BleepingComputer.com: Google redirect turned to nonfunctioning firefox

 SystemLook 30.07.11 by jpshortstuff
Log created at 21:53 on 05/10/2011 by Meghan
Administrator - Elevation successful

========== service ==========

DHCP
DHCP Client
"Registers and updates IP addresses and DNS records for this computer. If this service is stopped, this computer will not receive dynamic IP addresses and DNS updates. If this service is disabled, any services that explicitly depend on it will fail to start."
Current Status: Stopped
Startup Type: Automatic
Error Control: Severe
Binary: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Group: TDI
SafeBoot: Network Network(Group)
Dependencies:
->NSI
->Tdx
->Afd
Dependant Services:
->WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc) (Stopped)

Dnscache
DNS Client
"The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer's name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start."
Current Status: Stopped
Startup Type: Automatic
Error Control: Severe
Binary: C:\Windows\system32\svchost.exe -k NetworkService
Group: TDI
SafeBoot: Network Network(Group)
Dependencies:
->Tdx
Dependant Services:
(none)

NSI
Network Store Interface Service
"This service delivers network notifications (e.g. interface addition/deleting etc) to user mode clients. Stopping this service will cause loss of network connectivity. If this service is disabled, any other services that explicitly depend on this service will fail to start."
Current Status: Started
Startup Type: Automatic
Error Control: Severe
Binary: C:\Windows\system32\svchost.exe -k LocalService
Group: (none)
SafeBoot: Network
Dependencies:
->nsiproxy
Dependant Services:
->SL UI Notification Service (SLUINotify) (Stopped)
->Network List Service (netprofm) (Started)
->Network Location Awareness (NlaSvc) (Started)
->Internet Connection Sharing (ICS) (SharedAccess) (Stopped)
->Network Connections (Netman) (Started)
->Terminal Services Configuration (SessionEnv) (Stopped)
->Netlogon (Netlogon) (Stopped)
->Computer Browser (Browser) (Started)
->Workstation (LanmanWorkstation) (Started)
->IP Helper (iphlpsvc) (Stopped)
->WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc) (Stopped)
->DHCP Client (Dhcp) (Stopped)

TDX - Unable to open Service Handle.

AFD
Ancilliary Function Driver for Winsock
"Ancilliary Function Driver for Winsock"
Current Status: Started
Startup Type: System
Error Control: Normal
Binary: \SystemRoot\system32\drivers\afd.sys
Group: PNP_TDI
SafeBoot: Network Network(Group)
Dependencies:
(none)
Dependant Services:
->TCP/IP NetBIOS Helper (lmhosts) (Started)
->WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc) (Stopped)
->DHCP Client (Dhcp) (Stopped)

========== reg ==========

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dhcp]
"ServiceDll"="%SystemRoot%\system32\dhcpcsvc.dll"
"DisplayName"="@%SystemRoot%\system32\dhcpcsvc.dll,-100"
"Group"="TDI"
"ImagePath"="%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted"
"Description"="@%SystemRoot%\system32\dhcpcsvc.dll,-101"
"ObjectName"="NT Authority\LocalService"
"ErrorControl"= 0x0000000001 (1)
"Start"= 0x0000000002 (2)
"Type"= 0x0000000020 (32)
"DependOnService"="NSI Tdx Afd"
"ServiceSidType"= 0x0000000001 (1)
"RequiredPrivileges"="SeChangeNotifyPrivilege SeCreateGlobalPrivilege"
"FailureActions"=80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 01 00 00 00 c0 d4 01 00 01 00 00 00 e0 93 04 00 00 00 00 00 00 00 00 00  (REG_BINARY)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dhcp\Configurations]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dhcp\Linkage]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dhcp\Parameters]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dhcp\Parametersv6]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dhcp\Security]


-= EOF =- 

This post has been edited by cadmonkey: 05 October 2011 - 09:57 PM

Hi cadmonkey,

We're slowly getting to fixing your computer. Thanks for being patient. I want to try to fix your Internet connection first. I've been trying to diagnose why you're not able to get an Internet connection, and I think it's due to a missing critical file. This will hopefully confrim my suspicion:

Rerun SystemLook

• Double-click SystemLook.exe to run it.
  
• Type the content of the following codebox into the main textfield:
  

  :filefind
  tdx.sys

  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

 SystemLook 30.07.11 by jpshortstuff
Log created at 22:28 on 05/10/2011 by Meghan
Administrator - Elevation successful

========== filefind ==========

Searching for "tdx.sys"
C:\Windows\System32\drivers\tdx.sys	--a---- 72192 bytes	[00:29 12/01/2010]	[04:10 28/09/2011] 76B06EB8A01FC8624D699E7045303E54
C:\Windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6001.18000_none_ea3dc84bdc15a8b7\tdx.sys	--a---- 71680 bytes	[02:24 21/01/2008]	[02:24 21/01/2008] D09276B1FAB033CE1D40DCBDF303D10F
C:\Windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6002.18005_none_ec294157d9377403\tdx.sys	--a---- 72192 bytes	[00:29 12/01/2010]	[04:10 28/09/2011] 76B06EB8A01FC8624D699E7045303E54

-= EOF =- 

Hi cadmonkey,

Let's try this:

• Click on the Start menu
  
• In the search box type in: ncpa.cpl
  
• In the window that opens, right click on Wireless Network Connection and select Properties.
  
• Uncheck everything listed except for Internet Protocol Version 4 (TCP/IPv4)
  
• Click OK.
  
• Right click on the Wireless Network Connection and again select Properties.
  
• Click on Internet Protocol Version 4 (TCP/IPv4) and click on the Properties button.
  
• Select:
  
  • Obtain an IP address automatically
    
  • Obtain DNS server address automatically
  
  
• Click OK. Then click Close.

• Click on the Start button.
  
• Type Cmd in the Start Search text box.
  
• Right click on cmd and select Run as Administrator.
  
• Type netsh int ip reset in the Command Prompt window, and press the Enter key.
  
• Then type netsh winsock reset in the Command Prompt window, and press the Enter key.
  
• Restart the computer.

Rerun MiniToolBox
Checkmark following boxes:

• Report IE Proxy Settings
  
• Report FF Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List last 10 Event Viewer Log Errors

Click Go . Please put code boxes around just this entire log, like this, but without the letter x: [xcode] MiniToolBox log [/xcode]

This post has been edited by jntkwx: 05 October 2011 - 10:57 PM

 MiniToolBox by Farbar 
Ran by Meghan (administrator) on 05-10-2011 at 23:13:50
Windows Vista (TM) Home Premium Service Pack 2 (X86)

***************************************************************************

========================= IE Proxy Settings: ============================== 

Proxy is not enabled.
No Proxy Server is set.

========================= FF Proxy Settings: ============================== 

Hosts file not detected in the default directory
========================= IP Configuration: ================================

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset


popd
# End of IPv4 configuration



Windows IP Configuration

   Host Name . . . . . . . . . . . . : oid-PC
   Primary Dns Suffix  . . . . . . . : 
   Node Type . . . . . . . . . . . . : Broadcast
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : RP614v4

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : RP614v4
   Description . . . . . . . . . . . : Atheros AR5007EG Wireless Network Adapter
   Physical Address. . . . . . . . . : 00-21-63-BF-49-56
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Autoconfiguration IPv4 Address. . : 169.254.240.175(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 
   DNS Servers . . . . . . . . . . . : 192.168.100.1
   NetBIOS over Tcpip. . . . . . . . : Disabled

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Realtek RTL8102E Family PCI-E Fast Ethernet NIC (NDIS 6.0)
   Physical Address. . . . . . . . . : 00-1E-33-89-3A-EF
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 6:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : isatap.{0A2E6BA9-3B42-4B4C-BBFB-E7D86FD7E9DB}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 7:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : isatap.Belkin
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 11:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 02-00-54-55-4E-01
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 12:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : isatap.{073841FF-5BFD-4132-B13F-9B53D0BCB5AD}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 13:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : isatap.Belkin
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 14:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : 6TO4 Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 15:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : isatap.RP614v4
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
Server:  UnKnown
Address:  192.168.100.1

Ping request could not find host google.com. Please check the name and try again.

Server:  UnKnown
Address:  192.168.100.1

Ping request could not find host yahoo.com. Please check the name and try again.



Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
 11 ...00 21 63 bf 49 56 ...... Atheros AR5007EG Wireless Network Adapter
 10 ...00 1e 33 89 3a ef ...... Realtek RTL8102E Family PCI-E Fast Ethernet NIC (NDIS 6.0)
  1 ........................... Software Loopback Interface 1
 15 ...00 00 00 00 00 00 00 e0  isatap.{0A2E6BA9-3B42-4B4C-BBFB-E7D86FD7E9DB}
 17 ...00 00 00 00 00 00 00 e0  isatap.Belkin
 12 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
 13 ...00 00 00 00 00 00 00 e0  isatap.{073841FF-5BFD-4132-B13F-9B53D0BCB5AD}
 14 ...00 00 00 00 00 00 00 e0  isatap.Belkin
 16 ...00 00 00 00 00 00 00 e0  6TO4 Adapter
 18 ...00 00 00 00 00 00 00 e0  isatap.RP614v4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link   169.254.240.175    281
  169.254.240.175  255.255.255.255         On-link   169.254.240.175    281
  169.254.255.255  255.255.255.255         On-link   169.254.240.175    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link   169.254.240.175    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link   169.254.240.175    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
  1    306 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

========================= Event log errors: ===============================

Application errors:
==================
Error: (10/05/2011 11:03:15 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/05/2011 03:32:21 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2011 11:58:07 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2011 11:38:24 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/04/2011 07:56:31 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\MEGHAN\DESKTOP\VIDEOS\PICTURES> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog

Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (10/04/2011 07:56:31 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\MEGHAN\DESKTOP\VIDEOS\PICTURES> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog

Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (10/04/2011 07:55:21 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/03/2011 06:00:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/29/2011 05:42:14 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (09/29/2011 00:43:59 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c


System errors:
=============
Error: (10/05/2011 11:03:15 PM) (Source: Service Control Manager) (User: )
Description: stcy

Error: (10/05/2011 11:03:15 PM) (Source: Service Control Manager) (User: )
Description: MCSTRM%%2

Error: (10/05/2011 11:03:15 PM) (Source: Service Control Manager) (User: )
Description: IP HelperTdx

Error: (10/05/2011 11:03:15 PM) (Source: Service Control Manager) (User: )
Description: DNS ClientTdx

Error: (10/05/2011 11:03:15 PM) (Source: Service Control Manager) (User: )
Description: DHCP ClientTdx

Error: (10/05/2011 05:24:43 PM) (Source: Service Control Manager) (User: )
Description: DNS ClientTdx

Error: (10/05/2011 05:21:31 PM) (Source: Service Control Manager) (User: )
Description: DHCP ClientTdx

Error: (10/05/2011 04:48:54 PM) (Source: Service Control Manager) (User: )
Description: 30000Netman

Error: (10/05/2011 03:32:21 PM) (Source: Service Control Manager) (User: )
Description: stcy

Error: (10/05/2011 03:32:21 PM) (Source: Service Control Manager) (User: )
Description: MCSTRM%%2


Microsoft Office Sessions:
=========================

**** End of log ****
 

Hi cadmonkey,

Have you had problems with the wireless connection on this computer before? Is it possible for you to connect it to your router with an Internet cable, instead of through a wireless connection?

I've never had problems with that laptop's internet connection at all, wired or wireless. I did check before first posting on here though; I unplugged the ethernet cable from my desktop (knowing that the internet was working on there with it) and plugged it into the laptop, which didn't work. Whether wired or wireless I seems to get stuck at on the identifying part. (It looks like the picture when I open the Network & Sharing Center, except with my router's name; access: local only; signal strength: excellent)



Like I said in my original post, I started having the google redirect thing happen a few weeks ago, then when I got fed up with that, I attempted to run malwarebytes and things have just gone downhill from there. Malwarebyte's opened but would then shut down after a few seconds as if it had never opened in the first place. I have reset my modem & router, and they seem to be working for my desktop, so the problem seems to be with the laptop. Other wireless devices in our house have been able to work off our router, so I know it's not the internet connection or router.

Thanks for all the help so far by the way. I hope we can still get it fixed!

Hi cadmonkey,

Yes, if other computers can access the Internet fine, then the problem is with your computer. Good troubleshooting!

Let's try rebooting into Safe Mode with Networking.
This can be done tapping the F8 key as soon as you start your computer
You will be brought to a menu with several options. Press the down arrow key on your keyboard until Safe Mode with Networking is selected. Press Enter. Please see here for additional details.

Once your computer is started in Safe Mode with Networking, please let me know if the Internet connection works or not.

Still didn't work. All of my homepage tabs (yahoo mail, gmail, & facebook) all still say server not found; I'm getting the same response for any other page I try to open as well. It did seem to take quiet a long time to start up and to log-on to my desktop after signing in, much longer than it did before it started having these problems.

Hi cadmonkey,

I have a feeling your Internet troubles are due to malware. However, unfortunately there are a limited number of tools I'm allowed to use in the Am I Infected forum. So, with the information you have provided I believe you will need help from the malware removal team. I would like you to start a new thread HERE and include a link to this thread. Please make sure that you read the information about getting started before you start your thread.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and please be patient. There is currently a large backlog of people being helped. It may take several days for someone to respond.

Jumped this over to Virus, Trojan, Spyware, and Malware Removal logs.

Thanks for all the help through here!! Maybe everything done through here will help this work out over there!

Here is the link to the new topic.

Hello,

Now for the hard and frustrating part: waiting.

Now that you have posted a log, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom