Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google search links keep redirecting me to ads


  • Please log in to reply
8 replies to this topic

#1 Orange Milk

Orange Milk

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:14 AM

Posted 20 December 2009 - 01:40 PM

Ok, so for a little while now, what my title says has been going on. I tried Malwarebytes, but it never finds anything. Well just a couple days ago, my computer would not boot to Windows at all. It said some important file is missing, and to press 'r' to start recovery (which did nothing). Well, right when I was about to reformat it (which was later in the day, after I tried to do some other things to get it working) it starts to boot up again! I still have viruses, such as google ads, and also whenever I do boot up the computer it tries to run some anti-virus program from the start, and it won't quit unless I ctrl-alt-dlt it (forgot the name of it though).

So any help would be appreciated.. It's hard to look up help on google due to the redirects, and on yahoo I don't see anything helpful.

BC AdBot (Login to Remove)

 


#2 Computer Pro

Computer Pro

  • Members
  • 2,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:14 AM

Posted 20 December 2009 - 06:42 PM

Hello and welcome to Bleeping Computer.

Please subscribe to your topic so that you will be notified as soon as I post a reply, instead of you having to check the topic all of the time. This will allow you to get an email notification when I reply.

To subscribe, go to your topic, and at the top right hand corner by your first post, click the Options button and then click Track this topic. Then bullet the immediate notification bubble. Finally, press submit.



Can you please post your latest Malwarebytes log? It can be found under the "Logs" tab of the program
Computer Pro

#3 Orange Milk

Orange Milk
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:14 AM

Posted 20 December 2009 - 09:19 PM

Ehh, sure.. I get the same results with a full scan too, btw..

Malwarebytes' Anti-Malware 1.42
Database version: 3289
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/20/2009 9:00:27 PM
mbam-log-2009-12-20 (21-00-27).txt

Scan type: Quick Scan
Objects scanned: 131504
Time elapsed: 6 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


I was thinking of just reformatting my computer completely.. I'm probably going to get a couple computer games for Christmas, and I don't want it crashing then. Since I don't really have that much important files (since the last time I had to reformat, which was over the summer. I still have the thread if you guys want to see it.) I was thinking of just starting it over again...

#4 Computer Pro

Computer Pro

  • Members
  • 2,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:14 AM

Posted 20 December 2009 - 09:25 PM

Please update Malwarebytes's database as it is outdated. You can do so by going to the Update Tab, and then Rerun a Full scan and post back the log.
Computer Pro

#5 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:10:14 AM

Posted 20 December 2009 - 09:25 PM

Ok , this could be several things , first of all i suggest installing avast and allowing it to do an "on boot scan" , secondly this could a few different nasties , 1 is through the hosts file Repair here

Also Try IE8 >> Tools >> Internet Options >> Advanced tab >> RESET button (bottom)
Microsoft Certified Desktop Support Technician

#6 Orange Milk

Orange Milk
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:14 AM

Posted 20 December 2009 - 10:09 PM

Oh wow, this time I did find some viruses! It was only a quick scan, because I have to leave soon and don't have the time for a full one. Anyway, here is the log:

Malwarebytes' Anti-Malware 1.42
Database version: 3400
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/20/2009 10:04:42 PM
mbam-log-2009-12-20 (22-04-42).txt

Scan type: Quick Scan
Objects scanned: 134588
Time elapsed: 9 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 13

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Deborah\Local Settings\Temp\exMf.dll (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\Deborah\Local Settings\Temp\C1.tmp (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\Deborah\Local Settings\Temp\qLNd.dll (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Local Settings\Temp\BE.tmp (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Local Settings\Temp\BF.tmp (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Local Settings\Temp\C0.tmp (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Local Settings\Temp\C1.tmp (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Local Settings\Temp\exMf.dll (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Local Settings\Temp\qLNd.dll (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\Deborah\Local Settings\Temporary Internet Files\Content.IE5\ETM345QF\eH8cdff8c0V03005f35002R0143fdee102Tc7c7e610Q00000041900807F0020000aJ0f000601l0409316P000800070[1] (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\Deborah\Local Settings\Temporary Internet Files\Content.IE5\W5Q74TU7\eH8cdff8c0V03005f35002R0143fdee102Tc7c7e615Q00000041900807F0020000aJ0f000601l04093180[1] (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\ETM345QF\eH8cdff8c0V03005f35002R0143fdee102Tc7c7e610Q00000041900807F0020000aJ0f000601l0409316P000800070[1] (Rootkit.MBR) -> Quarantined and deleted successfully.
C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\W5Q74TU7\eH8cdff8c0V03005f35002R0143fdee102Tc7c7e615Q00000041900807F0020000aJ0f000601l04093180[1] (Rootkit.MBR) -> Quarantined and deleted successfully.


Also, I tried downloading Avast, but I got an error while downloading the files with the .exe. I will try again tomorrow. Oh, and this is in Firefox btw.

Edited by Orange Milk, 20 December 2009 - 10:09 PM.


#7 Computer Pro

Computer Pro

  • Members
  • 2,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:14 AM

Posted 20 December 2009 - 10:14 PM

Well their's a rootkit here, so I'm going to go ahead and turn you over to the HJT forum:

It looks like we are going to have to use more powerful tools than what we are allowed to use in the Am I Infected forum. I am going to need for you to post a DDS/HijackThis Log in the HijackThis Log section of the forum.

Please refer to this for your preparation reasons before posting:
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

You can find the forum here:
http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/

Once you have created a new topic in the HijackThis section, please post a link to it in this topic.
Please allow time for your topic to be replied to in the HijackThis section as the HJT Team is EXTREMELY busy posting logs before yours.
Computer Pro

#8 Orange Milk

Orange Milk
  • Topic Starter

  • Members
  • 85 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:14 AM

Posted 22 December 2009 - 09:10 PM

Ehh, sorry guys, but I'm just gonna reformat... This summer I had the same problem, and none of these methods helped. I'm not saying it's your fault, I'm just saying technology can suck sometimes.. Thanks anyway, though. :/

#9 Computer Pro

Computer Pro

  • Members
  • 2,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:14 AM

Posted 22 December 2009 - 09:33 PM

Your welcome. I am sorry that it had to end that way, and let us know if you have any other issues.
Computer Pro




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users