Constant redirects to several websites

[george969]

I am having constant redirects in both Foxfire and Explorere. Started as google-analitics and now there are many.

Here is my rootkit scan:

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-08-15 08:32:33

Windows 6.0.6002 Service Pack 2

Running: gmer.exe

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0007611f2755

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0007611f2755 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0007611f2755 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKLM\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\0007611f2755 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKLM\SYSTEM\ControlSet005\Services\BTHPORT\Parameters\Keys\0007611f2755 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet005\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKLM\SYSTEM\ControlSet006\Services\BTHPORT\Parameters\Keys\0007611f2755 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet006\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKLM\SYSTEM\ControlSet007\Services\BTHPORT\Parameters\Keys\0007611f2755 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet007\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKLM\SYSTEM\ControlSet008\Services\BTHPORT\Parameters\Keys\0007611f2755 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet008\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKLM\SYSTEM\ControlSet009\Services\BTHPORT\Parameters\Keys\0007611f2755 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet009\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKLM\SYSTEM\ControlSet010\Services\BTHPORT\Parameters\Keys\0007611f2755 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet010\Services\BTHPORT\Parameters\Keys\0007611f2755@00076123af85 0x72 0x35 0x03 0xC4 ...

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0350696E-1974-2669-4EED-88923B795DF6}

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0350696E-1974-2669-4EED-88923B795DF6}@iagolfcaijmjmihaem 0x6A 0x61 0x66 0x62 ...

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0350696E-1974-2669-4EED-88923B795DF6}@hamngddnljjmjdpi 0x6A 0x61 0x63 0x62 ...

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0350696E-1974-2669-4EED-88923B795DF6}@hadnmgkkkoihfoho 0x66 0x61 0x70 0x61 ...

---- EOF - GMER 1.0.15 ----

[inzanity]

Hello and

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:

• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• Do not install/uninstall anything on your computer unless advised.
  
• Do not run any other scanning tools other than those instructed for you to use.
  
• Follow the instructions on the order they are given.
  
• Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
  
• If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
  
• If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 48 hours then the topic will be closed.
  
• And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.
  

_________________________________________________

You will need to right click and choose "Run as Administrator" to run the tools we will use.

• Download OTL to your desktop.
  
• Right click on the icon then choose Run as Administrator to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Under Custom Scan paste this in
  

  
  

  netsvcs
  
  
  drivers32 /all
  
  
  %SYSTEMDRIVE%\*.*
  
  
  %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
  
  
  %systemroot%\system32\*.wt
  
  
  %systemroot%\system32\*.ruy
  
  
  %systemroot%\Fonts\*.com
  
  
  %systemroot%\Fonts\*.dll
  
  
  %systemroot%\Fonts\*.ini
  
  
  %systemroot%\Fonts\*.ini2
  
  
  %systemroot%\system32\spool\prtprocs\w32x86\*.tmp
  
  
  %systemroot%\*. /mp /s
  
  
  %systemroot%\REPAIR\*.bak1
  
  
  %systemroot%\REPAIR\*.ini
  
  
  %systemroot%\system32\*.jpg
  
  
  %systemroot%\*.scr
  
  
  %systemroot%\*._sy
  
  
  %APPDATA%\Adobe\Update\*.*
  
  
  CREATERESTOREPOINT
  
  
  %systemroot%\system32\*.dll /lockedfiles
  
  
  %systemroot%\Tasks\*.job /lockedfiles
  
  
  %systemroot%\System32\config\*.sav
  
  
  %systemroot%\system32\user32.dll /md5
  
  
  %systemroot%\system32\ws2_32.dll /md5
  
  
  %systemroot%\system32\ws2help.dll /md5
  
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  

  
  

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
    
  • You may need two posts to fit them both in.
    

[inzanity]

Hi,

It's been several days. Do you still need help on this?

This thread will be closed if you don't respond within 48 hours.

[AdvancedSetup]

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.