McAfee sites blocked, redirected websites, help!

Hi I'm new to this forum (actually new to forums in general) and I'm in need of some help.

I've been fighting a virus/malware/trojan/etc for a few days now and feel like I'm stuck.

System Info:
Windows XP Pro Service Pack 3
Internet Explorer 7

Here's the symptoms:
-Cannot update McAfee Suite (the free version for Comcast subscribers)
-Cannot visit any McAfee website ("The website is unable to display the webpage")
-Occasionally when I click on a link I'm redirected to a random other site (usually businesses)
-When redirected, I've seen web addresses such as "www.abcsearch.com", "redirect.clicksheild.net"
-When typing CMD or REGEDIT into the Run dialog box, the screen flashes and the Windows icons reload, the black command box dissappears instantly

Here's what I've done:
-AdAware - updated and ran - found a few things, all removed
-SuperAntiSpyware - installed, updated and ran - found a few things, all removed
-MalwareBytes - installed and ran - could not update ("update failed") - found a few things, all removed
-McAfee - ran - hasn't found anything
-Norton Online Scan - ran - didn't find anything
I've run all the programs multiple times, in Safe Mode and under normal startup

I'm starting to get very frustrated and contemplating a hard drive format unless someone can help me out.

Thank you so much!

Try this scan - you can copy it over from another computer on a CD or pen drive if you need to.

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download DrWeb-CureIt and save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:

• Double-click on drweb-cureit.exe to open the program and click Start. (There is no need to update if you just downloaded the most current version
• Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
• If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)

• After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
• In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
• Please be patient as this scan could take a long time to complete.
• When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
• Click Select All, then choose Cure > Move incurable.
• In the top menu, click file and choose save report list.
• Save the DrWeb.csv report to your desktop.
• Exit Dr.Web Cureit when done.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

Thanks so much for replying.

I followed your instructions and Dr Web CureIt found 1 virus. Here is the contents of the DrWeb.csv file:

dqtscd.qtu;C:\WINDOWS;Trojan.DownLoad.36204;Deleted.;

The problems listed above still remain though.

Run a full-scan with SUPERAntiSpyware in Safe Mode and post the log.

How to start Windows in Safe Mode

Ok I ran SuperAntiSpyware in safe mode and here is the log file. The same thing keeps getting detected.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/07/2009 at 07:27 PM

Application Version : 4.26.1002

Core Rules Database Version : 3875
Trace Rules Database Version: 1823

Scan type : Complete Scan
Total Scan Time : 00:54:27

Memory items scanned : 285
Memory threats detected : 0
Registry items scanned : 5549
Registry threats detected : 8
File items scanned : 78870
File threats detected : 6

Adware.Tracking Cookie
C:\Documents and Settings\Dave\Cookies\dave@insightexpressai[2].txt
C:\Documents and Settings\Dave\Cookies\dave@atdmt[2].txt
C:\Documents and Settings\Dave\Cookies\dave@revsci[2].txt
C:\Documents and Settings\Dave\Cookies\dave@doubleclick[1].txt
C:\Documents and Settings\Dave\Cookies\dave@mediaplex[2].txt
C:\Documents and Settings\Dave\Cookies\dave@apmebf[1].txt

Adware.MyWebSearch/FunWebProducts
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid32
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid32
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib

Are you now able to update Malwarebytes?

If so, run a qucik-scan in normal-mode and post the log.

I still cannot update MalwareBytes. I even made sure my firewall was shut off. I did a scan anyway but it didn't find anything. Here is the log:

Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 5.1.2600 Service Pack 3

5/8/2009 7:30:57 PM
mbam-log-2009-05-08 (19-30-57).txt

Scan type: Quick Scan
Objects scanned: 103600
Time elapsed: 19 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Try this scan:

http://www.bleepingcomputer.com/forums/t/131299/how-to-use-sdfix/

I tried the SDFix you recommended and I can't get it to work at all. I followed all of the troubleshooting steps but when it is run (in safe mode), the screen flashed and the window that asks you if you want to be in safe mode comes up (just like you first started Windows). When you click yes (for yes to start in safe mode) it returns to Windows.

Appears to me that I am completely locked out of any command screen.

How is your computer running now? Any more signs of infection?

Yes all of the original symptoms are still there (can't get into McAfee websites, can't use CMD, can't update McAfee, etc).

Try running RRT (Remove Restrictions Tool):

http://www.majorgeeks.com/RRT_Remove_Restr...Tool_d5635.html

And then try SDFix again.

Edited by Budapest, 10 May 2009 - 10:08 PM.

Just tried it. SDFix still doesn't work. I also still cannot get into regedit or cmd.

Try the fix at Kelly's Korner.

Lift Restrictions - TM, Regedit and CMD - #275 on the left.

Right click on it and save the .vbs file to your desktop. Then, double click on the file icon (on your desktop) to run the script. You may need to reboot your computer for the changes to take affect.

I ran the program you recommended from Kelly's Korner but I still can't run SDFix or get into CMD or REGEDIT.

I can't wait any longer knowing something is still in here so I will be formatting the whole system and starting from scratch.

I truly appreciate the time you spent trying to help me. Thank you.