Hello

When I use Google (with Firefox or Internet Explorer), the first few links are wrong. For example, if I search "lake", the first result is "lake-best-deals.com ", the second "lake.find.com". Only the first six or seven links are wrong.

How can I fix this problem?

Attached, you'll find the log-files from the 8-step Viruses/Spyware/Malware Preliminary Removal Instructions.

Sincerely,

Hans

I plan to request that the 8-step guide be clear that a restart of the computer is needed immediately before running the HJT scan.

You probably have handled most of the infections.

Scan with HJT. Tick & fix. Restart the computer.

Code:

O4 - HKLM\..\Run: [yuakg] "c:\windows\system32\yuakg.exe" yuakg
O4 - HKLM\..\Run: [359F5809-00B8-4455-A73A-9EA62A51101B] "C:\Dokumente und Einstellungen\All Users\Application Data\7E5E9C25.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll

Re-run scans with MBAM & SAS until clean or something remains that cannot be cleaned.

Scan with HJT.

Post logs & report current symptoms.

Google is working properly

Hi
Google has been working properly during the past few days. Attached, you'll find the log files.

Thank you very much for your help!!!!!

Sincerely,

Hans95

Your report is encouraging. However, I detect 2 problems with my original reply. Additionally, obtain current version for MBAM.

HJT scan. Tick & Fix . Restart computer.

Code:

Missed in first reply
O4 - HKLM\..\Run: [1085036306] "C:\Dokumente und Einstellungen\All Users\Application Data\845395704\1085036306.exe

• Delete files for O4 items appearing in this code box and in the previous reply.

Update & scan with MBAM & SAS.

I suggest the use of ComboFix to determine if Java DLL file is infected.

• C:\WINDOWS\system32\msjava.dll
• Appearance in system32 is not documented.
• File is candidate for deletion pending logs

Post log files and relate current experiences.

Supporting information

Combofix

Hello

Google is still working ok. Attached, you'll find the newest log files.

When I wanted to use combofix, there was an alert that MacAffee and Virus Rescue 3.0 are activ. I could switch off MacAffee, but I didn't find VirusRescue 3.0. I'don't remember having installed Virus Rescue 3.0.
How can I uninstall it? Is it a good program?

Sincerely,

Hans95