Internet Explorer Redirects

[alyona]

hi,

It looks like Internet Explorer started redirecting to some other web sites, after i do search on google.

I have Winows XP Professional.

What do i need to do to stop IE redirecting me

 

[kritius]

HighjackThis Instructions

• Make sure you have the LATEST version of HJT (currently v2.0.2) it can be downloaded from HERE
  
• Run the HijackThis Installer and it will automatically place HJT in its own folder, usually C:\Program Files\Trend Micro\HijackThis. Please don't change the directory as it is necessary to create backups.
  
• After installing, the program launches automatically, select Scan now and save a log
  
• After the scan is complete attach the log into your reply.

Do not attempt to fix any item yet.

Do not add anything to the ignore list.

Don't use the AnalyseThis button, its findings are dangerous if misinterpreted.

 

[alyona]

I'm trying to put log file and I kepp getting this message: "To be able to post links or images your post count must be 5 or greater. You currently have 1 posts.

Please remove links from your message, then you will be able to submit your post."

Is there any other way I can post my log file?

Thanks

 

[kimsland]

You must attach your logs using the paperclip button on the new reply toolbar =>

 

[alyona]

here it is as an attachment

 

[kritius]

Download and Run Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to:
  
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
    
• Then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select Perform full scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When completed, a log will open in Notepad. please Attach the log into your next reply.
  
• If you accidently close it, the log file is saved here and will be named like this: C:\Documents and Settings\<your username>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
  

Fix entries using HiJackThis

• Launch HiJackThis
  
• Click the Do a system scan only button
  
• Put a check next to the entries listed below
  

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O4 - HKLM\..\Run: [DSS] C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE

• IMPORTANT: Do NOT click fix until you exit all browser sessions including the one you are reading in right now
  
• Click the Fix checked button and close HiJackThis
  
• Reboot HijackThis if necessary

Navigate to this folder and delete it,

C:\WINDOWS\BBSTORE\

To get an Uninstall List from HijackThis:

• Open HijackThis, click Config, click Misc Tools
  
• Click "Open Uninstall Manager"
  
• Click "Save List" (generates uninstall_list.txt)
  
• Click Save, attach the results in your next post.

Download random's system information tool (RSIT) by random/random from HERE and save it to your Desktop.

• Double click on RSIT.exe to run.
  
• Click Continue at the disclaimer screen.
  
• Once it has finished, two logs will open.
  
• log.txt <will be maximized and info.txt <will be minimized
• Please post the contents of both logs in the next reply.
  

 

[alyona]

here are the logs

 

[kritius]

Unistall the following from add/remove programs,

Java(TM) 6 Update 6

Java(TM) 6 Update 7

Theres nothing really in the logs, are you still getting the redirects?

I would like you to do an online scan so that we can what else may be in your system,

Run Kaspersky online scanner

With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed

Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans to speed up scan time and to make sure there are no conflicts.

Do not go surfing while your resident protection is disabled!

Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.



Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.

• The program will launch and then start to download the latest definition files.
  
• Once the scanner is installed and the definitions downloaded, click Next.
  
• Now click on Scan Settings
  
• In the scan settings make sure that the following are selected:
  
  o Scan using the following Anti-Virus database:
  
  o Extended (If available, otherwise use standard)
  
  o Scan Options:
  
  o Scan Archives
  
  o Scan Mail Bases
  
• Click OK
  
• Under select a target to scan, select My Computer
  
• The scan will take a while so be patient and let it run.
  
• Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
  
• Click the Save Report As... button (see red arrow below)
  
  
  
  
  
  
  
  
  
• In the Save as... prompt, select Desktop
  
• In the File name box, name the file
  
• In the Save as type prompt, select Text file (see below)
  
  
  
  
  
  
  
  
  
• Include the report in your next post.

 

[Bobbye]

kritius, I'd like to make a suggestion. I have followed several of your replies asking the user to just run HijackThis initially. It is best to have them run all three of the cleaning programs HERE, which include Malwarebytes, SuperAntispyware AND HijackThis, then attach all three logs.

When someone is reporting a redirect or what appears is obviously malware, the HijackThis log alone isn't much help. Running the other two cleaning programs first, followed by HijackThis will remove some of the malware BEFORE it gets into the HijackThis log.

 

[alyona]

Now it doesn't redirect, yesterday I scanned computer using AniVir and there was one infection which was removed by AntiVir

 

[kritius]

what about the kaspersky log?

 

[alyona]

Sorry for delay,
It took quite some time to run Kaspersky,
Here it is

Sunday, March 15, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, March 15, 2009 14:26:37
Records in database: 1908427
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
C:\
D:\
Scan statistics
Files scanned 195940
Threat name 1
Infected objects 2
Suspicious objects 0
Duration of the scan 01:37:43

File name Threat name Threats count
C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE/C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE Infected: not-a-virus:AdWare.Win32.Background 1
C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE Infected: not-a-virus:AdWare.Win32.Background 1
The selected area was scanned.

 

[kritius]

OTMoveIT

Please download the OTMoveIt3 by OldTimer

• Please double-click OTMoveIt3.exe to run it. (Vista users, please right click on OTMoveit3.exe and select "Run as an Administrator")
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Folders
C:\WINDOWS\BBSTORE\

:commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTMoveIt3, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt3