8 Step Complete/Google Searches Being Redirected

[jjonz]

Yesterday I picked up some kind of malware that now redirectects my google searches to miscellaneous advertised sites. (I can cut and paste search links into the address bar to make it work). Also, links within a site seem to work.

I was running other spy an anti malware, but switched to zone alarm, avast, and SAS at the "8 Step" suggestion.

I have run numerous programs (ad-Adqare, a-sueared Spybot XofsSpySE, Spyware Doctor..), but non have seem to identify the problem

I left utorrent installed. I am aware of the dangers there, but this was not when the event occured. I was surfing the net when a window with something about windows poped up. I absent mindedly clicked to delete it and have been having this problem ever since.

Attached are my hjt, MAM, and SAS logs

Thanks for any help or suggestions.

jj

 

[Tmagic650]

Have you run CCleaner? Glary Utilities? Turn off System Restore by goin to System, Advanced... rerun the scans and if clean, turn System Restore back on

 

[jjonz]

That was a quick reply Tmagic.

I ran CC twice. I usually run this at least once a week anyway.

I did not see anything about Glary Utilities. (might be my old eyes).

I have turned off System Restore and will rerun the scans. This will take 30minutes to an hour,

jj

 

[jjonz]

8 Step Complete/ Google Searches Being Redirected

Ok.
I turned off System Restore and reran the scans
SAS caught a few new cookies, (guess I should have run CC first)
I have turned System Restore back on.
Google searches are still being redirected.

Here are my new logs

Thanks again.

jj

 

[jjonz]

Reloaded windows.

End of problem

jj

 

[Bobbye]

It could have been fixed. You did have problems. If all is set and loaded as before, expect a recurrence.

 

[Tmagic650]

Reloaded windows.

End of problem

jj

Sometimes a reinstall of Windows is needed Bobbye. The computer may show it is "clean" but it just isn't quite right. Good work jj

 

[Bobbye]

Yes, Tmagic, sometimes Windows does have to be reinstalled> for instance when there is a Virut infection.

But I wonder if jj had stopped the defragger, the iPod Manager, the CDBurner and the multitiude of unneeded processes HP puts on the system, would that have started a recovery.

And I wonder if he had handled the disabled Autoruns if that would have helped. And maybe the fact there there a 2 TrueVector Internet Monitor (vsmon) for ZoneAlarm Services running would have caused some problems.

Those things aren't malware. But malware takes all the blame for what's wrong with a system. Users tend to configure a system the same after the reinstall and eventually they will find at least part pf the problem occurring again.

So I am very conservative in recommending a reinstall and only suggest it if malware had been handled and if system problems have been resolved and the computer isn't usable. But there are users who reformat/reinstall "regularly"- kind of like throwing away the dirty laundry instead of washing it!

 

[jjonz]

Bobbye
Sorry I did not clarify the situation. I was still having the Google redirect, but was living with it until I could get some direction on the use of Combofix.

The reason I had to reload windows is that I changed firewalls from Sunbelt to Comodo. I turned off Sunbelt, but forgot to diable it. On a reboot they both started and computer froze.
I could not even start in safe mode.

Anyway with all this going on I just decided to reloaded Windows. Most of my programs are on a different drive, so I did not loose them.

Thanks for the comments.

jj

 

[Tmagic650]

"But there are users who reformat/reinstall "regularly"- kind of like throwing away the dirty laundry instead of washing it!'...

It is a time factor too... Pictures, documents & other important information can be easily backed up to DVD's, external devices or flash drives now. OS reinstalls= 1 hour. Cleanings can take many hours, with unsatisfactory results

 

[Bobbye]

jj, a tip for handling security programs in the future:

Most security programs can't be disabled when they're running. That's a good thing when it comes to malware, but it takes an extra step when you want to make any changes in the program, including an uninstall:

Boot into Safe Mode

• Restart your computer and start pressing the F8 key on your keyboard.
• Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

Now go to Start> Run> type in msconfig> enter> Selective Startup> Startup tab> uncheck any processes that are running for the program you want to change/uninstall> Apply> OK

Then do Start> Run> type in services.msc> right click on any Service for the program> Properties> Change the Startup type to Disabled> Stop the Service.

When done, reboot back into Normal Mode. Ignore the nag message and close it after checking 'don't show this message again'. Stay in Selective Startup.

Now you should be able to uninstall a security program..

Guess it sounded like I was nagging you for the reinstall. That might have been the only choice. I am really big on troubleshooting- I enjoy the challenge. Sometimes it takes a while, sometimes we have to try different things to resolve a problem. But it is always a good thing to come out on the other side with a properly working computer, especially a clean one!

It's too bad no one is here to tell users how to remove the cleaning tools .

You could try this:
Remove all of the tools we used and the files and folders they created

• Download OTCleanIt by OldTimer
• Save it to your Desktop.
• Double click OTCleanIt.exe.
• Click the CleanUp! button.
• If you are prompted to Reboot during the cleanup, select Yes.

The tool will delete itself once it finishes.

If you are prompted to Reboot during the cleanup, select Yes.

Even thought I did not help you with the cleaning, I can help you cleanup!

 

[jjonz]

Thanks Bobbeye

I ran OTC. So fast I do not know what it did. It did ask for a reboot though.

Earlier TMagic650 mentioned Glary Tools. I have downloaded that and have been using that also.

jj

 

[Bobbye]

Good. OTC is just some housekeeping! Stay safe.

Have you set a new clean restore point? You might want to do that- you could name it "Clean"!

The easiest and safest way to do this is:

• Go to Start > All Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next".
• Give the Restore Point a name then click "Create".

The new Restore Point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

 

[jjonz]

Bobbye
I thought I posted some other messages yesterday, but don't see them here.
This is probably not the place anyway, but.....a couple of questions.

I set a restore point, but do you ever use software for this? Such as "ERUNT" or Regisry Booster?

Secondly, I noticed on another post that you said you were using TUT (The Ultiimate Troubleshooter). I am using winpatrol (free) now, but am thinking about TUT. It seems to clarify the needed and superfulous programs better. Are you using TUT and what do you recommend?

Thanks again.

jj

 

[Bobbye]

jj, Yes, I am still using TUT> It is one of the best programs I have! It gives me the ability to view and control all parts of the system, get explanations and recommendations and change the settings. One of the most valuable sections is called 'Housekeeping'. This is an app that allows me to remove which is normally cleaned up in a disc cleanup, plus additional cleanup abilities.

Another important-and free- program is called Eraser. I found it years ago and have used since. When I do the Housekeeping, what is deleted goes to the Recycle Bin. When through, I erase-overwrite- the contents. This has Department of Defense overwrite abilities. I'm not erasing 'secret files' but I am removing them from the hard drive which is something a delete doesn't do.

I am on a laptop that has just had it's 4th birthday. It has 88% of the hard drive available. This is because of the housekeeping/erase combination.

One to purchase, one free. Great combination:
The Ultimate Troubleshooter
Eraser

I don't use WinPatrol. For a while I had the paid AdAware which had AdWatch running in Real Time, similar to WinPatrol. but I found it intrusive. Almost everything changes the system and these types pf programs can be annoying. I don't use any Registry program.

Eraser is also available on the right click menu, so instead of deleting a file or image, I overwrite it.

As for setting the Restore Points: I let the system set and I set my own occasionally. I created a sbortcut for SR and have it in the Quick Launch Toolbar. It's a good reminder to set my own occasionally and I don't have to do the All Programs> Accessories> System Tools path.

 

[kritius]

I was still having the Google redirect, but was living with it until I could get some direction on the use of Combofix.

No one on this site can advise on the proper use of ComboFix.

 

[jjonz]

Bobbye
Thanks for taking the time.
I will buy TUT and am eager to delete some of the useless tasks hanging around and see how much memory is freed up.

Another question. On tasks, services, and startups, do you disable (stop, suspend) or delete (terminate)?

As far as "ERASER" I use a program called "Perfect Uninstaller". First it uninstalls, then it searches the registry for left over files, then it searches hard drives for left over files. It can take up to 10 minutes, but I feel it has done a good job at getting rid of everything. Of course it does not write over files, but I hope the FBI does not come and search any of my (4) hard drives.

Thanks again for your time.

jj