Google search keeps being redirected

[JohnScully]

Hello. I have been having problems with my Google search being redirected to add sites. I came accross this board and was able to follow along with your preliminary removal instructions for the initial phase of removal. Since running everything it seems that the search function is back to normal but you will know better than I. So I've attached all the logs you requested. Can you please help?

 

[JohnScully]

I take that back....I still have the problem intermittenly. I'm also having OpenGL errors in my video software that was not there before.

 

[kimsland]

You say that it does actually run? correct? (can't see how )

Startup HijackThis scan again, and tick all these entry boxes

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MMTray2k] MMTray2k.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\MKVtoolnix\update.exe -silent
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O20 - AppInit_DLLs: kqgehl.dll

Then close any Internet browsers (Internet Explorer or Firefox etc) and select FIX to all of them

Then go to Control Panel => Add\Remove Programs. And uninstall:

Shareaza
Network Associates (McAfee)
Avast
Adaware

Restart

Install Avira free AntiVirus

Start up Malwarebytes again; Update it; then run a full scan (remove all found Malwares)
You need to run this multiple times, until all hidden Malwares are uncovered and removed

Then restart

Then provide a New HJT log as an attachment
Oh and let me know if it runs a tad better

 

[JohnScully]

Hi kimsland, I did exactly what you requested. While running the scan the first time with Malawarebyte Anti-Malware the program Avira keep picking up trojans (but Malawaree didn't) and I deleted everything as it went along. When I ran the Malawarebytes program again and again none of them showed any trojans or malware. I then went ahead and tried some Google searches. The first couple of times in "Firefox" I was redirected again...but then it stopped and has not happened since. In Internet Explorer I had no problems. Attached is the HiJack log for you to view. I'm still having OpenGL problems in my video software however. This is a brand new video card (1 week old). Thanks for your help.

 

[kimsland]

Please startup HJT scan again and place a tick next to the following entries
Close all Internet browsers before selecting FIX

O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll (file missing)

O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Resources/2.0.6.9/cab/aolpPlugins.10.6.0.4.cab
O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://setup.bellsouth.net/wizlet/PWReset/static/controls/WebflowActiveXInstaller_4-2-1.cab
O20 - AppInit_DLLs: kqgehl.dll

Download Combofix
Lots of info on its use h e r e
Direct download h e r e

Locate the downloaded Combofix. Double click on it to run, answering any prompts along the way
Note: during Combofix scan (lasting up to 10mins) your Desktop and clock may reset (all normal)
ComboFix will also restart your computer (eventually) and then (eventually) create a log

Save this log file to be attached to a new reply

 

[JohnScully]

Here you go.

By the way the performance is better. No more noticable incidents with OpenGL and my browser.

 

[kimsland]

Please download and run SDFix (I'm sorry, but I must refer you to t h i s tutorial on its use, scroll down to "SDFix Instructions")

Download, and run the "RunThis.bat" in Safe Mode, as advised
Then attach the log and a new HJT log
Oh by the way, it says that it may take 20mins to scan! (Mine took over an hour to complete!)

 

[JohnScully]

Ok. Here you go.

 

[JohnScully]

Am I good?

If so I just want to thank you for all the help you've given.

 

[kimsland]

Not with Limewire installed (file sharing program)
And DAEMON Tools tends to fault a lot too

 

[JohnScully]

Ok I'll uninstall both. Are you saying they slow down my PC?

 

[JohnScully]

I did a Google search today and on the very first try I got sent to an add page. But after that it was ok. This happened in Firefox but no more on Internet Explorer. Do you think there is some sort of hidden script in Firefox that was overlooked? What should I do next?

 

[kimsland]

I think you should run Combofix and Malwarebytes (updated first) again
Then provide the logs