Google and Yahoo searches redirect to a blank page

[TimJFowler]

Hello all,

I'm working on a WinXP pc that is being redirected to a blank page for Google and Yahoo searches. I've run Malwarebytes and HiJack This and attached the most recent log files. I have also flushed DNS and reset the DSL modem (no router).

I appreciate any help you can offer.

Thanks in advance,
Tim

 

[TimJFowler]

Am I missing anything?

I removed / fixed the obvious "O1 - Hosts: 78.159.110.41 ...." entries
and the "R3 - URLSearchHook: (no name) ... " entry.

So, the redirect problem appears to be fixed.

But, there are a few things in the HijackThis log I'm not sure about. I've attached the most recent log file and would appreciate another opinion.

Thanks again,
Tim

 

[Bobbye]

Welcome to TechSpot Tim. I'll help with the malware.

But you are both ahead of me and behind me! HijackThis entries shouldn't be removed until your helper tells you which ones to remove. That's ahead of me. Behind is the lack of the Superantispyware log.

There is still a Norton service running: Norton Removal Tool and save it to your desktop. Don't run it yet.

Please temporarily disable Tea Timer. It is Real Time Protection and can interfere with the scans:
Spybot Search & Destroy TeaTimer

• Right click the TeaTimer icon in the system Tray
  
• Then click Exit Spybot-S&D Resident
• (One you are clean you can restart TeaTimer by going to C:\Program Files\Spybot - Search & Destroy, and double clicking on TeaTimer.exe

You have a Rogue Spyware program. > Spyware Cleaner.The removal is optional, but strongly suggested for the following reasons:

• They use deceptive means to get the user to buy their program
• The programs give 'false positives' meaning an entry is presented as 'bad' when is usually is not.
• Their scanning techniques are not thorough and their databases may not be current.
• There is no privacy policy
• See SpywareWarrior for specifics.

Please reopen HijackThis to 'do system scan only.' Check the following if present:

O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot>> Rogue Spyware

Close all Windows except HijackThis and click on "Fix Checked."

Boot into Safe Mode

• Restart your computer and start pressing the F8 key on your keyboard.
• Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

Show hidden files and folders

• Control Panel> Folder Options> View tab
• Check 'show hidden files and folders'
• Uncheck 'hide system and protected files- Recommended
• Click on Apply> OK

Go to Add/Remove Programs in the Control Panel and uninstall Spyware Cleaner

Using Windows Explorer go to Local Drive (C)> Programs> delete the Spyware Cleaner folder.

Rehide the files and folders.Empty the Recycle Bin
Double click on the Norton removal setup and run it.

Rescan with HJT and leave new log.

Recap:
1. Download Norton removal Tool
2. Disable TeaTimer
3. ScSuperantispywareispyware
4.Remove Rogue Spyware
5. Run Norton Removal HijackThis
jackThis