Browser Redirect problem in IE and Firefox

Here is the LockSearch log...

Please download OTM

• Save it to your desktop.
• Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  Code:

  :Processes
  
  :Services
  
  :Reg
  
  :Files
  C:\WINDOWS\system32\pschdcnte.dll
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]
  

• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  Code:

  :dir
  %systemroot%\Tasks\

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

OK... Here are the two log files

bevzz, yes, this is a common problem. But you need to start your own thread, following the steps HERE and attaching the logs for review.

Although malware can cause redirects, it is not always the same malware and the 'fix' will depend on identifying it.

Still being redirected?


Please download OTM

• Save it to your desktop.
• Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  Code:

  :Processes
  
  :Services
  
  :Reg
  
  :Files
  C:\WINDOWS\Tasks\PHINSDVGE.job
  
  :Commands
  [purity]
  [emptytemp]
  

• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Kritius,
Here is the log...

Still being redirected?

Kritius,
It appears as though the redirect has been cleared up. In my testing, all of the Google searches have been directed to the proper links. Same goes for Yahoo and Bing. Do you guys think it will be safe to use this machine or is there a chance there are more "backdoor" hijacks lurking around on the HD?

DDS by sUBs
Please download DDS by sUBs from HERE or HERE and save it to your Desktop.

Vista users. Right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

• Double click on dds to run it.
• When done, DDS.txt will open.
• You will receive another prompt after a while. Click Yes at the prompt. It will take another few minutes to scan.
• When done, Attach.txt will open.
• Please zip and attach the contents of DDS.txt and Attach.txt in your next reply.

Kritius,
Your first link opens a site that McAfee flags as dangerous. The second downloads a screen saver! I am REAL CAUTIOUS about screen savers. Are you sure about this?

Yup.

McAfee wouldn't know the preverbial **** from elbow. Disable it and then download

Am I to open a screen saver named dds.scr?

Disable McAfee and then download from link 1

dds.scr is the tool to run DDS. See http://community.mcafee.com/thread/5309

The SCR file type is primarily associated with 'Script'
http://www.fileinfo.com/extension/scr

FYI: There are 19 other file types using the SCR file extension:
See http://www.file-extensions.org/scr-file-extension-windows-screensaver-file

OK...
Here is the zipped file...

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Here is the ComboFix Log...

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Step 3 of your instructions includes a single line:

c:\windows\system32\drivers\raqhcge.sys

In the e-mail instructions there are multipl lines:

c:\windows\system32\AVSredirect.dll
c:\windows\system32\cygwin1.dll
c:\windows\system32\cygz.dll
c:\windows\system32\x.264.exe
c:\windows\system32\drivers\raqhcge.sys

I have already started the ComboFix with the first virsion and my machine is rebooting.
Should I rerun with the second set?

c:\windows\system32\drivers\raqhcge.sys this is what it should have been.

No need to re run.