BleepingComputer.com: Google Redirect After Effects

Thank you - I may not get to do all of this right away, so I apologize for the delay in advance.

No problem

Ran the Temp File Cleaner (very nice program) and the ESET Online Scanner (including the checkmark for Scan archives). No threats were found.

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

=================================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll remove all old restore points and create fresh, clean restore point.

Turn system restore off.
Restart computer.
Turn system restore back on.

If you don't know how to do it...
Windows XP: http://support.microsoft.com/kb/310405
Vista and Windows 7: http://www.howtogeek.com/howto/windows-vista/disable-system-restore-in-windows-vista/

2. Make sure, Windows Updates are current.

3. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

4. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

5. Run Temporary File Cleaner (TFC) weekly.

6. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

7. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

8. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

9. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

Wow, what an ordeal!

I couldn't install Adobe Reader X - kept getting a "Download Configuration Failed" in the Adobe Download Windows (the window that shows the download progress). It kept failing at 33%.

I uninstalled the previous version of Adobe Reader.

I was finally able to get Adobe 8.3 installed by getting it directly from Adobe's FTP site. I will keep trying to update it when I can.

However, I am STILL getting the Google Redirect issue.

This is very frustrating. I know what you mean about the computer being "clean", but there is obviously something still going on.

Obviously, I'm concerned about the C:\WINDOWS\system32\setupt.dll **INFECTED** Win32:MalOb-GD [Cryp] that was found earlier - is there a reason why we are ignoring this?

Thanks again for your help.

Jim

I have appeared to have resolved the issue.

I downloaded and installed Microsoft Security Essentials. However, when I started it, the MSE screen would come up briefly, but disappear. I did a search for that issue and found the solution:

Open Task Manager and select Rundll32.exe - right-click and select End Process Tree. That kills the process that is causing an issue - MSE should now be able to find it.

Start MSE. Found the culprit the discussed earlier - in setupt.dll, there was a trojan in there called Win32/Vundo.gen!AV - cleaned that up, restarted and ran another scan.

Now, the searches are working in both IE and Firefox. I've done at least 20 to 30 with no redirects when clicking search results. Usually you would get one, maybe two clicks without redirects before the issue would appear.

Thank you VERY much for your help. You helped me find a file that I had suspicions about previously and showed that there was an issue with it. I'm glad I was able to finally find something to resolve this issue.

Nice job