Keep getting redirected, some web pages wont fully load

[gott1rott]

There are couple websites I goto that will not fully load. Sometimes only half of the page and sometimes pictures and icons are missing. They are gamespot.com, yahoo.com, and nfl.com. Nfl.com will not work at all. It acts as if I never typed it in.

I seem to only get redirected when I search for something and click one of the search results and it opens up in a new tab(I use firefox). I get redirected to a bunch of different sites Ive never heard of. When I ran a search on my problem I had to copy and paste the link to this site because I kept getting redirected.

I uploaded my log but I'm not sure if I did it correctly. Please help me this is very annoying.
Thanks

 

[Bobbye]

Please follow the directions here: https://www.techspot.com/vb/post645589-1.html

When you have finished, attach all of the logs to your post.

 

[gott1rott]

Ok I followed all of the instructions and my pc seems to be functioning better already ready so thanks a lot. I've posted the logs as well.
Thanks again.

 

[SpiritWind]

Hi :

Some of the malware detected by Malwarebytes' Anti-Malware require that the
computer be rebooted for the malware to be quarantined, etc; you have done
that !?

Your Adobe is outdated, a security risk . Recommend you uninstall it and
consider using the safer "Foxit Reader" .

Noticed you have ZA's misnamed "Spy Blocker" on your computer; this is nothing
more than the Adware "ask.com" toolbar . You should seriously consider getting
rid of it after reading the very reliable Info at http://securitygarden.blogspot.com/2...zonealarm.html .

 

[gott1rott]

Hi
yes I did reboot. The log was from right after the scan but before the reboot. Thank you for the tips. I will follow up on your recommendations.

 

[Bobbye]

The log was from right after the scan but before the reboot.

Then the log is not a valid indicator.
The SAS log shows the presence of just about every Tracking Cookie there is! Most come from the 'gametime' Domain. Have SAS remove these and set your Cookies as follows:
Internet Options> Privacy tab> CHECK 'allow first party cookies'> CHECK 'block third party cookies> CHECK always allow per session cookies> Apply> OK. This will allow the Cookie from the site itself while blocking most from the ads and partners.

Open Real Player and Java. Find the Update tab> UNCHECK 'automatically check for updates' on each> Apply> OK
Your Adobe version is v8. That's fine. The latest is v9. You can update it at a later time here: https://www.techspot.com/downloads/2083-adobe-reader-dc.html
Please re-open HiJackThis and scan.**Check the boxes next to all the entries listed below.

J:\Program Files\Common Files\Real\Update_OB\realsched.exe
J:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "J:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "J:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: (no name) - {3E422F49-1566-40D3-B43D-077EF739AC32} - (no file)
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - J:\Documents and Settings\g\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker Basic - {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - J:\Documents and Settings\g\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk
O9 - Extra button: Doyles Room Poker - {725E77D3-B919-4eef-8EEE-D09DE618B6C1} - J:\Microgaming\Poker\DoylesRoomMPP\MPPoker.exe
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - J:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - J:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - J:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - J:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - e:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: WassPoker - 4053ebe6-a54d-4bb9-b118-ce1d8f99a548 - J:\Documents and Settings\g\Start Menu\Programs\WassPoker\WassPoker.lnk (HKCU)
O9 - Extra button: ReeferPoker - 60a501e4-a078-4cb2-8728-3fab4264f3c1 - J:\Documents and Settings\g\Start Menu\Programs\ReeferPoker\ReeferPoker.lnk (HKCU)
O9 - Extra button: CarbonPoker - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - J:\Documents and Settings\g\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk (HKCU)
O9 - Extra button: PokerNordica - {caf8603b-35e9-4f0f-819d-a509543a1e09} - J:\Documents and Settings\g\Start Menu\Programs\PokerNordica\PokerNordica.lnk (HKCU)

The ZoneAlarm issue: The installation or updating of ZoneAlarm asks if you want to install this free toolbar. ZA describes this to "to "prevents an Internet surfer from unintentionally ending up at a malicious Web site, such as one that downloads "drive-by spyware" to unsuspecting visitors." On the other hand, ZA's FAQ seems to say that they use it to track your surfing"
Check the following to have HijackThis emove. See ***** for additional instructions..

O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - J:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} is identified as (Adware.AskSBAR)
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - J:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

Question: Do you have a Nokia phone connecting to the PC through Bluetooth? IF YES, leave the following. If NO, check to remove:

J:\Program Files\PC Connectivity Solution\ServiceLayer.exe
J:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
J:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "J:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKCU\..\Run: [PC Suite Tray] "J:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray

Now close all windows other than HiJackThis, then click Fix Checked.**Close HiJackThis*and*reboot into Safe Mode:
Control Panel> Administrative Tools> Services> Change the Startup type of the following Services to Manual:

.O23 - Service: PD91Agent - Unknown owner - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe (file missing)
O23 - Service: PD91Engine - Unknown owner - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe (file missing)

(The Perfectdisk agent allows you to connect to remote computers running Perfectdisk and to control Perfectdisk operations on that computer.)
Control Panel> Java> Update tab> UNCHECK 'automatically check for updates'> answer Yes> Apply> OK
Do the same for Real Player.

After that, Reboot into Normal mode and post a new HijackThis log here in a reply.
Run SAS again after the Tracking Cookies have been removed and post log.
Run MBAM again and post log.


**** Re: ZoneAlarm: make sure this process is not on Startup. Open ZA and look for the option for the Toolbar. Remove or Disable it.

 

[gott1rott]

Here are the new logs and to answer your question, yes I do have my nokia connected to my pc.
Thanks

 

[Bobbye]

Remove this entry from Trusted Zone:

O15 - ESC Trusted Zone: .update.microsoft.com[/url]

I don't see PerfectDisk installed and running. Did you try the trial version and decide not to purchase full version? If so, that's why thase Services are showing like this:

O23 - Service: PD91Agent - Unknown owner - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe (file missing)
O23 - Service: PD91Engine - Unknown owner - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe (file missing)

Check them for HijackThis to fix. Close any open Windows and have them fixed.

Boot into Safe Mode> Control Panel> Administrative Tools> Services> find PerfectDisk and right click> Properties> change Start up type to Disabled.
Control Panel> Add/Remove Programs> Uninstall Perfect Disk.
Reboot into Normal mode.

OTCleanit! by Oldtimer
Download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe) Click the CleanUp! button.
It will go thorough the list and remove all of the tools it finds and then delete itself (requiring a reboot).

This is a good time to clear your existing system restore points and establish a new clean restore point:
*Go to Start > All Programs > Accessories > System Tools > System Restore
* Select Create a restore point, and Ok it.
* Next, go to Start > Run and type in cleanmgr
* Select the More options tab
* Choose the option to clean up system restore and OK it.
This will remove all restore points except the new one you just created.

Your logs look good. IF you find you're slow loading or surfing, know that there are many programs starting at boot that do not need to start. The run in the background and slow you down. All you need on Start is the antivirus or in your case, the ZA Suite. You can uncheck everything else with the exception of touchpad if you're on a laptop and network process if on network.