Google search results was redirected

[Yitz]

My Google search results was highjacked and redirected but after following the 8-step removal instructions it seems to have fixed the problem, but I would still appreciate it if someone would take a look at my logs to make sure it is clean and nothing bad is left over.

I use PC Tools AntiVirus and below is what it found and deleted.

PC Tools AntiVirus Activity Report
Generated on: 12/16/2009 6:52:55 PM

Scan Information:
Object Name Status Action Infection Date and Time
C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\8VAFQKBQ\yy[1].htm
Infected Quarantined Worm.IM.Sohanad 12/16/2009 9:34:18 PM
Attached please find the log files.

Thank you in advance.
Yitz

 

[Tmagic650]

This entry in the hijackthis log needs to be "fixed":
"R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch"...

Try running the ESET On-Line scanner:
Scanner

Post the results

 

[Yitz]

I am not sure what you meant by 'results', but attached is what I was able to get. (It is just a list of what it found and deleted.) If there is any other way to get a log after the scan please let me how and I will run it again.

Attached also find a new HighJackThis log.

Thank You
Yitz

 

[Tmagic650]

Nice work on the logs. ESET found and removed some real nasty stuff. Hows your computer running now?

 

[Yitz]

I am not home right know but I was online a couple of minutes this morning and everything seems to be running fine. If anything comes up again I will let you know.

Thanks again for your help
Hpappy holidays

Yitz

 

[Tmagic650]

Happy Holiday's to you Yitz! Glad we could help...

 

[Yitz]

Hi,
The problem reappeard on Sunday, the links are redirected again. I ran everything again and nothing was detected besides a few cookies by SUPERAntiSpyware. See attached logs.

I also ran Windows Defender, which I have I my machine and use for RealTime protection, and it found one thing (see below) and nothig changed.

TrojanDownloader:JS/Renos

Category:
Trojan Downloader

Description:
This program displays deceptive product messages.

Advice:
Remove this software immediately.

Hope to hear from you soon.
Thank You
Yitz

 

[Yitz]

Sorry I forgot to attach the logs, here they are.