Being redirected when I click search results

Dave,
I downloaded and fixed using Winsock, still no Internet Explorer. Actually attempted couple of times but to no avail. I also tried copying "%programfiles%\Internet Explorer\iexplore.exe" into the dialog box after doing the Start>Run, still nothing..

 

Scan again with HijackThis and place a check next to the following entries.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

Now close all open browser windows, then click Fix Checked.

Copy the following to a text file so you can use it while browsers are closed.

Click Start>Run and type cmd then hit enter to open a command window. Type or copy/paste the following commands, hitting enter after each.

ipconfig /release

ipconfig /flushdns

ipconfig /renew

After the last command, it should list out a renewed ip address. Close the command window.

Click Start>Run and paste the following command then hit enter.


"%programfiles%\Internet Explorer\iexplore.exe "


Internet Explorer should open and will hopefully display a page. Copy and paste the following in the address window then hit enter.

http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

 

Dave,
This is the page that popped up: http://www.msn.com/. Is this right? Sorry, I am starting to feel like a space case now

 

That's just as it should be.

Now, using IE, go to the Kaspersky online scanner and run a full system scan. Save the report when done and post it here.

 

and finally presenting...

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, January 08, 2008 8:16:37 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 8/01/2008
Kaspersky Anti-Virus database records: 504024
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 45231
Number of viruses found: 9
Number of infected objects: 19
Number of suspicious objects: 0
Duration of the scan process: 00:47:57

Infected Object Name / Virus Name / Last Action
C:\counter.cab/counter.exe Infected: Trojan-Dropper.Win32.Agent.az skipped
C:\counter.cab CAB: infected - 1 skipped
C:\Documents and Settings\Dennille Christensen\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Desktop\Setup.exe Infected: not-a-virus:AdWare.Win32.180Solutions.as skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\Application Data\Yahoo\Widget Engine\Widgets DB\widgets.db Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\ntuser.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\info6_s.cab/Information.exe Infected: Trojan.Win32.Dialer.t skipped
C:\info6_s.cab CAB: infected - 1 skipped
C:\QooBox\Quarantine\C\111.exe.vir Infected: Trojan-Downloader.Win32.Delf.dd skipped
C:\QooBox\Quarantine\C\Documents and Settings\Dennille Christensen\Desktop\SUPERG~2.EXE.vir Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ntsystem.exe.vir Infected: Trojan-Clicker.Win32.Oleloa.gen skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1051\A0047179.exe Infected: Trojan-Downloader.Win32.Delf.dd skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1051\A0047180.exe Infected: Trojan-Clicker.Win32.Oleloa.gen skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1053\A0047317.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1056\A0047607.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1058\A0047768.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1058\A0047773.exe/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.bvs skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1058\A0047773.exe/stream Infected: Trojan-Downloader.Win32.Zlob.bvs skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1058\A0047773.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1060\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\dup.dll Infected: Trojan-Downloader.Win32.Delf.dd skipped
C:\WINDOWS\internet.exe Infected: Trojan-Downloader.Win32.Small.or skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\ехplorer.exe Infected: Trojan-Downloader.Win32.PurityScan.n skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

 

Hi fortunateden

WOW, Dave put you through the ringers HUH

Thanks Dave.

Please open OTMoveIt.

Copy and paste these into the left hand pane and click moveit.

Let me know that it said succeeded

C:\counter.cab
C:\info6_s.cab
C:\Documents and Settings\Dennille Christensen\Desktop\Setup.exe
C:\WINDOWS\dup.dll
C:\WINDOWS\internet.exe
C:\WINDOWS\system32\ехplorer.exe

If it did, Run another Kaspersky scan and post the log.

Thanks
Geri

 

The ringer indeed!
Here is the sucessful moves after OTMoveIT


C:\counter.cab moved successfully.
C:\info6_s.cab moved successfully.
C:\Documents and Settings\Dennille Christensen\Desktop\Setup.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\dup.dll
C:\WINDOWS\dup.dll NOT unregistered.
C:\WINDOWS\dup.dll moved successfully.
C:\WINDOWS\internet.exe moved successfully.
File/Folder C:\WINDOWS\system32\??plorer.exe not found.

OTMoveIt2 v1.0.5 log created on 01082008_180017

I will proceed with the Kaspersky scan now...

 

Geri, Here is the latest


------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, January 08, 2008 8:09:22 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 8/01/2008
Kaspersky Anti-Virus database records: 504448
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 45283
Number of viruses found: 9
Number of infected objects: 19
Number of suspicious objects: 0
Duration of the scan process: 00:46:07

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\Application Data\Yahoo\Widget Engine\Widgets DB\widgets.db Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\History\History.IE5\MSHist012008010820080109\index.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\ntuser.dat Object is locked skipped
C:\Documents and Settings\Dennille Christensen\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\QooBox\Quarantine\C\111.exe.vir Infected: Trojan-Downloader.Win32.Delf.dd skipped
C:\QooBox\Quarantine\C\Documents and Settings\Dennille Christensen\Desktop\SUPERG~2.EXE.vir Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ntsystem.exe.vir Infected: Trojan-Clicker.Win32.Oleloa.gen skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1051\A0047179.exe Infected: Trojan-Downloader.Win32.Delf.dd skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1051\A0047180.exe Infected: Trojan-Clicker.Win32.Oleloa.gen skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1053\A0047317.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1056\A0047607.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1058\A0047768.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1058\A0047773.exe/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.bvs skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1058\A0047773.exe/stream Infected: Trojan-Downloader.Win32.Zlob.bvs skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1058\A0047773.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{BAEC8C27-353F-4EBE-A742-AAB36C8E8E31}\RP1060\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\ехplorer.exe Infected: Trojan-Downloader.Win32.PurityScan.n skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\_OTMoveIt\MovedFiles\01082008_180017\counter.cab/counter.exe Infected: Trojan-Dropper.Win32.Agent.az skipped
C:\_OTMoveIt\MovedFiles\01082008_180017\counter.cab CAB: infected - 1 skipped
C:\_OTMoveIt\MovedFiles\01082008_180017\Documents and Settings\Dennille Christensen\Desktop\Setup.exe Infected: not-a-virus:AdWare.Win32.180Solutions.as skipped
C:\_OTMoveIt\MovedFiles\01082008_180017\info6_s.cab/Information.exe Infected: Trojan.Win32.Dialer.t skipped
C:\_OTMoveIt\MovedFiles\01082008_180017\info6_s.cab CAB: infected - 1 skipped
C:\_OTMoveIt\MovedFiles\01082008_180017\WINDOWS\dup.dll Infected: Trojan-Downloader.Win32.Delf.dd skipped
C:\_OTMoveIt\MovedFiles\01082008_180017\WINDOWS\internet.exe Infected: Trojan-Downloader.Win32.Small.or skipped

Scan process completed.

 

Hi fortunateden
OK That's looking real good. But,

This is showing and OT doesn't seem to find it, so I want you to look for it manually.
C:\WINDOWS\system32\ехplorer.exe Infected: Trojan-Downloader.Win32.PurityScan.n skipped

Here's how.

Enable the 'Show Hidden Folders' option, like this:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Reboot.

Navigate to
C:\WINDOWS\system32\ and delete the file ехplorer.exe if it's there.

Let me know.

Thanks
Geri

 

Geri,
Just a tad confused on this one: How do I navigate to C:\WINDOWS\system32\


Also, should I click Apply after I do this:
Enable the 'Show Hidden Folders' option, like this:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

 

Hi

Yes, Apply and OK.

Click on Start
Click on My Computer
Double click C:\ Drive (May say HP Pavilion C:\) (Or local Disk C:\ )
Double Click on the Windows Folder
Double Click on the System32 Folder

In the (system32 folder ONLY,) (DO NOT delete it from anywhere else.) look for explorer.exe
If found, right click on it and click delete.

Geri

 

Hi,

Good, I did apply and OK...
However after I go to Start>My computer>Local Disk:C, it brings me to that search wizard guy, (not seeing things, really it is a little wizard with a crystal ball)..There is no Windows 32 folder there, I even searched for it using the wizard fella..

 

Hi

OK
Lets try it this way.

Using Windows Explorer (to get there right-click your Start button and go to "Explore "), please delete these files (if present):

C:\WINDOWS\system32\ехplorer.exe

After that, Reboot.

Click on the ( + ) next to Windows and then also System32
See if you can find the file.

Geri

 

Geri,
No "explore" there..

 

ohhh, do you mean Internet Explorer, when you say Windows explorer?

( i am not even blonde)

 

Hi

NO. To different things.

OK
Lets get a scan from here, see if it shows.

Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

Please post the results.
Thanks
Geri

 

Click Start>Run and paste the following command then hit enter.

%systemroot%\system32

Now look for the file explorer.exe and delete it if present.

 

Geri,
Okay so that was weird; I just did this


Click Start>Run and type cmd then hit enter to open a command window. Type or copy/paste the following commands, hitting enter after each.

ipconfig /release

ipconfig /flushdns

ipconfig /renew

After the last command, it should list out a renewed ip address. Close the command window.

Click Start>Run and paste the following command then hit enter.


"%programfiles%\Internet Explorer\iexplore.exe ",
which was my instructions on how to access IE, and my Mozilla and IE both had the error, "problem loading page ", or Page cannot be displayed.
I rebooted and every thing seems to be fine now though. Is this how I access IE, for the future, or should I be doing something else?

 

sorry guys, disregard my babbling...

 

okay,
the file was there, after I ran that command that dave sent, (thanks), but it said access denied when I went to delete it. File in use, or write-protected, etc.

should I go on with the Panda scan?