Google search redirected and internet connection problem

[devils85]

Hi i have checked other post about this subject but i have ran almost all tools and anti-virus and nothing was detected on my computer....but when i do a search it always redirect me to some random pages....Plus it blocked my email connection, msn messenger etc.... Ran blacklight....nothing detected....AVG...Mcaff...ad-aware.... nothing at all detected...

Please help me here is a log of my Hijackthis

http://rapidshare.com/files/148671281/hijackthis.log.html

 

[kimsland]

Follow the New Preliminary Removal Instructions , and attach

the requested logs:

1) Malwarebytes Anti Malware log
2) SuperAntiSpyware log
3) Hijackthis log

 

[devils85]

Here are my 3 log

-Malwarebytes
-hijackthis
-Super anti-spyware

Super detected something in memory SVChost - Fake and putted it in quarantine but im still having my problem....

 

[kimsland]

You have AVG Antivirus, but there are many entries for McAfee
Please go to Add/Remove Programs in Control Panel and remove McAfee Antivirus (if exists there)

but when i do a search it always redirect me to some random pages

Is this now working ok?

 

[Bobbye]

Per kimsland, decide which antivirus program you want to run> AVG or McAfee. Have the entries for the program you DON'T want removed in the HijackThis rerun and uninstall in Safe Mode after first reboot. You will need to UNCHECK any entries for the unwanted AV program on the Startup tab, BEFORE the uninstall.

SAS shows just about every Tracking Cookies on the Internet. Have ALL of them removed and reset your Cookies as follows:

Internet Options> Privacy tab> Advanced button> CHECK 'allow first party Cookies'> CHECK 'block third party Cookies> Apply> OK.

Per Tracking Cookies, I noticed many from this:

Application Data\Mozilla\Firefox\Profiles\i0kditwp.default\cookies.txt ] I couldn't ID i0kditwp. Do you know what this is?

Could it be an add-on?

Reopen HijackThis and scan. Check the following:

C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKCU\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

Now close all windows other than HiJackThis, then click Fix Checked.**Close HiJackThis*and*reboot into Safe Mode.
Do this:

Control Panel> Java> Update tab> UNCHECK 'automatically check for updates'> OK> answer Yes> Apply> OK
Control Panel> RealPlayer> Update tab> UNCHECK 'automatically look for updates'> answer Yes> Apply> OK
Control Panel> Add/Remove Programs> uninstall v6u4

Right click on Start> Explore> Tools> Folder Options> View tab> CHECK 'show hidden files and folders'> Windows> Prefetch> open each folder> Edit> Select All> Delete on each.

Go back and re-hide the files and folders.

Reboot into Normal Mode. Update Java here to v6u7:
https://www.techspot.com/downloads/6463-java-se.html

You have an extraordinary of processes loading from startup and the Registry on boot. Almost none of them need to be on startup. This will cause you time. If you want to pursue this when clean, let me know.

Post a new HijackThis log when finished.

 

[kimsland]

Thanks Bobbye

I already know I'm limited in this area (HJT logs), I just scrape by most of the time
Thanks for coming to the rescue; your post is definitely more suited.

 

[devils85]

It's really strange.....i désinstalled Java... and when i try reinstalling its saying The installer cannot process with the current internet connection setting ( virus is blocking my email, msn messenger + some other application )

2nd when i went to add/remove program Mcafee is not in the list but there is many many entries ....i tried to delete them...reboot..but they are always there here is my log now

 

[momok]

Those O23 entries are service entries. They should be fixed by disabling from start up by:

Start > run > services.msc

search for the entries for eg, for an HJT entry that says

O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe

it will be located in the list as McAfee Update Manager

Right click on the service to stop it. Thereafter right click > properties to set its start up to 'disabled'.

 

[Bobbye]

Thanks momok- I totally left out the Services as I wasn't sure which was going to be kept.

It appears that you have the McAfee Internet Security Suite 2007. One of the features it has is called a "redirector". Many have disabled this as it has prevented the loading of sites. I wasn't able to find a description from McAfee of just what this Service does. It is possible this feature is causing whatever 'redirect' you're getting.

For whichever security program you do NOT want to keep, you will follow the same process:
1. Rerun HijackThis. Check the processes for the program you do NOT want> Close all windows other than HiJackThis, then click Fix Checked.**Close HiJackThis*and*reboot into Safe More..
2. Stop the Services: Start> Run> type in services.msg> enter
3. Stop the startup entries> Start> Run> type in ''msconfig' without the quotes> Selective Start-up> Startup tab> uncheck the processes for this> Apply> OK.
4. Uninstall the program> Control Panel> Add/Remove Programs

I suggest you KEEP the McAfee Suite. You will have purchased this program and it has a multitude of entries running. You should Disable the Redirector Service however- just this one Service:

O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe

To REMOVE AVG and KEEP McAfee Security Suite
1) Have HijackThis fix these:

C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

Please also check the following for HijackThis to remove: (removing these entries is due to the high volume of Tracking Cookies they put out).

C:\WINDOWS\system32\IoctlSvc.exe
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll

Close all windows other than HiJackThis, then click Fix Checked.**Close HiJackThis*and*reboot into Safe More
2) Disable and Stop the Service:
AVG Free8 WatchDog (avg8wd)

3) Stop Startups:
AVG8_TRAY\AVG8\avgtray.exe
AVG Free8 WatchDog (avg8wd) -

4) Uninstall AVG 8

Reboot into Normal Mode. You will get a the nag message that you can close after checking 'don't show this message again'. Run HijackThis and post fresh log.

Please do NOT use System Restore. We will clean out the old restore points when through. You can reinfect the system is used.

IF you decide to keep AVG instead and remove the McAfee Security Suite, let me know and I'll list those process for you.