help please - keep getting redirected to gamingharbour website

scopey

Nenen - should you delete the link in your first post, in case people click on it and pick up what you've picked up? Just a thought.

Browntoa

run this

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

and post the log

macman

OP is still using Vista SP1. When clean they need to update to SP2.

Nenen

Browntoa wrote: »

run this

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

and post the log

Browntoa, when you say 'run this' do you mean I should click on 'run' or should I (as the website suggests) save the download as a file and then run it?

macman

It doesn't make any difference. The former installs it straight away, the latter saves it to your PC and then you just double click it when you want to run it.

Browntoa

download the file to your desktop , then run it

it will otherwise be running from a temp file location ( and combofix flushes that location)

macman

Apologies Browntoa, I hadn't realised that!

Nenen

Browntoa - thank you for your swift reply. I have just read through all the instructions for downloading combofix and am rather nervous particularly because it says I might lose internet connections etc. I am just under three weeks away from handing in my masters thesis (not in computing as you can probably tell lol) and being able to use my computer with internet connection is VITAL during this time. Given what I have down so far, do you think it would be a problem for me or make things any worse to delay running combofix until after 3rd August (thesis handin date)? Obviously if this malware or virus or whatever it is might be likely to cause my PC to crash entirely then I need to take immmediate action... just note sure how serous this is and very anxious not to make things any worse for myself at this crucial time.
Thanks again

Browntoa

I've not ever seen combofix do this, but to be sure rerun malwarebytes and see if it finds anything

post the log if it does

then follow up with this other similar tool that may catch stuff that the other has not

superantispywareDownload

Nenen

Hi again annd thank you for all the help. I really appreciate it.

I reran malaware and it didn't find anything. However, the superantispyware found something (still linked to the doublejoy thing). I have checked the box to remove and quarentine these items. Do I need to do anything else?

This is the log:
UPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/16/2009 at 09:15 PM

Application Version : 4.26.1006

Core Rules Database Version : 3999
Trace Rules Database Version: 1939

Scan type : Complete Scan
Total Scan Time : 00:37:57

Memory items scanned : 1086
Memory threats detected : 0
Registry items scanned : 9184
Registry threats detected : 4
File items scanned : 34768
File threats detected : 35

Adware.Tracking Cookie
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\jameson@ad-tracking[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\jameson@azjmp[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\jameson@doubleclick[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\jameson@mediaplex[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@adrevolver[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@microsoftinternetexplorer.112.2o7[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@statse.webtrendslive[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@revsci[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@advertising[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@valueclick[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@specificclick[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@rotator.adjuggler[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@atdmt[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@microsoftwindows.112.2o7[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@serving-sys[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@tdpg.adbureau[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@tradedoubler[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@e-2dj6wjmyaiajeho.stats.esomniture[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@msnportal.112.2o7[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@socialmedia[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@roiservice[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@bs.serving-sys[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@e-2dj6wjmywkd5kho.stats.esomniture[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@doubleclick[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@ads.aol.co[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@2o7[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@adviva[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@aoluk.122.2o7[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@questionmarket[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@media.adrevolver[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@mediaplex[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@media.adrevolver[3].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@track.webgains[2].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@track.omguk[1].txt
C:\Users\Jameson\AppData\Roaming\Microsoft\Windows\Cookies\Low\jameson@ad.yieldmanager[2].txt

Adware.JuicyAccess
HKU\S-1-5-21-4110448949-3802730221-3671641754-1000\Software\DoubleD
HKLM\Software\DoubleD
HKLM\Software\DoubleD\DoubleD
HKLM\Software\DoubleD\GamingHarbor Toolbar