Try Here If I'm helping you and I don't reply within 24 hours send me a PM.

0

AVZ link: http://rapidshare.com/files/2573969... DDS link: http://rapidshare.com/files/2573967... Thank You!

0

Follow these Steps in order numbered. Don't proceed to next step unless you have successfully completed previous step: 1) Run this script in AVZ like before, your computer will reboot: begin SetAVZGuardStatus(True); SearchRootkit(true, true); DelCLSID('{9E4D1CA8-B5F5-40B2-9665-2599E22434F5}'); DelCLSID('{3D7BFFA3-7E56-4F1B-8F20-CCC763C31EBC}'); DelCLSID('{3CCDB9C7-08F8-44B1-9F57-1A0460ACCC05}'); QuarantineFile('C:\Windows\temp\7684624.tmp',''); DeleteFile('C:\Windows\temp\7684624.tmp'); DeleteFile('C:\windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job'); BC_ImportDeletedList; ExecuteSysClean; BC_Activate; RebootWindows(true); end. 2) Change your dns servers to Open DNS and reboot. PS: Check and see if you still are getting redirected. If I'm helping you and I don't reply within 24 hours send me a PM.

0

Back to normal, thank you so much! Would it now be acceptable for me to uninstall some of the spyware removal programs I had previously installed? Or are there additional diagnostics that need to be executed? Thanks again!

0

Run one more log just to eliminate rootkit. Follow these steps in order numbered: 1) Download GMER: http://gmer.net/download.php [This version will download a randomly named file (Recommended).] 2) Disconnect from the Internet and close all running programs. 3) Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver. 4) Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked. 5) GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress) 6) If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO. 7) Now click the Scan button. If you see a rootkit warning window, click OK. 8) When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log and upload it rapidshare.com. Post the download link to the uploaded file in your post. 9) Exit GMER and re-enable all active protection when done. Note: Please give me the exact name of the file you downloaded in step 1 + post your log from step 8 in your next post. If I'm helping you and I don't reply within 24 hours send me a PM.

0

Hi, I've ran the program 5 times and each time, Windows closes the program. "The program has stopped working" or something along the lines of that. Any ideas? I disabled every real-time protection.

0

Run it in safe mode. If I'm helping you and I don't reply within 24 hours send me a PM.

0

jdk, do you not know the rules of this site???? People are NOTsupposed to post a HJT log unless requested by a qualified member. What gives with that??? Some HELP in posting on Computing.net plus free progs and instructions Cheers

0

GMER still doesn't completely scan in safe mode -- it always stops working and the program needs to be closed. The first time it closed, my computer was rebooted. Do I need to delete GMER and download another copy in safe mode?

0

Run complete scan with http://onecare.live.com/site/en-Us/... . Post screenshot of what gets detected. XpUser4Real talk to the admins? I didn't post HjT... yzarius did. If they have problem they can delete his post. If i see something wrong i try to help :). If I'm helping you and I don't reply within 24 hours send me a PM.

0

Here's the rapidshare link: http://rapidshare.com/files/2580092... For the scan, should I just leave it there or click next?

0

Original problem fixed? If I'm helping you and I don't reply within 24 hours send me a PM.

0

yeah the redirect is gone. anything else?

0

Follow: 1) Install, update database and run full scan with Malwarebytes' Anti-Malware. Attach malwarebyte full scan log, fix anything detected. 2) Run full Scan with SuperAntispyware : http://www.superantispyware.com/dow... . Fix what it detects and post summary scan log. If I'm helping you and I don't reply within 24 hours send me a PM.

0

Malware Bytes won't run.

0

Follow these Steps in order numbered. Don't proceed to next step unless you have successfully completed previous step: 1) Attach a Combofix log, please review and follow these instructions carefully. Download it here -> http://download.bleepingcomputer.co... Before Saving it to Desktop, please rename it to something like 123.exe to stop malware from disabling it. Now, please make sure no other programs are running, close all other windows and pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) until after the scanning and removal process has taken place. Please double click on the file you downloaded. Follow the onscreen prompts to start the scan. Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal. You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed. Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please upload that file to rapidshare.com and paste the link here. 2) Please zip up C:\qoobox\quarantine and upload it, to a filehost such as http://rapidshare.com/ Then, Private Message me the Download links to the uploaded files. If I'm helping you and I don't reply within 24 hours send me a PM.

0

I renamed the Malwarebytes file and now it is running properly, should I run a scan from there first?

0

Follow: Response Number 22 first. If I'm helping you and I don't reply within 24 hours send me a PM.

0

I couldn't find the combofix text file but here's the link to the quarantine file: http://rapidshare.com/files/2581683...

0

Link doesn't work log should be here c:\combofix.txt . If I'm helping you and I don't reply within 24 hours send me a PM.

0

http://rapidshare.com/files/2581683...

0

Still no text file, was I suppose to run combofix in safe mode?

0

Uninstall Combofix by: pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) > Start > run > type combofix /u > ok. No need run it again follow: Please download RootRepeal Rootkit Detector and save it to your Desktop. * Close all programs and temporarily disable your anti-virus, Firewall and any anti-malware real-time protection before performing a scan. * Click this link to see a list of such programs and how to disable them. * Create a new folder on your hard drive called RootRepeal (C:\RootRepeal) and extract (unzip) RootRepeal.zip. (click here if you're not sure how to do this. Vista users refer to this link.) * Open the folder and double-click on RootRepeal.exe to launch it. If using Vista, right-click and Run as Administrator... * Click on the Report tab at the bottom of the program window * Click the Scan button * In the Select Scan dialog, check: * Drivers * Processes * SSDT * Hidden Services * Click the OK button * In the next dialog, select all drives showing * Click OK to start the scan * When the scan has completed, a list of files will be generated in the RootRepeal window. * Click on the Save Report button and save it as rootrepeal.txt to your desktop or the same location where you ran the tool from. * Upload rootrepeal.txt to rapidshare.com and post the download link in your next reply. * Exit RootRepeal and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled. Note: If RootRepeal cannot complete a scan and results in a crash report, try repeating the scan in "Safe Mode". If I'm helping you and I don't reply within 24 hours send me a PM.

0

I was getting the following messages: "Could not read the boot sector. Try adjusting the disk access level in the options dialog." & then another rootrepeal error message saying "Could not read the system registry! Please contact the author!" But there was no crash. Here's the report I still received though: http://rapidshare.com/files/2581868... Thanks again

0

Follow these Steps in order numbered. Don't proceed to next step unless you have successfully completed previous step: 1) Run this script in AVZ like before, your computer will reboot: begin SetAVZGuardStatus(True); SearchRootkit(true, true); QuarantineFile('C:\Windows\system32\drivers\ESQULpohctvxthcxrsbpbpneedkivdtpuyjwi.sys',''); DeleteFile('C:\Windows\system32\drivers\ESQULpohctvxthcxrsbpbpneedkivdtpuyjwi.sys'); ExecuteRepair(10); ExecuteRepair(11); ExecuteRepair(17); BC_ImportAll; ExecuteSysClean; BC_Activate; RebootWindows(true); end. 2) After reboot execute following script in AVZ: begin CreateQurantineArchive('C:\quarantine.zip'); end. A file called quarantine.zip should be created in C:\. Upload that file to rapidshare.com and Private message me download link. 3) Follow these steps carefully and in order numbered: 1) Download The Avenger by Swandog46 from here. 2) Unzip/extract it to a folder on your desktop. 3) Double click on avenger.exe to run The Avenger. 4) Click OK. 5) Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it. 6) Copy all of the text in the below code box to the clipboard by highlighting it and then pressing Ctrl+C. Files to delete: C:\Windows\system32\drivers\ESQULpohctvxthcxrsbpbpneedkivdtpuyjwi.sys 7) In the avenger window, click the Paste Script from Clipboard, button. 8) Click the Execute button. 9) You will be asked Are you sure you want to execute the current script?. 10) Click Yes. 11) You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?. 12) Click Yes. 13) Your PC will now be rebooted. Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation. 14) After your PC has completed the necessary reboots, a log should automatically open. If it does not automatically open, then the log can be found at %systemdrive%\avenger.txt (typically C:\avenger.txt). 15) Please upload this log to rapidshare.com and post a download link to the uploaded file. If I'm helping you and I don't reply within 24 hours send me a PM.

0

jdk (by neoark) Obviously you are no Jabuck. He understood the rules of the forum and KNEW that HJT posts had to be requested by a qualified helper. When someone posted a HJT without a request, he would let the poster know. it is forum etiquette. Some HELP in posting on Computing.net plus free progs and instructions Cheers

0

Here's the avenger text: http://rapidshare.com/files/2581978...

0

yzarius: Redo Response Number 22 in normal mode. How is your computer running now? XpUser4Real: Gotcha will keep that in mind. If I'm helping you and I don't reply within 24 hours send me a PM.

0

The scan ran and finished normally.

0

Still need combofix log. The link you send me is wrong link. If I'm helping you and I don't reply within 24 hours send me a PM.

0

http://rapidshare.com/files/2585098... right one?

0

How is your system running now? Seems like we got everything just some cleaning up left to do. Follow Response Number 20. Then Downlaod and run ccleaner (temp and registry). Uninstall Combofix by: pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) > Start > run > type combofix /u > ok. If I'm helping you and I don't reply within 24 hours send me a PM.

0

Where can I find CCleaner? The System seems to be running fine, google search is back to normal in Firefox and IE. And I didn't have to rename MalwareBytes, now I'm just waiting for the other scan to finish. Thanks again.

0

Ccleaner: http://www.ccleaner.com/download/bu... If I'm helping you and I don't reply within 24 hours send me a PM.

0

Malwarebytes' Anti-Malware 1.39 Database version: 2476 Windows 6.0.6001 Service Pack 1 7/21/2009 10:53:29 PM mbam-log-2009-07-21 (22-53-29).txt Scan type: Full Scan (C:\|D:\|E:\|) Objects scanned: 347595 Time elapsed: 3 hour(s), 29 minute(s), 50 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Users\od\Desktop\avenger.exe (Trojan.Agnet) -> Quarantined and deleted successfully.

0

SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 07/22/2009 at 00:30 AM Application Version : 4.26.1006 Core Rules Database Version : 4010 Trace Rules Database Version: 1950 Scan type : Complete Scan Total Scan Time : 01:22:50 Memory items scanned : 773 Memory threats detected : 0 Registry items scanned : 7799 Registry threats detected : 0 File items scanned : 27925 File threats detected : 82 Adware.Tracking Cookie C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@msnservices.112.2o7[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@adopt.euroclick[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ads.mediamayhemcorp[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@questionmarket[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@microsoftwlsearchcrm.112.2o7[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@realmedia[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ads.pointroll[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@clicksor[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@2o7[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@www.burstbeacon[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ad.yieldmanager[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@hitbox[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ads.bridgetrack[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@myroitracking[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ar.atwola[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@adserver.easyad[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@advertising[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ads.addynamix[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@cdn.at.atwola[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@trafficmp[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@atdmt[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@qnsr[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ad.zanox[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@bannersulike[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@media6degrees[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@247realmedia[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@fastclick[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@mediaplex[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@microsoftwlmessengermkt.112.2o7[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@network.realmedia[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@msnportal.112.2o7[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@doubleclick[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@a1.interclick[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ads.bootcampmedia[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@adserver.adtechus[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@apmebf[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@zedo[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@bs.serving-sys[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@microsoftwlmailmkt.112.2o7[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@msnaccountservices.112.2o7[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@adbrite[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@statcounter[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@revsci[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@interclick[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@tracker.adprotracker[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@yadro[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@rotator.adjuggler[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@zillow.adbureau[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@adlegend[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ads.us.e-planning[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@nextag[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@at.atwola[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@burstbeacon[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@ehg-morningstar.hitbox[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@imrworldwide[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@www.burstnet[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@insightexpressai[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@atwola[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@burstnet[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@oasn04.247realmedia[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@serving-sys[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@adserv.brandaffinity[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@2o7[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@ad.yieldmanager[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@adrevolver[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@ads.widgetbucks[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@advertising[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@apmebf[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@atdmt[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@azjmp[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@doubleclick[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@dynamic.media.adrevolver[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@fastclick[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@media.adrevolver[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@mediaplex[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@microsoftwlsearchcrm.112.2o7[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@msnportal.112.2o7[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@msnservices.112.2o7[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@specificclick[2].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@specificmedia[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Low\od@statcounter[1].txt C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\od@atdmt[2].txt

0

combofix is uninstalled. Is it safe to uninstall anything else or install a new program for class?

0

Yes you can delete everything else. Avenger was false positive detection. Your clean :). If I'm helping you and I don't reply within 24 hours send me a PM.

0

This was my first time using this site and it was very helpful. Thanks again for everything!

0

i had this problem long time ago. i fixed it with windows live one care. it's actually some kind of spy ware or virus or Trojan. this Trojan is redirecting your page because it wants to download other viruses from the internet ad infect the computer. it turns off windows defender and you can't turn it on. i had trend micro internet security 14, which could not even try to remove the Trojan. some how i got the info about it on Microsoft's website. they told me to download windows live one care. as soon as i finished installing it. it said there is a Trojan in you computer. it deleted about 25 Trojans off my computer. now it works fine. . i will put the link about it if i find it.

0

if it doesnot work try deleting all the cooking. every time you search something on google.

0

i got the link of the trogan from windows defender. if it finds some thing, you can get more information about it.

0

i just remembered that the virus was called win32 or something

0