Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Search engine redirect


  • This topic is locked This topic is locked
2 replies to this topic

#1 snakeeyed

snakeeyed

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 02 March 2009 - 07:39 AM

Using Firefox I'm getting redirected from Google and Yahoo search engines every few times I click on a search result link. I'm getting redirected to www.fasttools.biz most often, and various other sites.

DDS results:

DDS (Ver_09-02-01.01) - NTFSx86
Run by Stuart at 22:30:35.82 on Mon 02/03/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Home Edition 5.1.2600.2.1252.61.1033.18.511.139 [GMT 10:00]


============== Running Processes ===============

D:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
D:\WINDOWS\System32\svchost.exe -k netsvcs
D:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\dvd43\dvd43_tray.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\system32\cisvc.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
D:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Internet Download Manager\IDMan.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
D:\WINDOWS\System32\tcpsvcs.exe
D:\WINDOWS\System32\svchost.exe -k imgsvc
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
D:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
D:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
D:\WINDOWS\System32\svchost.exe -k HTTPFilter
D:\Program Files\Internet Download Manager\IEMonitor.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\cidaemon.exe
D:\Documents and Settings\Stuart\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
mWinlogon: Shell=Explorer.exe D:\WINDOWS/system32/SVCH0ST.EXE
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - d:\program files\internet download manager\IDMIECC.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Click-to-Call BHO: {5c255c8a-e604-49b4-9d64-90988571cecb} - d:\program files\windows live\messenger\wlchtc.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - d:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - d:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - d:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - d:\program files\windows live\toolbar\wltcore.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "d:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [PC Suite Tray] "d:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray
uRun: [Nokia.PCSync] "d:\program files\nokia\nokia pc suite 7\PCSync2.exe" /NoDialog
uRun: [ctfmon.exe] d:\windows\system32\ctfmon.exe
uRun: [IDMan] d:\program files\internet download manager\IDMan.exe /onboot
mRun: [NvCplDaemon] RUNDLL32.EXE d:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE d:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [dvd43] d:\program files\dvd43\dvd43_tray.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [NeroFilterCheck] d:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "d:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [AppleSyncNotifier] d:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "d:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "d:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "d:\program files\java\jre6\bin\jusched.exe"
dRun: [CTFMON.EXE] d:\windows\system32\CTFMON.EXE
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - d:\program files\microsoft office\office10\OSA.EXE
IE: Download all links with IDM - d:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - d:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - d:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - d:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: DirectAnimation Java Classes - file://d:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://d:\windows\java\classes\xmldso.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1220783019031
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
TCP: NameServer = 85.255.112.39,85.255.112.40
TCP: {B8B5828D-4F16-441D-8413-BC456800BF74} = 85.255.112.39,85.255.112.40
TCP: {D0786B9C-7323-4151-9BC5-ED25FB98B5F5} = 85.255.112.39,85.255.112.40
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - d:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - d:\docume~1\stuart\applic~1\mozilla\firefox\profiles\hpz0yno5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: d:\documents and settings\stuart\application data\idm\idmmzcc2\components\idmmzcc.dll
FF - plugin: d:\program files\microsoft\office live\npOLW.dll
FF - plugin: d:\program files\windows live\photo gallery\NPWLPG.dll

============= SERVICES / DRIVERS ===============

R2 fssfltr;FssFltr;d:\windows\system32\drivers\fssfltr_tdi.sys [2009-1-9 55136]
R2 Iprip;RIP Listener;d:\windows\system32\svchost.exe -k netsvcs [2002-8-29 14336]
R2 SeaPort;SeaPort;d:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2008-12-4 226640]
S3 fsssvc;Windows Live Family Safety;d:\program files\windows live\family safety\fsssvc.exe [2008-12-8 533344]

=============== Created Last 30 ================

2009-03-02 21:53 73,728 a------- d:\windows\system32\javacpl.cpl
2009-03-02 18:44 46,456 a----r-- d:\windows\system32\exitwx.exe
2009-03-02 18:39 661,808 a------- d:\windows\system32\UfWSC.cpl
2009-02-17 08:44 410,984 a------- d:\windows\system32\deploytk.dll
2009-02-15 09:07 <DIR> --d----- d:\program files\freshplay

==================== Find3M ====================

2009-01-10 11:35 103 a------- d:\documents and settings\stuart\HiroConfig.dat
2008-12-21 09:15 826,368 a------- d:\windows\system32\wininet.dll
2008-12-17 21:03 206,256 a------- d:\windows\system32\idmmbc.dll
2008-12-04 22:55 307,560 a------- d:\windows\WLXPGSS.SCR
2008-12-02 22:37 49,480 a------- d:\windows\system32\sirenacm.dll
2008-08-01 10:20 17,144 a------- d:\docume~1\stuart\applic~1\GDIPFONTCACHEV1.DAT

============= FINISH: 22:31:14.76 ===============


Tried a Kapersky online scan but it reported an error and requested I go online.

Please help.

Attached Files



BC AdBot (Login to Remove)

 


#2 mas_pogi

mas_pogi

    Carpal Tunnel of Love


  • Members
  • 1,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tokyo, JP
  • Local time:03:10 PM

Posted 07 March 2009 - 06:26 PM

Hello snakeeyed,

Welcome to Bleeping Computer.

My name mas_pogi and I will be helping you with your Malware problem.
As I am still in training I will be helping you under supervision of our expert teachers, so there may be a delay between posts.

Attention!

Please do not run any other tool untill instructed to do so.
Please tell me about any problems that have occurred during the fix.
Please tell me of any other symptoms you may be having as these can help also.
Please try as much as possible not to run anything while executing a fix.
Please reply to this thread, do not start another.




You might want to save this page on your bookmark, so you can find it again when you return.

Firefox: Posted Image Then click on Done.

IExplorer: Posted Image Then click on Add.

Stay calm. :thumbup2:


Download GMER from here:
http://www.gmer.net/files.php

Unzip it to the desktop.

Open the program and click on the Rootkit tab.
Make sure all the boxes on the right of the screen are checked, EXCEPT for 'Show All'.
Click on Scan.
When the scan has run click Copy and paste the results (if any) into this thread.


With Regards,
mas_pogi

#3 snakeeyed

snakeeyed
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 08 March 2009 - 05:14 AM

thanks for the reply!
Unfortunately I lost patience before you posted and formatted the computer. Problem solved!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users