Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google Search Results Redirect


  • This topic is locked This topic is locked
2 replies to this topic

#1 Conservative Chaos

Conservative Chaos

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:37 PM

Posted 11 February 2009 - 10:40 AM

I'm grasping for straws here guys. I need help. Both Firefox and IE7 google search results are taking me to random locations. Clicking on results sometimes redirects to the likes of monstermarketplace.com, hotjobs.yahoo.com, etc. I have searched the forums for similar instances, but none of the fixes that were done in those situations have yielded any results for me. Here are the scanners, applications I have ran in attempting to fix this malware/spyware.

Mcafee antivirus - full scan
Trendmicro Housecall- full scan
Kaspersky Online Scan - Full scan
Malwarebytes - full scan
Ad-Aware - Full Scan
Windows Defender - Full Scan
Combofix - standard scan
fixwareout
ATFcleaner

I made sure all of these applications were up to date with newest definitions, but what items they did find have not solved my issue.

DDS (Ver_09-02-01.01) - NTFSx86
Run by bob at 10:54:58.40 on Wed 02/11/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.998.426 [GMT -5:00]

AV: McAfee VirusScan Enterprise *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\MPC\jetty\DMWebSrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\MPC\java\bin\java.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\MPC\system_monitor\agent\smaagent.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\Qliner Hotkeys\HotKeys.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\RightFax\Client\FaxCtrl.exe
C:\WINDOWS\sttray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Relative Date.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\PROGRA~1\UNIFIE~1\LineMgr.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\caseyr\Desktop\dds.scr

============== Pseudo HJT Report ===============

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptcl.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [updateMgr] c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe AcRdB7_1_0
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\udaterui.exe" /StartedFromRunKey
mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE
mRun: [00Hotkeys] "c:\program files\qliner hotkeys\HotKeys.exe"
mRun: [RightFAX Print-to-Fax Driver] c:\program files\rightfax\client\FaxCtrl.exe
mRun: [SigmatelSysTrayApp] sttray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
StartupFolder: c:\docume~1\caseyr\startm~1\programs\startup\relati~1.lnk - c:\Relative Date.exe
mPolicies-explorer: NoWinKeys = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1217615491952
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} - hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\caseyr\applic~1\mozilla\firefox\profiles\2n3wj170.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-2-11 64160]
R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2008-1-24 31816]
R2 caniodrvr;caniodrvr;c:\mpc\system_monitor\agent\drivers\Caniodrvr.sys [2005-8-24 4096]
R2 DMWebSrv;MPC Desktop System Manager Web Server;c:\mpc\jetty\dmwebsrv.exe -s c:\mpc\jetty\dmwebsrv.conf --> c:\mpc\jetty\dmwebsrv.exe -s c:\mpc\jetty\DMWebSrv.conf [?]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 950096]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2009-1-16 103744]
R2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\Mcshield.exe [2008-1-24 144704]
R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2008-1-24 54608]
R2 SMAgent;MPC Desktop System Manager Agent;c:\mpc\system_monitor\agent\smaagent.exe dml 0 --> c:\mpc\system_monitor\agent\smaagent.exe DML 0 [?]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2008-8-1 72936]
R3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2008-8-1 33960]
R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2008-8-1 171400]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
S3 ultradfg;ultradfg;c:\windows\system32\drivers\ultradfg.sys [2008-10-2 24576]

=============== Created Last 30 ================

2009-02-11 10:02 270 a---h--- C:\aaw7boot.cmd
2009-02-11 09:39 15,688 a------- c:\windows\system32\lsdelete.exe
2009-02-11 09:35 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-02-11 09:27 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-02-11 09:25 82,768 a------- c:\windows\system32\lmdimon8.dll
2009-02-11 09:24 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Applications
2009-02-10 17:08 <DIR> --d----- c:\windows\system32\XPSViewer
2009-02-10 17:07 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-02-10 17:07 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-10 17:07 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-10 17:07 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-10 17:07 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-02-10 17:07 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-02-10 17:07 117,760 -------- c:\windows\system32\prntvpt.dll
2009-02-10 17:07 <DIR> --d----- C:\7648320d14cd5352d6228dc9811519
2009-02-10 13:56 73,728 a------- c:\windows\system32\javacpl.cpl
2009-02-10 13:56 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-10 13:30 <DIR> a-dshr-- C:\cmdcons
2009-02-10 13:27 98,816 a------- c:\windows\sed.exe
2009-02-10 13:27 <DIR> --d----- C:\ComboFix
2009-02-10 12:07 <DIR> --d----- C:\fixwareout
2009-02-10 12:05 <DIR> --d----- c:\documents and settings\caseyr\.housecall6.6
2009-02-06 14:59 <DIR> --d----- c:\docume~1\caseyr\applic~1\Malwarebytes
2009-02-06 14:59 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-06 14:59 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-06 14:59 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-06 14:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-05 16:23 <DIR> --d----- C:\VundoFix Backups
2009-02-05 15:30 978 a------- c:\windows\system32\SiteList.xml
2009-02-05 14:25 <DIR> --d----- c:\program files\Lavasoft
2009-02-05 14:20 <DIR> --d----- c:\program files\Trend Micro
2009-02-05 14:08 1,104 a------- c:\windows\luqaderj
2009-02-05 13:29 <DIR> --d----- c:\windows\system32\Adobe
2009-01-28 16:17 <DIR> --d----- c:\docume~1\caseyr\applic~1\S-5-4-02
2009-01-28 16:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\S-5-4-02
2009-01-28 16:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\OZ
2009-01-23 17:08 <DIR> --d-h--- c:\windows\system32\GroupPolicy
2009-01-22 13:15 <DIR> --d----- C:\NES

==================== Find3M ====================

2008-12-20 18:15 826,368 a------- c:\windows\system32\wininet.dll
2008-11-10 11:55 30 a------- c:\documents and settings\caseyr\jagex_runescape_preferences.dat
2008-07-23 12:50 184,193 a--shr-- c:\windows\system32\sz390agk.dat
2008-07-23 12:20 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat
2008-08-01 13:57 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008080120080802\index.dat

============= FINISH: 10:55:29.09 ===============

Attached Files


Edited by Conservative Chaos, 11 February 2009 - 10:59 AM.


BC AdBot (Login to Remove)

 


#2 Conservative Chaos

Conservative Chaos
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:37 PM

Posted 11 February 2009 - 11:42 AM

Please close this topic. After further investigation I found that it was redirecting to clickfraudmanager.com. I found several topics regrading this new problem. This one was the most helpful.

http://forums.mozillazine.org/viewtopic.ph...8&t=1085175

I ended up deleting all the directories in my 'C:\Program Files\Mozilla Firefox\extensions' folder which seems to have solved my problem.

#3 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Staff Emeritus
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the &quot;Logic Free Zone&quot;, in Md, USA
  • Local time:06:37 PM

Posted 18 February 2009 - 06:22 PM

Thanks for informing us.

This Topic is closed.

Should you need it reopened, please contact a Forum Moderator. Include the address of this thread in your request.

If you have a new issue, please start a New Topic.

This applies only to the original poster. Everyone else please begin a New Topic.

R,
K
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users