another search engine redirect victim

[gizmohead]

here's more info for the bug that affects the LOCAL results of search engines
(affects google & yahoo, but dogpile works fine!) - it happens with both IE
and firefox, so i assumed it was in the network layer. In fact, if i remove
tcp/ip from the network properties and reboot, then re-enable tcpip,
everything works fine. If i reboot without "uninstalling" tcpip, the problem
returns. When you hover over a link, nothing appears in the status bar. I
can only see the url by right-clicking on it... Also, when you click on a link, it
opens up in a new window...

mcafee is on the system, but added spybot 1.6, and AVG 7.5, updated them
both, and they both ran clean. lspfix only shows 3 items, and they
all appear legit. Have used autoruns and removed a few suspicious items,
but not yet found whatever this bug is...

Here's a (probably partial) list of sites i get redirected to:
onlinelearning101.com
anticipatesavings.com
tastelife.com
alltheservices.com
monstermarketplace.com
bottomdollar.com
adservices10.enhance.com
frisgo.com
nexplore.com
bankingmyway.com
crackle.com
and the bogus links seem to be related to the results - the same result link
always goes to the same bogus site.
The links are very long; here's an example (i removed the http://):
go.google.com/?u=gvrSZag-ZUZCXlgUQCkSAdEJIhsYmeKjITg8zHfDIWFapEvVe_qIIZZkj-nz_i3F9n2dYKiHJHPjgRcAhl4q1Xc1zKKqweEUWH6WZ3EiFKDInpPIh4ka0pJno473trdQbYpZJ3puQDEsrTPla19o-IQsXA3m2B9Mcrz2LMir1vpxLjeNKGPsFglRU1GrJ47sBqO7cAyU_KXKktfT1WK15cPZebrPrpWtf84sjSVOHZioiRFX5_JuHkw4ntdI5hDkqntxh41rrzHR24b4C-eGCmMMLRWxtjyT1X_kmTdGYa_Fv2EQetWXVWNATMrizVrYhb_Oz4tZ8Gup4RfSka7dj1aoujZ2DspDStvy9SQuA8lXs1Lvyn8dG890NJv6-OP_NVoGl8KPMGbfx4Ff-l3xXwLsZ3THYtZlbig_1dpY23JzCMuDdG5fsIbx5f3Zhx_3ljWbSoBY5SEMESFuIlYpcYKAAgNgAPGJCr5XgLWuBDjiGYQgFUTGFF2kihZ4GYU_PsvORWlgqMPQ0isIhFKN4YAAQYtJdB_phwkGf8x9g33nQs1Lhw_x2HajypGYt93zucuuc311299HqERExCkRBQCFNXYHEoXQE9Qg61SeJ0gKI_TRAAjoSuckdoNe%3Ds%3Fphp.c%2F711.691.111.46&bid=0.252620&aid=78&said=v2test7&ppc=peak

Any clues where else to look? Sigh...

[Blade81]

BEFORE you POST
(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288) ;)


Download and install TrendMicro HijackThis (http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe)
* Once installed open HijackThis by clicking Start > Programs > HijackThis and click the button labeled
Do a system scan only

* Click the scan button in the lower left hand corner of the interface and HijackThis will quickly scan your system.
* Once the scan is complete the scan button will now read save log. Click this button to save the log file to your PC. Once you select where you would like to save the file it will open in your systems default text editor. Typically this application is Notepad. Post the log here.

[Blade81]

Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.