google search page redirecting

New Kapersky scan results....



-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, December 21, 2007 7:18:38 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 21/12/2007
Kaspersky Anti-Virus database records: 490818
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 57034
Number of viruses found: 5
Number of infected objects: 10
Number of suspicious objects: 0
Duration of the scan process: 01:26:07

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\vwpt.exe Infected: Packed.Win32.Tibs.ez skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\muvee Technologies\030625\0102\0310\values Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\me\Application Data\MySpace\IM\Logs\MySpaceIM-20071220-184446.log Object is locked skipped
C:\Documents and Settings\me\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\me\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\me\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\me\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\me\Local Settings\Temp\~DF50B3.tmp Object is locked skipped
C:\Documents and Settings\me\Local Settings\Temp\~DF7DC.tmp Object is locked skipped
C:\Documents and Settings\me\Local Settings\Temp\~DF82B.tmp Object is locked skipped
C:\Documents and Settings\me\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\me\ntuser.dat Object is locked skipped
C:\Documents and Settings\me\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\logs\output_me.log Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\benchmark.dat Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\codescache\20\fe20 Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\codescache\35\a435 Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\codescache\41\f941 Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\codescache\4a\a04a Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\codescache\6c\fb6c Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\codescache\activeDomains Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\codescache\nonactiveDomains Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\http_cache\headers\_0000_1 Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\http_cache\headers\_0000_2 Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\http_cache\_0000_1 Object is locked skipped
C:\Program Files\BellSouth Accelerator Technology\temp\http_cache\_0000_2 Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.7\NCOWAD.dat Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.7\NCOWADMT.dat Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.7\NCOWAS.dat Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\coShared\WA\1.7\NCOWAS.ldb Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Norton 360\Log\AutoProtect.log Object is locked skipped
C:\Program Files\Norton 360\Log\AVContext.log Object is locked skipped
C:\Program Files\Norton 360\Log\AVManual.log Object is locked skipped
C:\Program Files\Norton 360\Log\Backup.log Object is locked skipped
C:\Program Files\Norton 360\Log\CUInternetPageViewHistory.log Object is locked skipped
C:\Program Files\Norton 360\Log\CUInternetSearchHistory.log Object is locked skipped
C:\Program Files\Norton 360\Log\CUInternetTempFiles.log Object is locked skipped
C:\Program Files\Norton 360\Log\CUWindowsTempFiles.log Object is locked skipped
C:\Program Files\Norton 360\Log\EmailScan.log Object is locked skipped
C:\Program Files\Norton 360\Log\InternetSecurity.log Object is locked skipped
C:\Program Files\Norton 360\Log\ISIntrusionPrevented.log Object is locked skipped
C:\Program Files\Norton 360\Log\ISIOTraffic.log Object is locked skipped
C:\Program Files\Norton 360\Log\ISNewNetwork.log Object is locked skipped
C:\Program Files\Norton 360\Log\LiveUpdate.log Object is locked skipped
C:\Program Files\Norton 360\Log\NCO.log Object is locked skipped
C:\Program Files\Norton 360\Log\VABrowserSettings.log Object is locked skipped
C:\Program Files\Norton 360\Log\VAIPAddresses.log Object is locked skipped
C:\Program Files\Norton 360\Log\VAWeakPasswords.log Object is locked skipped
C:\Program Files\Norton 360\Log\WDFScanner.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP421\A0071549.exe Infected: Packed.Win32.Tibs.ez skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP428\A0071947.exe Infected: Packed.Win32.Tibs.ez skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0074185.dll Infected: not-a-virus:AdWare.Win32.Vapsup.mr skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0074186.exe Infected: not-a-virus:AdWare.Win32.Vapsup.mv skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP446\A0074193.exe Infected: Trojan.Win32.DNSChanger.abk skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP448\A0074263.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP448\A0074274.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP448\A0074274.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP448\A0074274.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP448\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_AC97 Soft Data Fax Modem with SmartCP.txt Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TEMP\JET269D.tmp Object is locked skipped
C:\WINDOWS\TEMP\JET3013.tmp Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

 

As far as the Google Search redirection, I think that has stopped.Still have no windows updates showing in add or remove programs. windows update website shows only a few optional updates and no Priority. There is also the 2empty folders in C:\program files....Windows update, Uninstall information. Other than the update problem I haven't noticed anything else unusual.

 

Open a command window. Copy the bolded text below and paste it in (the command window will close on it's own).

del /q C:\WINDOWS\explorer.exe.old
del /q C:\WINDOWS\system32\dllcache\explorer.exe.old
del /q "C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\vwpt.exe "
exit
cls

Having the two empty folders in Program Files is normal. They are normally hidden folders, and you would not have noticed them before unless you had Windows set to show hidden files and folders, which you apparently do now.

Lets see if the Windows Updates show up here. Open HijackThis to the Misc Tools section. Click 'Open Uninstall Manager'. Click 'Save List', select Desktop from the left pane of the Save dialog box that opens then click Save. Close HijackThis. Post the contents of the uninstall_list.txt file now on the desktop.

 

Looks to be the same as the add or remove programs list.


Contents of uninstall manager in Hijackthis.....


Adobe Flash Player 9 ActiveX
Adobe Reader 7.0.5 Language Support
Adobe Reader 7.0.8
Apple Mobile Device Support
Apple Software Update
AVG Anti-Spyware 7.5
BellSouth Accelerator Technology
CCleaner (remove only)
Conexant AC-Link Audio
Easy Internet Sign-up
GdiplusUpgrade
Google Earth
HijackThis 2.0.2
HP Help and Support
HP Image Zone 4.8.5
HP Image Zone Plus 4.8.5
HP Software Update
HP User Guides 0001
HP Wireless Assistant
HPIZplus450
Intel(R) Graphics Media Accelerator Driver for Mobile
InterVideo WinDVD
iTunes
Java(TM) 6 Update 2
Java(TM) SE Runtime Environment 6 Update 1
Kaspersky Online Scanner
McAfee SecurityCenter
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Money 2005
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
muvee autoProducer 4.0 - SE
MySpaceIM
Panda ActiveScan
Quick Launch Buttons 5.10 B2
QuickTime
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Sierra Home Architect
Soft Data Fax Modem with SmartCP
Sonic Audio Module
Sonic Copy Module
Sonic Data Module
Sonic Express Labeler
Sonic MyDVD Plus
Sonic Update Manager
SpywareBlaster v3.5.1
Symantec Technical Support Web Controls
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515 drivers.
Viewpoint Media Player
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11

 

Copy the following bolded command.

sc stop wuauserv

Click Start then Run and paste the command on the run line then hit enter.
Rename the folder C:\Windows\SoftwareDistribution to something like C:\Windows\SftDst
Now paste the next command on the run line and hit enter.

sc start wuauserv

Go to the Windows Update site and check for updates.

 

Still not getting any critical updates from windows update website. Only 6 optional software and 1 hardware update.

 

Click Review update history in the left pane on the Windows Update site and see what you get.

 

When checking update history I received the following message.....

Review Your Update History


You have not yet installed updates from this website or by turning on automatic updating on your computer.To select and install updates now,go to our home page.

 

edit - not applicable

 

Open a command window and paste the following command, then hit enter.

ren %systemroot%\system32\catroot2\Edb.log *.tst

Check for updates again.

 

Same result.

 

Open a command window and paste the first command below then hit enter.

sc stop cryptsvc

Wait 10 seconds and do the next

sc query cryptsvc

When it returns a Stopped state, proceed with the following 2, first one, then the other.

ren %systemroot%\System32\Catroot2 oldcatroot2

sc config cryptsvc start= auto

When you get a SUCCESS message, do the next.

sc start cryptsvc

Wait 10 seconds and follow with this one.

sc query cryptsvc

If it reports running, check Windows Update again.

 

Still not getting any high priority updates.

 

Open a command window. Highlight and copy the bolded text below and paste it in.

regsvr32 /u /s softpub.dll
regsvr32 /u /s wintrust.dll
regsvr32 /u /s initpki.dll
regsvr32 /u /s dssenh.dll
regsvr32 /u /s rsaenh.dll
regsvr32 /u /s gpkcsp.dll
regsvr32 /u /s sccbase.dll
regsvr32 /u /s slbcsp.dll
regsvr32 /u /s mssip32.dll
regsvr32 /u /s cryptdlg.dll
exit
cls

Reboot and open a command window again. Highlight and copy the bolded text below and paste it in.

regsvr32 /s softpub.dll
regsvr32 /s wintrust.dll
regsvr32 /s initpki.dll
regsvr32 /s dssenh.dll
regsvr32 /s rsaenh.dll
regsvr32 /s gpkcsp.dll
regsvr32 /s sccbase.dll
regsvr32 /s slbcsp.dll
regsvr32 /s mssip32.dll
regsvr32 /s cryptdlg.dll
exit
cls

Check for updates again (choose custom)

 

Hmmm. Still nothing.

 

Download the package from the following link and save it to the drive root (Local Disk C

http://download.windowsupdate.com/w...one/7.0.6000.381/windowsupdateagent30-x86.exe

Click Start>Run and type or paste the following command then hit enter.

C:\WindowsUpdateAgent30-x86.exe "/wuforce

Complete the wizard and reboot if prompted, then check for updates again.

 

Ok, on first attempt, i downloaded to: C:\WindowsUpdateAgent30-x86.exe
I entered the specified command into run.Got an error message stating that windows cannot find the specified file. Thinking that I probably
did something wrong I deleted the file and tried it again. This time after the download was complete I just clicked run and some files were extracted. The installer then gave me a message stating that an install was not necessary since windows update agent is already installed.

 

I'm not surprized at the message. The command was intended to force a re-install. I mucked the command though ..... missed the beginning quotes. Please try again.

"C:\WindowsUpdateAgent30-x86.exe" /wuforce

If that fails to produce any available updates, please check if the C:\Windows\SofwareDistribution folder was recreated. If not, rename the original (we named it C:\Windows\SftDst) back to SoftwareDistribution and again check the installation history at Windows Update site. Probably should stop the automatic updates service prior to renaming, and restart it afterwards. Following commands from the run line will do that.

sc stop wuauserv
sc start wuauserv

 

Entered new command, installer ran,extracted files, and successfully installed windows update agent.

Still no new updates available, and no update history.

C:\windows\softwaredistribution folder was recreated.

 

First, paste the following command on the Run line and hit enter.

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP" /s> "%userprofile%\desktop\updates.txt "

It will create updates.txt on your desktop, which I'd like for you to post. If it's large, it may require splitting into two or more posts.

Lets stop the automatic updates service;

sc stop wuauserv

rename the current SoftwareDistribution folder to SD, then rename the original back to SoftwareDistribution. Start the automatic updates service;

sc start wuauserv

Check the update history.