When I click a link after doing a google search I get redirected to a sansujo site of some sort. This only seems to happen when searching for things. I did all of the preliminary cleaning and will attach a cf and hjt log. Thank you for your help. This problem is very annoying.

Attached Files

	ComboFixlog.txt (11.7 KB, 3 views)
	hijackthislog2.txt (6.5 KB, 3 views)

Download Vundofix from [URL="http://www.atribune.org/content/view/24/2/"]HERE[/URL].

Double click the Vundofix.exe to run it.

Right click in the vundofix window and click add files.

Enter the full file path/s to the files you want Vundofix to delete and click the add files button, followed by the close window button. Click the remove vundo button and let Vundofix do it`s stuff.

These are the filepaths you need to enter into Vundofix.

C:\WINDOWS\system32\soxiokl.dll
C:\WINDOWS\system32\qicnvei.dll

Post a fresh HJT log as well as an AVG Antispyware log.

Regards Howard

[color=red][b]This thread is for the use of[/color] smoke157 [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]

here are my new logs. thank you.

Attached Files

	hijackthislog3.txt (6.5 KB, 1 views)
	Report-Scan-20070322-173128.txt (1.8 KB, 1 views)

You might want to check your Host files and see if there were any modifications made,
Some adaware etc. use this to redirect.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Bodog Poker

Close control panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

BPGame.exe

Close task manager.

Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {5579B1C1-F9AE-9C92-4CEE-000381433AC5} - C:\WINDOWS\system32\soxiokl.dll (file missing)

O2 - BHO: (no name) - {74C11DEB-B706-8EAA-8E5B-05046181A53F} - C:\WINDOWS\system32\qicnvei.dll (file missing)

O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe

O16 - DPF: WMP10ctrl - [url]http://www.cinemanow.com/WMP10ctrl.CAB[/url]

O16 - DPF: {B0781EB7-16EA-49F1-9C1D-9716D88206CF} (CSQ Object) - [url]http://169.254.0.1/view.cab[/url]

O16 - DPF: {CE74A05D-ED12-473A-97F8-85FB0E2F479F} (dlControl.UserControl1) - [url]http://www.cinemanow.com/dlControl_3_3.CAB[/url]

O20 - Winlogon Notify: winxtx32 - winxtx32.dll (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following [b]bold[/b] files and/or directories(if there).

C:\Program Files\[b]Bodog Poker[/b]<Delete the entire folder.

Reboot your computer.

Run the Ccleaner programme as per the instructions in step9 of this thread [URL="http://www.techspot.com/vb/topic58138.html"]HERE[/URL].

Post a fresh HJT log and let me know how your system is running.

Regards Howard

[color=red][b]This thread is for the use of[/color] smoke157 [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]

seems to be fixed. thank you very much. greatly appriciated.

Attached Files

hijackthislog4.txt (5.9 KB, 1 views)

Your HJT log is clean.

[b]Turn off system restore.(XP/ME only)[/b] See how [URL="http://www.bleepingcomputer.com/forums/tutorial56.html"]HERE[/URL].

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

[color=red][b]This thread is for the use of[/color] smoke157 [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our [URL="http://www.techspot.com/vb/menu28.html"]security and the web forum[/URL].[/color][/b]

thank you.