google/bing search redirected

[anthonyq]

I posted in a different forum and was asked to run various things and post in this forum,with the following problem.

When using Google/Bing search,and click to go to a site I am taken to a completely different site. Have run Malwarebytes-Superantispyware-McAfee AV and Stinger. but still have the problem. Toshiba laptop running Windows Vista.

The results of the various scans are as follows.

Log File

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6562

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

12/05/2011 21:11:40

mbam-log-2011-05-12 (21-11-40).txt

Scan type: Full scan (C:\|E:\|)

Objects scanned: 279133

Time elapsed: 1 hour(s), 21 minute(s), 25 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

DDs.tet

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Tony at 8:36:12.86 on 13/05/2011

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_22

Microsoft

ark.zip

Attach.zip

[anthonyq]

I posted in a different forum and was asked to run various things and post in this forum,with the following problem.

When using Google/Bing search,and click to go to a site I am taken to a completely different site. Have run Malwarebytes-Superantispyware-McAfee AV and Stinger. but still have the problem. Toshiba laptop running Windows Vista.

The results of the various scans are as follows.

Log File

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6562

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

12/05/2011 21:11:40

mbam-log-2011-05-12 (21-11-40).txt

Scan type: Full scan (C:\|E:\|)

Objects scanned: 279133

Time elapsed: 1 hour(s), 21 minute(s), 25 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

DDs.tet

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Tony at 8:36:12.86 on 13/05/2011

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_22

Microsoft

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[anthonyq]

Hi screen317,

while I was awaiting a reply I ran Hitman Pro 3 which seems to have solved the problem. I later read on the Malwarebytes Forum,that I should not install other software while awaiting a reply,sorry about that. Would you advise me to still run a scan and post ect.

[anthonyq]

screen 317.

please find below the 3 files you requested. Coped/pasted.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6598

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

17/05/2011 14:39:25

mbam-log-2011-05-17 (14-39-25).txt

Scan type: Quick scan

Objects scanned: 148513

Time elapsed: 9 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

CombiFix Log 17 05 2011

ComboFix 11-05-16.03 - Tony 17/05/2011 14:54:04.1.2 - x86

Microsoft

[screen317]

Hi,

Let's make sure everything is gone.

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[anthonyq]

Hi screen317

please find the files that you asked for.

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# plugin-container.exe=2.0.1

# OnlineScanner.ocx=1.0.0.6522

# api_version=3.0.2

# EOSSerial=f7c87011f86b9c4eb35d662b4c477c1b

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-05-20 04:30:55

# local_time=2011-05-20 05:30:55 (+0000, GMT Daylight Time)

# country="United Kingdom"

# lang=9

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=768 16777215 100 0 131064973 131064973 0 0

# compatibility_mode=5121 16777213 100 75 9324084 19414995 0 0

# compatibility_mode=5892 16776574 100 100 40522165 143431391 0 0

# compatibility_mode=8192 67108863 100 0 224 224 0 0

# scanned=153263

# found=0

# cleaned=0

# scan_time=10392

Results of screen317's Security Check version 0.99.11

Windows Vista Service Pack 2 (UAC is disabled!)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

ESET Online Scanner v3

McAfee Internet Security

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

CCleaner

Java 6 Update 22

Out of date Java installed!

Adobe Flash Player 10.2.159.1

````````````````````````````````

Process Check:

objlist.exe by Laurent

``````````End of Log````````````

[screen317]

Hi,

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program (if present):

Java

[anthonyq]

Hi screen317

I have done as you asked,but have not downloaded "Adobe Reader" as I prefer "Foxit Reader" is that O.K.

I notice that the report after using ESET shows that I have IE8 installed (see below) but I have IE9 installed.

Other than the points above everything seems to be running O.K

Results of screen317's Security Check version 0.99.11

Windows Vista Service Pack 2 (UAC is disabled!)

Internet Explorer 8

[screen317]

Hi,

That's all fine.

If there are no other issues then I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

5) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

[anthonyq]

Hi screen 317,

thank you for all your help and advice.

Regards anthonyq

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!