Google redirect help

[GKFISH]

Hi Ken,

Ran eset again, it did not create a log, the scanning window only stated "no threats found". and gave file totals and time scan took.

Greg

[ken545]

Hello Greg,

Thats good. Where are you being redirected to ??

[GKFISH]

Say I do a search on Google, i'll get the results and click on one and I get redirected to sites such as " yellowbook.com, funbrain,gimmieanswers, find fast answers, catty etc.etc

But now its only certain result or sites, it seem that on government sites I dont get redirected, but MLB.com I got redirected. I cannot firgure out which I do or dont, theres really no pattern.

Thanks, Greg

[ken545]

Where you ever able to get aswMBR to run, now that Combofix removed some bad entries it may run, but drag it to the trash and grab a fresh copy.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan


On completion of the scan click save log, save it to your desktop and post in your next reply





Or try this one

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

• Double click GMER.exe.
  
• If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
• In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
    
    Click the image to enlarge it
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
• Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Please copy and paste the report into your Post.

[GKFISH]

Ken,

ran GMER here is log

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-09-14 14:39:18
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Greg\LOCALS~1\Temp\ugtyapog.sys


---- Files - GMER 1.0.15 ----

File C:\WINDOWS\temp\97c17011-9581-4593-8aef-912c43f8db59.tmp 0 bytes

---- EOF - GMER 1.0.15 ----

Greg

[ken545]

Lets try updating Malwarebytes , run a Quick Scan and post the log, then try this program also.

Please download SuperAntiSpyware Free
Install the program

• Run SuperAntiSpyware and click: Check for updates
• Once the update is finished, on the main screen, click: Scan your computer
• Check: Perform Complete Scan
• Click Next to start the scan.

Superantispyware scans the computer, and when finished, lists all the infections found.
Make sure everything found has a check next to it, and press: Next <-- Important
Then, click Finish

It is possible that the program asks to reboot in order to delete some files.

Obtain the SuperAntiSpyware log as follows:

• Click: Preferences
• Click the Statistics/Logs tab
• Under Scanner Logs, double-click SuperAntiSpyware Scan Log

It opens in your default text editor (such as Notepad)

Please provide the SuperAntiSpyware log in your next reply

[GKFISH]

Ken,

Am I administering these programs correctly? Could it be something i'm doing wrong!!

[ken545]

Why, wont they run ?

[GKFISH]

Malwarebytes' Anti-Malware 1.34
Database version: 1849
Windows 5.1.2600 Service Pack 3

9/14/2011 6:32:48 PM
mbam-log-2011-09-14 (18-32-48).txt

Scan type: Full Scan (C:\|)
Objects scanned: 155136
Time elapsed: 30 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Greg\Desktop\WiNlOgOn.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Greg\Desktop\uSeRiNiT.exe (Heuristics.Reserved.Word.Exploit)

[ken545]

Now run SuperAntiSpyware