Homepage search leading to other search pages

glowgirl_2

I am in comp hell atm, I've had problem after problem for 4 days now, I seem to of solved most of them by following the steps in the excellent sticky for removing malware but this morning when performing a search from my home page I just kept getting redirected to either adverts or some other search page:mad: I'm guessing I'm still infected so can anyone help me because I'm now at a loss as to what to do:(

I use Vista and IE8, I have bullguard security as well as Spybot, ccleaner, ad aware and malwarebytes and I'm using a Dell laptop - thanks in avance for any help offered:)

aliEnRIK

Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_malwarebytes_anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM QUICK SCAN then click SCAN
Remove everything thats found (needs to be ticked)
Post the COMPLETE log here AFTER youve deleted everything it finds
If anything was found then do the exact same but run a FULL scan

reboot
Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)
If you get a message that you cant write to the hosts file then Press the SHIFT key, and whilst holding it RIGHT CLICK and select RUN AS (admin)

glowgirl_2

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org
Database version: 5270
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975
08/12/2010 11:36:31
mbam-log-2010-12-08 (11-36-31).txt
Scan type: Quick scan
Objects scanned: 140020
Time elapsed: 14 minute(s), 10 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Sky-Banners (Adware.Adrotator) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Thanks aliEnRIK:) above is the log after performing the quick scan, it had found one thing which I fixed, I'm now performing the full scan as advised, the quick one took 14 mins so this one might take a while, thanks again.

spike7451

I'd also bin IE in favor of Firefox which is more secure.

glowgirl_2

spike7451 wrote: »

I'd also bin IE in favor of Firefox which is more secure.

Is firefox ok for windows? I was going to change to Chrome once I'm sorted, do you think firefox would be better?

glowgirl_2

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org
Database version: 5270
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975
08/12/2010 13:39:18
mbam-log-2010-12-08 (13-39-18).txt
Scan type: Full scan (C:\|D:\|E:\|)
Objects scanned: 260978
Time elapsed: 2 hour(s), 0 minute(s), 48 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\program files\windows live\messenger\msimg32.dll (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\program files\windows live\messenger\riched20.dll (PUP.FunWebProducts) -> Quarantined and deleted successfully.

Ok this is the log for the full scan, I have rebooted and am just about to do the next thing.

glowgirl_2

I cant seem to download hijack this its very very slow and then gets stuck halfway through - what can I do?

debitcardmayhem

Try direct from trend micro here http://free.antivirus.com/hijackthis/

Down load the installer one

aliEnRIK

After posting the hijack log -
Download SUPERANTISPYWARE (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_superantispyware/
UPDATE and PERFORM COMPLETE SCAN
(Then goto console and LOGS and post the log it created then untick it from STARTING UP WITH WINDOWS)

glowgirl_2

debitcardmayhem wrote: »

Try direct from trend micro here http://free.antivirus.com/hijackthis/

Down load the installer one

Thanks that worked:) I'm doing the other steps now.

dazarooney1987

glowgirl wrote: »

Is firefox ok for windows? I was going to change to Chrome once I'm sorted, do you think firefox would be better?

Go for Chrome, it's so much quicker than Firefox

On another note, I remember having a similar problem you were having and I had to reinstall to get rid of the problem