a number of malwares have been identified and can be killed, because of likely backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

See How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

See http://www.dslreports.com/faq/10063

See also 4 steps to protect your computer

I suggest a clean (new) Windows XP Install:

Before you do that, make sure you have at hand the Windows XP CD and also, a fresh new copy of your antivirus that is downloaded from a clean pc and saved on transportable-media (CD-DVD or clean thumb drive).

When you are at point of re-installing o.s., I'd recommend you have the pc disconnected from internet until after the o.s. is installed, plus the antivirus is fully setup and running.

See Windows XP Clean Installation - Partitioning and Formatting using Windows XP CD by Ramesh Srinivasan, MS-MVP & AumHa VSOP

Also Clean Install Windows by Michael Stevens, MS-MVP

I would urge you to follow the directions very carefully.

You will loose your documents so if you have some to save, offload them to a separate offline media. And later on insure you do a full scan of them by running your antivirus.

If you wish to attempt to remove malwares with my guided help, let me know.

But make note that there are no guarantees of any kind that all malwares will be found and removed.