Not able to install SpyBot S&D

[makaveliliveson]

I have some kind of worm or other malware that is redirecting my search engine searches on IE and Firefox to a number of different sites including "free-fast-answers.com." So I am trying to install SpyBot in an effort to resolve this issue since my Norton Security has not found any issues. I get all the way through the install until the last 200kb or so and the I get a program pop-up that says "internal error: Failed to expand shell folder constant "userappdata"." Any help would be appreciated.

[imageek]

Go into safe mode with networking, install Spybot, update, and scan.

[makaveliliveson]

I tried it in Safe Mode and Safe Mode with Networking and still cannot install.

[imageek]

What OS do you have?

[makaveliliveson]

Windows 7 64-bit SP1

[imageek]

Is anything strange running in memory? Open the task manager, hit "Show processes from all users", and look for stuff with random letters (like "wsqweq.exe" or "re8rjae89")

[makaveliliveson]

atiedxx.exe
csrss.exe

Those are the only two that look strange.

[imageek]

Nah, they're normal.

Run cmd from the command line, and write regedit. Navigate yourself to HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel. Check for the existence of keys named ResetWebSettings or HomePage. If such keys exist, delete them.

Next, navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

Verify that the information stored in the Default_Page_URL key and Start Page key is correct. If these keys contain values that reflect an undesirable startup page, double-click on the key to open its dialog box and then replace the existing value with an appropriate one.

[makaveliliveson]

There isn't an Internet Explorer group in the Microsoft directory tree, so I cannot check the Control Panel for anything. The Home Page is correct, though.

[tashi]

Hello makaveliliveson,

As per this forum's sticky Please don't post Malware logs in the Spybot forum, thanks :-) the HJT log has been removed. Also the thread has been closed to avoid confusion about a possible infection and its removal.

I posted to your topic in the malware forum providing a link to the procedure in order for you to receive assistance from a helper. http://forums.spybot.info/showthread...488#post410488

Best regards.

Edit
http://forums.spybot.info/showthread.php?t=63574