Google redirecting

Nick42_2

Hi
I have an intermittent problem with google redirecting to ad pages or other search engines.
I ran scans with:
Avast
cwshredder
superantispy
malwarebytes antimalware

Thought the problem was gone but somes back every few uses.

Any ideas please - have very limited tech knowledge.

Thanks.

The_Grandmaster

Do you have the latest log of malwarebytes? Did you scan with the latest definitions (4196) and latest version (1.46) of malwarebytes? If not, please do so and post log here. If you have done the above, please post log here. Instructions below by alienRIK:

Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_ma..._anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM FULL SCAN then click SCAN
Remove everything thats found (needs to be ticked)
Post the COMPLETE log here AFTER youve deleted everything it finds


reboot

Download HIJACK THIS (Make sure you click 'DOWNLOAD THIS VERSION')
http://www.filehippo.com/download_hijackthis/2894/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

Nick42_2

Thanks

Malwarebytes was 1.45 so will update and do as you suggest.

Nick42_2

Re Hijackthis:

the link was for version 2.0.2 793kb, is the version 2.0.4 1.34mb from same site newer/better?

Nick42_2

Malwarebytes' Anti-Malware 1.46

Database version: 4196
Windows 5.1.2600 Service Pack 3, v.3311
Internet Explorer 8.0.6001.18702
14/06/2010 12:13:26
mbam-log-2010-06-14 (12-13-26).txt
Scan type: Full scan (C:\|)
Objects scanned: 192074
Time elapsed: 1 hour(s), 28 minute(s), 28 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Nick42_2

I can't post my hijackthis log as it contains links???

fiddiwebb

Nick

When you say you thought the problem had gone did you scan with Malwarebytes before and did it find any viruses and remove them?

If it did could you possibly post the Malwarebytes log file showing the viruses that were removed also the same for Superantispyware, it just givesus an idea of what viruses you had before and are still causing problems.

The_Grandmaster

The newer version is indeed better I think for hijackthislog.

Will find a link for you to post it on. Edit: rapidshare!

And please do as fiddiweb said too.

Nick42_2

fiddiwebb wrote: »

Nick

When you say you thought the problem had gone did you scan with Malwarebytes before and did it find any viruses and remove them?

If it did could you possibly post the Malwarebytes log file showing the viruses that were removed also the same for Superantispyware, it just givesus an idea of what viruses you had before and are still causing problems.

No, Malware scans hadn't found anything.

superantispy did find somethings - think it was tracking cookies??

Nick42_2

checked malwarebytes logs over last few months - all clear, except this one and I can't remember whether I had this problem then

Malwarebytes' Anti-Malware 1.45
Database version: 3978
Windows 5.1.2600 Service Pack 3, v.3311
Internet Explorer 8.0.6001.18702
11/04/2010 22:51:04
mbam-log-2010-04-11 (22-51-04).txt
Scan type: Quick scan
Objects scanned: 102669
Time elapsed: 9 minute(s), 42 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Nick42_2

The_Grandmaster wrote: »

The newer version is indeed better I think for hijackthislog.

Will find a link for you to post it on. Edit: rapidshare!

And please do as fiddiweb said too.

never used rapid share???

can I pm you the log?