Google search results get redirected to random sites

I always use Google as my search engine - I recently noticed that if I search for info on a topic, it will generate results as usual, but when I click on any of the results links, rather than taking me to the page I am expecting, I get redirected to random sites (they are never the same from what I can tell, just completely random sites that are NOT the site I am looking to go to). Shortly after that (within minutes) I started getting random popups, including fake warnings of infections looking for me to purchase anti-virus programs I don't need nor do I want. At first, I attempted to run Malwarebytes Anti-Malware (MBAM) but I got a message saying it was infected...in fact everything I tried to open resulted in a message saying that the file was infected. At that point I shut down my computer and as soon as my desktop appeared I immediately opened MBAM and ran it. It found several issues, which I had it take care of. After that, I ran SUPER Anti-Spyware Free Edition, which found 2 items that I suppose MBAM did not pick up. Since these initial scans, I ran the programs again, as well as AVG Free anti-virus, all of which turned up nothing. I figured that took care of everything, so I went to test out Google and the problem with the search results getting redirected still existed. At that point I ran MBAM again and it came up with only one problem file. Again, I had MBAM take care of it. That brings us to today - scans reporting no problems, but Google still getting redirected. I don't know what to do and am looking for some help. I followed all the guidelines to prepare for this initial post - I was able to do all of the scans and I believe I have all the logs necessary. Please help me...thank you!


DDS (Ver_10-03-17.01) - NTFSx86
Run by Keith Woythaler at 19:00:43.74 on Sat 05/29/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.129 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\AccessDirect\DadTray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Keith Woythaler\Desktop\BLEEPING COMPUTER\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.optonline.net/
uInternet Connection Wizard,ShellNext = hxxp://www.dellnet.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\WCESCOMM.EXE"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [DadApp] c:\program files\dell\accessdirect\dadapp.exe
mRun: [DwlClient] c:\program files\common files\dell\eusw\Support.exe
mRun: [nwiz] nwiz.exe /installquiet
mRun: [MP10_EnsureFileVer] c:\windows\inf\unregmp2.exe /EnsureFileVersions
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wirele~1.lnk - c:\program files\linksys\wireless-g notebook adapter\Gcc.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INETREPL.DLL
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INETREPL.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201327103819
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1201327088577
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - c:\program files\microsoft activesync\AATP.DLL
WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL
WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL
WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL
WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL
WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\CENETFLT.DLL
WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\CENETFLT.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 AVG Anti-Rootkit;AVG Anti-Rootkit;c:\windows\system32\drivers\avgarkt.sys [2007-1-31 5632]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-8-30 28544]
R1 AvgArCln;Avg Anti-Rootkit Clean Driver;c:\windows\system32\drivers\AvgArCln.sys [2008-2-1 3968]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-3-15 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-2-1 29512]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-3-15 242896]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-11-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-11-23 74480]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-13 308064]
S0 zbkptu;zbkptu; [x]
S3 epstw2k;SCM Parallel Port SCSI Driver;c:\windows\system32\drivers\epstw2k.sys [2005-3-4 114944]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-11-23 7408]
S3 scsiscan;SCSI Scanner Driver;c:\windows\system32\drivers\scsiscan.sys [2005-3-4 11520]

=============== Created Last 30 ================


==================== Find3M ====================

2010-05-02 16:51:16 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-19 03:29:33 8783 ----a-w- c:\windows\system32\nvModes.dat
2010-03-19 22:05:50 4874240 ------w- c:\windows\system32\dllcache\wmp.dll
2010-03-13 14:14:35 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll
2002-12-16 12:20:26 207759 ----a-w- c:\program files\INSTALL.LOG

============= FINISH: 19:03:05.45 ===============

Hi Razorburne,

Welcome to Virus/Trojan/Spyware/Malware Removal (VTSMR) forum. I am going to assist you with your problem.

Please refrain from making any changes to your system (scanning or running other tools, updating Windows, installing applications, removing files, etc.) from now on as it might interfere with our fixes. Please let me know in your next reply if you agree with this.

The rootkit has patched the AVG driver.

1. Go to Start => Control Panel => Internet Options => click the "Connections" tab => Delete the numbers in the Address and Port box (if you have to check "Use a Proxy server for your LAN" to be able to remove the numbers, make sure you uncheck Use a Proxy server for your LAN again otherwise you will not be able to connect to internet). Click OK.
   
   
2. Download AVG 9 free edition from installer http://free.avg.com/nl-en/homepage and save it to your desktop. Don't install it yet.
   
   
3. Disconnect the computer from internet or at least make sure Windows firewall in enabled.
   
   
4. Go to ADD/Remove Programs and uninstall AVG then reboot the computer. After reboot make sure the following file is removed:
   
   c:\windows\system32\drivers\avgtdix.sys
   
   
5. Install AVG, connect to internet and update it.
   
   
6. Please download MBR.EXE by GMER. Save the file in your Windows directory (C:\Windows).
   
   Please run Notepad (start > All Programs > Accessories > Notepad) and copy and paste the text in the code box into a new file:
   
   
   CODE
   @echo off
   mbr.exe -t
   ping 1.1.1.1 -n 1 -w 1000 >nul
   start mbr.log
   
   
   • Go to the File menu at the top of the Notepad and select Save as.
   • Select Save in: desktop
   • Fill in File name: dirlook.bat
   • Save as type: All file types (*.*)
   • Click save.
   • Close the Notepad.
   • Locate look.bat on the desktop. It should look like this:
   • Double-click to run it.
   • A notepad opens, copy and paste the content (log.txt) to your reply.

farbar,

thank you so much for your quick response over this holiday weekend - I truly appreciate your help. First things first: I am completely fine with making no changes to my system until we take care of everything...consider it a non-issue. OK, so I did everything you told me to, step by step. After I unintalled AVG, I searched my computer for the avgtdix.sys file....it was still there, so I deleted it manually, cleared the recycle bin, and rebooting the computer before continuing. I searched once more and it was gone at that point. I followed your directions regarding MBR.exe, and here is the log file that appeared after running dirlook.bat:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK


Let me know what I need to do next. Again, thanks for your help in this matter - I look forward to hearing back from you soon.

The log is clean and the malware is taken care of.

1. Please download OTC and save it to Desktop.
   • Make sure you have internet connection.
   • Double-click OTC. In Windows Vista right-click to run it as administrator.
   • Click the CleanUp! button.
   • Select Yes when the "Begin cleanup Process?" prompt appears.
   • If you are prompted to Reboot during the cleanup, select Yes.
   
   
2. You delete mbr.exe and any remaining tool or log from your computer as they are not needed any more.
   
   
3. First Set a New Restore Point then Remove the Old Restore Points to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.
   
   To set a new restore point:
   • Go to Start > Programs > Accessories > System Tools and click "System Restore".
   • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next".
   • Give the Restore Point a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
   
   To remove the old restore points:
   • Go to Start > Run then type: Cleanmgr in the box and click "OK".
   • You get a window to select the drive to clean, the default is already set to (C:) drive. Click OK.
   • Click the "More Options" Tab.
   • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.
   • Click OK and Yes.

Happy Surfing Razorburne.

Farbar,

I did everything you said...seems like all is good. I checked my Google searches and it no longer redirects. My computer is faster and no more issues that I can tell. Thank you so so much!

I created the new Restore Point and deleted the old ones as you instructed - I had one question about that. Going forward, if I run into any more problems, do I have to go through another cleanup like I did this time with you, or can I just use the Restore Point I just made?

Lastly, is there anything else I need to do? Scans to perform, logs to post, etc.? If not, that's great...I just want to make sure. Let me know. I appreciate it.

You are welcome Razorburne.


If the computer got infected in the future and the security software couldn't take care of that you may first try to use the Restore Points. Sometimes it works, if it didn't then you have to take other steps like seeking assistance here. If you wanted you might seek assistance if the scanners didn't take out the infection.

The infection is taken care of, you had already run AVG, Malwarebytes and SupperAntiSpyware and posted DDS and GMER logs. The only infections on the log is taken care of and no need for another scan.

I hope your questions are answered.

This thread will now be closed since the issue seems to be resolved.

If you need this topic reopened, please send me a PM and I will reopen it for you.

If you should have a new issue, please start a new topic.