Google results re-direct to random websites (and computer is slow)

[spikyspud]

Hi,

My computer (running Vista) has started to re-direct Google results to seemingly random websites. I have backed up the registry using ERUNT, when I try and run DDS however it runs for a while and then the computer locks up (nothing responds, can't get task manager open etc). The computer has Microsoft Security Essentials which was recently installed, it did find several issues, but I disabled the live protection for running DDS.

Also a portable version of Spybot was used recently as well, the scan on that also found some issues that were fixed by the program.

I am not sure where to go from here if any further information is required please let me know.

And thanks very much in advance of any advice given.

[ken545]

Please read Before You Post
While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.

Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware except for the programs we may run.



Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan


On completion of the scan click save log, save it to your desktop and post in your next reply

[spikyspud]

Thanks for the reply.

I tried running aswMBR as described, however it won’t start up. When I double click it no GUI runs or anything like that. I checked the processes running in the task list and the aswMBR.exe process does pop up for around 2 seconds but then it just disappears.

Should I try running in safe mode?

[ken545]

Good Morning,

Yes , try safemode.

To Enter Safemode

• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
  this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode with Networking
• Then press the Enter Key on your Keyboard

Tutorial if you need it How to boot into Safemode

[spikyspud]

Afternoon,

Thanks for the rapid reply.

Tried to run in safe mode and the exact same issue, aswMEB.exe shows in the process list for around 2 seconds before just shutting down again....

Are there any other steps I should take?

[ken545]

With Vista, you need to RIGHT CLICK ON A PROGRAM AND SELECT "RUN AS ADMINISTRATOR" Have you done that ?

Try that also with DDS both normally and in Safemode


If still a no go than try running these programs


Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

• Double click GMER.exe.
  
• If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
• In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
    
    Click the image to enlarge it
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
• Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Please copy and paste the report into your Post.






OTL by OldTimer

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Click the "Scan All Users" checkbox.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.