Search Redirection

[RRR]

I seem to have contracted something that is hijacking all of my search results. When clicking a search result, rather than going to the expected page, a new tab opens and I am taken to some add. I've tried running several tools that are commonly requested for this type of problem but have not been able to even identify the malware causing the problem. I am more than willing to run any of them again if I've done something improperly. I've attached logs from MBAM, TDDSKiller, ComboFix, GMER Rootkit Scanner and DDS. Below is the output of DDS.txt. Please help me get rid of this malware.

TIA,

Ryan

.

DDS (Ver_2011-06-23.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26

Run by Revel at 18:19:43 on 2011-07-02

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.2046.896 [GMT -4:00]

.

AV: Kaspersky Internet Security *Enabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Kaspersky Internet Security *Enabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}

FW: Kaspersky Internet Security *Enabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\Ati2evxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\TeamViewer\Version6\TeamViewer.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\TeamViewer\Version6\tv_w32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe

c:\program files\teamviewer\version6\TeamViewer_Desktop.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2011\ievkbd.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~1\office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2011\klwtbbho.dll

mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2011\avp.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [AT&T Communication Manager] "c:\program files\at&t\communication manager\ATTCM.exe" -a

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky internet security 2011\ie_banner_deny.htm

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\micros~1\office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2011\klwtbbho.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2011\klwtbbho.dll

LSP: bmnet.dll

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{2C695410-FED0-45D3-B8EB-6BC1303F1908} : DhcpNameServer = 172.26.38.1 172.26.38.2

TCP: Interfaces\{C15C6583-521F-488F-997A-6C73C3F77D6C} : DhcpNameServer = 192.168.1.41 208.67.220.220

TCP: Interfaces\{E869EF12-1F5B-41DE-8217-59822B752F9E} : DhcpNameServer = 192.168.1.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Notify: klogon - c:\windows\system32\klogon.dll

AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\kloehk.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\revel\appdata\roaming\mozilla\firefox\profiles\auvxb682.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - plugin: c:\progra~1\micros~1\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~1\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll

FF - plugin: c:\users\revel\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

============= SERVICES / DRIVERS ===============

.

R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2010-6-9 11352]

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2010-4-22 22104]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]

R2 AVP;Kaspersky Anti-Virus Service;c:\program files\kaspersky lab\kaspersky internet security 2011\avp.exe [2010-11-2 365336]

R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-6-6 2337144]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-11-2 19984]

R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\at&t\communication manager\RcAppSvc.exe [2010-9-2 121416]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 CAATT;AT&T Con App Svc;c:\program files\at&t\communication manager\ConAppsSvc.exe [2010-9-2 125512]

S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2011-5-10 18432]

S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]

S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-6-6 52224]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-6-2 1343400]

.

=============== Created Last 30 ================

.

2011-07-02 21:18:02 -------- d-----w- c:\users\revel\appdata\roaming\Malwarebytes

2011-07-02 21:17:42 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-02 21:17:41 -------- d-----w- c:\programdata\Malwarebytes

2011-07-02 21:17:35 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-07-02 21:17:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-07-02 20:26:16 -------- d-sh--w- C:\$RECYCLE.BIN

2011-07-02 20:07:34 98816 ----a-w- c:\windows\sed.exe

2011-07-02 20:07:34 518144 ----a-w- c:\windows\SWREG.exe

2011-07-02 20:07:34 256000 ----a-w- c:\windows\PEV.exe

2011-07-02 20:07:34 208896 ----a-w- c:\windows\MBR.exe

2011-07-01 18:31:54 7074640 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{20596ef0-4f84-4daf-9783-c640f11a637d}\mpengine.dll

2011-06-29 12:15:16 293376 ----a-w- c:\windows\system32\umpnpmgr.dll

2011-06-29 12:15:11 1549312 ----a-w- c:\windows\system32\tquery.dll

2011-06-29 12:15:11 1401344 ----a-w- c:\windows\system32\mssrch.dll

2011-06-29 12:15:10 86528 ----a-w- c:\windows\system32\SearchFilterHost.exe

2011-06-29 12:15:10 666624 ----a-w- c:\windows\system32\mssvp.dll

2011-06-29 12:15:10 427520 ----a-w- c:\windows\system32\SearchIndexer.exe

2011-06-29 12:15:10 337408 ----a-w- c:\windows\system32\mssph.dll

2011-06-29 12:15:10 197120 ----a-w- c:\windows\system32\mssphtb.dll

2011-06-29 12:15:10 164352 ----a-w- c:\windows\system32\SearchProtocolHost.exe

2011-06-29 12:15:09 59392 ----a-w- c:\windows\system32\msscntrs.dll

2011-06-27 01:39:37 -------- d-----w- c:\program files\iPod

2011-06-27 01:39:36 -------- d-----w- c:\program files\iTunes

2011-06-23 13:35:05 -------- d-----w- c:\users\revel\appdata\local\Adobe

2011-06-21 13:07:03 -------- d-----w- c:\users\revel\appdata\roaming\AT&T

2011-06-21 13:06:48 -------- d-----w- c:\users\revel\appdata\roaming\Bytemobile

2011-06-21 13:01:34 -------- d-----w- c:\users\revel\appdata\local\AT&T

2011-06-21 13:00:46 -------- d-----w- c:\users\revel\appdata\roaming\Sierra Wireless

2011-06-21 12:57:38 -------- d-----w- c:\program files\common files\Motorola Shared

2011-06-21 12:56:50 -------- d-----w- c:\programdata\LG

2011-06-21 12:56:50 -------- d-----w- c:\program files\common files\Research In Motion

2011-06-21 12:56:50 -------- d-----w- c:\program files\common files\PctelEapPeer Authentication

2011-06-21 12:56:49 -------- d-----w- c:\programdata\AT&T

2011-06-21 12:56:49 -------- d-----w- c:\program files\Sierra Wireless Inc

2011-06-21 12:56:49 -------- d-----w- c:\program files\AT&T

2011-06-20 22:40:11 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-20 22:40:10 141104 ----a-w- c:\program files\internet explorer\sqmapi.dll

2011-06-20 22:40:09 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-06-20 20:45:10 311808 ----a-w- c:\windows\system32\drivers\srv.sys

2011-06-20 20:45:10 310272 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-06-20 20:45:10 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-06-20 20:45:09 338944 ----a-w- c:\windows\system32\drivers\afd.sys

2011-06-20 20:45:09 1290624 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-06-20 20:45:08 571904 ----a-w- c:\windows\system32\oleaut32.dll

2011-06-20 20:45:07 741376 ----a-w- c:\windows\system32\inetcomm.dll

2011-06-20 20:45:06 96768 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-06-20 20:45:06 223744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-06-20 20:45:05 123904 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-06-20 20:31:41 -------- d-----w- c:\users\revel\appdata\local\Diagnostics

2011-06-11 23:37:13 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-06-11 22:57:49 -------- d-----w- c:\program files\Synaptics

2011-06-11 22:57:32 196608 ----a-w- c:\windows\system32\SynCtrl.dll

2011-06-11 22:57:32 179256 ----a-w- c:\windows\system32\drivers\SynTP.sys

2011-06-11 22:57:32 163840 ----a-w- c:\windows\system32\SynCOM.dll

2011-06-11 22:57:32 143360 ----a-w- c:\windows\system32\SynTPAPI.dll

2011-06-11 22:57:32 110592 ----a-w- c:\windows\system32\SynTPCo4.dll

2011-06-11 22:57:32 1060424 ----a-w- c:\windows\system32\WdfCoInstaller01000.dll

2011-06-11 22:57:32 -------- d-----w- C:\dell

2011-06-11 22:47:36 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-11 22:25:50 -------- d-----w- c:\program files\Yahoo!

2011-06-08 04:58:07 -------- d-----w- c:\program files\CONEXANT

2011-06-08 04:16:48 -------- d-----w- c:\users\revel\appdata\local\Apple Computer

2011-06-08 04:16:33 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2011-06-08 04:16:33 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2011-06-08 04:15:30 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2011-06-08 04:14:32 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll

2011-06-08 04:14:32 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll

2011-06-08 04:14:32 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2011-06-08 04:14:32 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2011-06-08 04:14:32 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2011-06-08 04:14:32 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2011-06-08 04:14:32 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2011-06-08 04:13:55 -------- d-----w- c:\users\revel\appdata\local\Apple

2011-06-08 04:13:15 -------- d-----w- c:\program files\Bonjour

2011-06-08 01:07:09 -------- d-----w- c:\windows\PCHEALTH

2011-06-08 01:05:49 -------- d-----w- c:\program files\Microsoft Analysis Services

2011-06-08 01:04:51 -------- d-----w- c:\users\revel\appdata\local\Microsoft Help

2011-06-07 04:27:54 109240 ----a-w- c:\program files\mozilla firefox\extensions\kavantibanner@kaspersky.ru_bak\components\abhelperxpcom.dll

2011-06-07 04:27:51 150200 ----a-w- c:\program files\mozilla firefox\extensions\linkfilter@kaspersky.ru_bak\components\kavlinkfilter.dll

2011-06-07 04:27:39 97859 ----a-w- c:\windows\system32\drivers\klick.dat

2011-06-07 04:27:39 115369 ----a-w- c:\windows\system32\drivers\klin.dat

2011-06-07 04:26:25 -------- d-----w- c:\programdata\Kaspersky Lab

2011-06-07 04:26:25 -------- d-----w- c:\program files\Kaspersky Lab

2011-06-07 04:20:15 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files

2011-06-07 01:58:45 -------- d-----w- c:\program files\TeamViewer

2011-06-07 01:39:15 -------- d-----w- c:\windows\system32\SPReview

2011-06-07 01:38:33 -------- d-----w- c:\windows\system32\EventProviders

2011-06-07 01:36:07 1130824 ----a-w- c:\windows\system32\dfshim.dll

2011-06-07 01:36:03 52224 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys

2011-06-07 01:36:03 3215872 ----a-w- c:\windows\system32\mstscax.dll

2011-06-07 01:36:03 11776 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2011-06-07 01:36:00 1171456 ----a-w- c:\windows\system32\d3d10warp.dll

2011-06-07 01:34:59 830464 ----a-w- c:\windows\system32\MSMPEG2ENC.DLL

2011-06-07 01:33:51 606208 ----a-w- c:\windows\system32\wbem\fastprox.dll

2011-06-07 01:20:17 -------- d-----w- c:\users\revel\appdata\local\Google

2011-06-07 01:19:46 -------- d-----w- c:\users\revel\appdata\local\Apps

2011-06-07 01:19:45 -------- d-----w- c:\users\revel\appdata\local\Deployment

2011-06-06 16:55:30 183696 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

2011-06-05 02:42:52 7074640 ----a-w- c:\programdata\microsoft\windows defender\definition updates\backup\mpengine.dll

2011-06-05 02:37:10 0 ----a-w- c:\windows\ativpsrm.bin

.

==================== Find3M ====================

.

2011-06-07 01:44:17 152576 ----a-w- c:\windows\system32\msclmd.dll

2011-05-24 23:14:10 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-05-10 12:06:14 18432 ----a-w- c:\windows\system32\drivers\netaapl.sys

2011-05-10 12:06:08 4517664 ----a-w- c:\windows\system32\usbaaplrc.dll

2011-05-10 12:06:08 42496 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2011-04-22 19:14:16 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2011-04-09 06:02:25 3967872 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-04-09 06:02:25 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-04-09 05:56:38 123904 ----a-w- c:\windows\system32\poqexec.exe

2011-04-08 18:59:46 1461992 ----a-w- c:\windows\system32\wdfcoinstaller01009.dll

2011-04-06 20:20:16 91424 ----a-w- c:\windows\system32\dnssd.dll

2011-04-06 20:20:16 75040 ----a-w- c:\windows\system32\jdns_sd.dll

2011-04-06 20:20:16 197920 ----a-w- c:\windows\system32\dnssdX.dll

2011-04-06 20:20:16 107808 ----a-w- c:\windows\system32\dns-sd.exe

.

============= FINISH: 18:21:16.83 ===============

Attach.zip

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[RRR]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

Unfortunately have not been able to update MBAM. I've attached the error that I am getting. I have tried both from the opening request to update and from within the app after it has loaded. Is there something else that I can do to update it?

Thank you,

Ryan

[screen317]

Skip that for now and proceed with the other steps.

[RRR]

Skip that for now and proceed with the other steps.

I've attached the requested logs.

Thanks,

Ryan

malware logs 2.zip

[screen317]

Hi,

Please do the following:

• Download and run mbam-clean.exe from here
  
• It will ask to restart your computer, please allow it to do so very important
  
• After the computer restarts, temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware from here
  
  • Note: You will need to reactivate the program using the license you were sent via email if using the Pro version
    
  • Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.
    Restart the computer again and verify that MBAM is in the task tray if using the Pro version. Now setup any file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications. You may use the guides posted in the FAQ's here or ask and we'll explain how to do it.
    

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[RRR]

• Download and run mbam-clean.exe from here
  
• It will ask to restart your computer, please allow it to do so very important
  
• After the computer restarts, temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware from here
  
  • Note: You will need to reactivate the program using the license you were sent via email if using the Pro version
    
  • Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.
    Restart the computer again and verify that MBAM is in the task tray if using the Pro version. Now setup any file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications. You may use the guides posted in the FAQ's here or ask and we'll explain how to do it.
    

I was able to d/l and install the latest version after completing the mbam-clean. I was still unable to update MBAM however. I received the same error as shown in a previous post.

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Here are the contents of that log file. There was nothing detected.

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

I've attached the checkup.txt file.

Let me know how things are running now and what issues remain.

Unfortunately the problem remains. With just my normal A/V software running the problem happens consistently - any search result that I click on results in a new tab opening and redirecting me to an ad site. If I leave MBAM running (in trial mode), the redirect still happens, but the ad site fails to load. I did see a popup from MBAM indicating that the page had been blocked.

Thank you for all your assistance,

Ryan

checkup.txt

[screen317]

Hi,

Are you currently running a router?

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!