May 21, 2009 at 14:15:26
Specs: Windows XP

#1
May 21, 2009 at 14:35:54
 Hi,Can you please post your AVZ log:1) To create the logfile, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.2) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.3) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as AdministratorYou should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.begin ExecuteStdScr(3); RebootWindows(true); end. Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called virusinfo_syscure.zip inside. Upload that file to rapidshare.com and paste the link here.Image Tutorial--------------------------------------------To Private Message me Click Here

Report •

#2
May 21, 2009 at 14:57:53

Report •

#3
May 21, 2009 at 15:19:27
 I believe it might be caused by ask toolbar you can run this script in AVZ:begin SetAVZGuardStatus(True); SearchRootkit(true, true); DelBHO('{201f27d4-3704-41d6-89c1-aa35e39143ed}'); QuarantineFile('C:\Program Files\AskBarDis\bar\bin\askBar.dll',''); QuarantineFile('C:\Program Files\AskBarDis\bar\bin\AskService.exe',''); DeleteService('ASKService'); StopService('ASKService'); QuarantineFile('c:\program files\askbardis\bar\bin\askservice.exe',''); TerminateProcessByName('c:\program files\askbardis\bar\bin\askservice.exe'); DeleteFile('c:\program files\askbardis\bar\bin\askservice.exe'); DeleteFile('C:\Program Files\AskBarDis\bar\bin\AskService.exe'); DeleteFile('C:\Program Files\AskBarDis\bar\bin\askBar.dll'); BC_ImportDeletedList; ExecuteSysClean; ExecuteRepair(14); ExecuteRepair(15); BC_Activate; RebootWindows(true); end. Your computer will reboot after reboot check and see if you still get redirected.--------------------------------------------To Private Message me Click Here

Report •

Related Solutions

#4
May 21, 2009 at 15:26:18
 I'll do that, but I didn't get that toolbar until I changed my firewall to Zone Alarm and it installed the Zone Alarm spyblocker toolbar which has the Ask.com search.I was having the redirecting a day or two before that.

Report •

#5
May 21, 2009 at 15:35:49
 I also forgot to mention that the toolbar is only installed on Firefox and not Internet Explorer. I can't even use IE but for only a few minutes before I get the error screen and it closes it after it sends a report.I should of mentioned that I have a slow start up. After the wallpaper comes up it takes a few minutes for the icons and start menu to pop up. During this time the computer PF and CPU usage is very low like the computer isn't trying to do anything, it's just delayed. Sometimes it won't even load at all and going to run new task and entering explorer.exe does nothing. I thought this was all part of the google redirecting trojan/virus.Should I post a Hijack This log?

Report •

#6
May 21, 2009 at 15:36:50

Report •

#7
May 21, 2009 at 15:48:11
 I'm running Norton and I did exactly what that link said to disable it. It even shows the red X over the ballon or whatever you want to call it showing it's disabled, and when I put the mouse over it, it says disabled but Combofix is still giving me the alert that it's not.

Report •

#8
May 21, 2009 at 15:52:27
 Look at this to disable Norton Firewall: http://service1.symantec.com/SUPPOR... Disable that aswell.--------------------------------------------To Private Message me Click Here

Report •

#9
May 21, 2009 at 18:30:35
 http://rapidshare.com/files/2357974...

Report •

#10
May 21, 2009 at 18:55:55
 Run this script in AVZ your computer will reboot:begin SetAVZGuardStatus(True); SearchRootkit(true, true); QuarantineFile('c:\windows\system32\1041a.exe',''); DeleteFile('c:\windows\system32\1041a.exe'); QuarantineFile('c:\windows\Internet Logs\xDB1.tmp',''); DeleteFile('c:\windows\Internet Logs\xDB1.tmp'); BC_ImportDeletedList; ExecuteSysClean; ExecuteRepair(2); ExecuteRepair(3); ExecuteRepair(4); BC_Activate; RebootWindows(true); end. After reboot follow:1) Run this script in AVZ:begin CreateQurantineArchive('c:\quarantine.zip'); end. 2) A file called quarantine.zip should be created in C:\. Then please zip up C:\qoobox\quarantine and upload both it and C:\quarantine.zip to a filehost such as http://rapidshare.com/ Then, Private Message me the Download link to the uploaded file. 3) Lastly, uninstall Combofix by: pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) > Start > run > type combofix /u > ok. Or Start > run > type 123 /u > ok.4) Install and run full scan with SuperAntiSpyware. Attach full scan log, Fix what it detects.--------------------------------------------To Private Message me Click Here

Report •

#11
May 21, 2009 at 20:14:30
 After I used that scanner it didn't give me an option to save it and I also can't find where it keeps a logs of the scans, but here is a screenshot of what it found. I know it doesn't show the whole thing, but if you need the rest of it I'll type it out. Besides those 2 things it only found cookies.

Report •

#12
May 21, 2009 at 20:23:09
 Download and run Kaspersky AVP tool:http://devbuilds.kaspersky-labs.com...Once you download and start the tool select all the objects/places to be scanned and hit Scan. Fix what it detects and at the end of the scan post screen shot/log of detected items that is fixed and which it could not fix.--------------------------------------------To Private Message me Click Here

Report •

#13
May 22, 2009 at 16:19:25
 http://img190.imageshack.us/img190/...None of them could be disinfected, but said all were deleted.

Report •

#14
May 22, 2009 at 16:38:40