1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active google-redirect.com

Discussion in 'Malware and Virus Removal Archive' started by gursh123, 2009/11/11.

  1. 2009/11/11
    gursh123

    gursh123 Inactive Thread Starter

    Joined:
    2009/11/11
    Messages:
    2
    Likes Received:
    0
    [Active] google-redirect.com

    Hi all,

    I dont know whether i have a virus, or whether its something to do with having google as my homepage???? But when I click on different links, the above website loads, and takes me to a completely unrelated and random website??

    Any help will be very much appreciated


    Thanks in advance
    Gursh!:)
     
    gursh123,
    #1
  2. 2009/11/11
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    Hi,

    Read this post as indicated at the top of this forum & follow the instructions.
     
    Admin.,
    #2


  3. to hide this advert.

  4. 2009/11/12
    gursh123

    gursh123 Inactive Thread Starter

    Joined:
    2009/11/11
    Messages:
    2
    Likes Received:
    0
    Logs

    DDS (Ver_09-10-26.01) - NTFSx86
    Run by Gursh at 12:44:49.75 on 12/11/2009
    Internet Explorer: 8.0.6001.18241
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2431.1717 [GMT 0:00]

    AV: avast! antivirus 4.8.1296 [VPS 090430-0] *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\ParetoLogic\PLAS\plasservice.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Gursh.GURSH-XLT46E8F8\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = about:blank
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [autochk] rundll32.exe c:\docume~1\networ~1.nta\protect.dll,_IWMPEvents@16
    mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
    mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
    mRun: [autochk] rundll32.exe c:\windows\system32\autochk.dll,_IWMPEvents@16
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [ParetoLogic Anti-Virus PLUS] "c:\program files\paretologic\anti-virus plus\Pareto_AV.lnk" -NM -hidesplash
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    StartupFolder: c:\documents and settings\gursh.gursh-xlt46e8f8\start menu\programs\startup\ChkDisk.dll
    StartupFolder: c:\docume~1\gursh~1.gur\startm~1\programs\startup\chkdisk.lnk - c:\windows\system32\rundll32.exe
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    LSP: c:\windows\system32\INetHTTPFilter.dll
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    mASetup: {2E1A9DE4-ADA0-4501-A46E-6633CDB01654} - rundll32 kixm32.dll,InitO

    ============= SERVICES / DRIVERS ===============

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-11 111184]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-11 20560]
    R2 ZeppelinService;plasservice;c:\program files\common files\paretologic\plas\plasservice.exe [2009-2-18 587216]

    =============== Created Last 30 ================

    2009-11-11 13:39:48 5000 --sha-w- c:\windows\system32\drivers\fidbox.idx
    2009-11-11 13:39:48 259872 --sha-w- c:\windows\system32\drivers\fidbox.dat
    2009-11-11 13:39:48 1820 --sha-w- c:\windows\system32\drivers\fidbox2.idx
    2009-11-11 13:39:48 10528 --sha-w- c:\windows\system32\drivers\fidbox2.dat
    2009-11-11 13:39:05 2021 ----a-w- C:\rollback.ini
    2009-11-11 12:36:47 0 d-----w- c:\program files\ParetoLogic
    2009-11-11 12:36:47 0 d-----w- c:\program files\common files\ParetoLogic
    2009-11-11 12:36:47 0 d-----w- c:\docume~1\alluse~1.win\applic~1\ParetoLogic Anti-Virus PLUS
    2009-11-11 12:36:47 0 d-----w- c:\docume~1\alluse~1.win\applic~1\ParetoLogic
    2009-10-29 15:01:42 24064 --sha-w- c:\windows\system32\autochk.dll
    2009-10-29 14:36:58 0 d-----w- c:\docume~1\gursh~1.gur\applic~1\Malwarebytes
    2009-10-29 14:36:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-10-29 14:36:52 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-10-29 14:36:52 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-10-29 14:36:52 0 d-----w- c:\docume~1\alluse~1.win\applic~1\Malwarebytes
    2009-10-29 14:17:11 0 d-----w- c:\program files\HighjackThis
    2009-10-29 14:09:51 0 d-----w- c:\program files\Trend Micro
    2009-10-22 11:26:01 0 d-----w- c:\program files\Microsoft
    2009-10-21 14:59:54 36928 ---ha-w- c:\windows\system32\mlfcache.dat
    2009-10-21 13:12:36 0 d-----w- c:\docume~1\alluse~1.win\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2009-10-21 13:07:21 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-10-21 13:07:21 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll

    ==================== Find3M ====================

    2009-10-29 14:59:25 24064 ------w- c:\documents and settings\gursh.gursh-xlt46e8f8\protect.dll

    ============= FINISH: 12:45:35.57 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-10-26.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 11/12/2008 05:01:31 PM
    System Uptime: 11/12/2009 12:30:53 PM (-696 hours ago)

    Motherboard: Hewlett-Packard | | 30B0
    Processor: Mobile AMD Sempron(tm) Processor 3400+ | U10 | 1795/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 49 GiB total, 18.902 GiB free.
    D: is FIXED (NTFS) - 7 GiB total, 0.187 GiB free.
    E: is CDROM ()
    F: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description:
    Device ID: ACPI\IFX0102\4&24963685&0
    Manufacturer:
    Name:
    PNP Device ID: ACPI\IFX0102\4&24963685&0
    Service:

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description:
    Device ID: ACPI\HPQ0006\2&DABA3FF&0
    Manufacturer:
    Name:
    PNP Device ID: ACPI\HPQ0006\2&DABA3FF&0
    Service:

    ==== System Restore Points ===================

    RP127: 13/08/2009 08:57:46 PM - System Checkpoint
    RP128: 18/08/2009 05:05:48 PM - System Checkpoint
    RP129: 20/08/2009 04:40:42 PM - System Checkpoint
    RP130: 25/08/2009 05:10:53 PM - System Checkpoint
    RP131: 27/08/2009 07:31:04 PM - System Checkpoint
    RP132: 31/08/2009 01:09:56 PM - System Checkpoint
    RP133: 21/09/2009 09:44:59 AM - System Checkpoint
    RP134: 22/09/2009 12:15:03 PM - System Checkpoint
    RP135: 23/09/2009 04:42:15 PM - System Checkpoint
    RP136: 15/10/2009 04:36:38 PM - System Checkpoint
    RP137: 21/10/2009 02:40:36 PM - System Checkpoint
    RP138: 29/10/2009 02:57:36 PM - System Checkpoint
    RP139: 02/11/2009 04:00:01 PM - System Checkpoint
    RP140: 05/11/2009 11:59:57 AM - System Checkpoint
    RP141: 06/11/2009 05:48:22 PM - System Checkpoint
    RP142: 07/11/2009 11:48:21 PM - System Checkpoint
    RP143: 11/11/2009 12:36:45 PM - Installed ParetoLogic Anti-Virus PLUS.

    ==== Installed Programs ======================

    Acrobat.com
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Reader 9
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Display Driver
    AuthenTec Fingerprint Sensor Minimum Install
    avast! Antivirus
    Bonjour
    Broadcom 440x 10/100 Integrated Controller
    Broadcom 802.11 Wireless LAN Adapter
    Broadcom NetXtreme Ethernet Controller
    Football Manager 2009
    HDAUDIO Soft Data Fax Modem with SmartCP
    HijackThis 2.0.2
    Hotfix for Windows XP (KB896256)
    Hotfix for Windows XP (KB909095)
    Hotfix for Windows XP (KB912436)
    Hotfix for Windows XP (KB915326)
    Hotfix for Windows XP (KB918005)
    Hotfix for Windows XP (KB942288-v3)
    HP Product Detection
    HP Wireless Assistant 2.00 F1
    iTunes
    Malwarebytes' Anti-Malware
    Microsoft Application Error Reporting
    Microsoft Bootvis
    Microsoft Choice Guard
    Microsoft Office Professional Edition 2003
    Microsoft Silverlight
    MSVCRT
    NetWaiting
    ParetoLogic Anti-Virus PLUS
    Picasa 3
    QuickTime
    SAMSUNG Mobile Composite Device Software
    SAMSUNG Mobile Modem Driver Set
    Samsung Mobile phone USB driver Software
    SAMSUNG Mobile USB Modem 1.0 Software
    SAMSUNG Mobile USB Modem Software
    Samsung PC Studio 3
    Segoe UI
    SoundMAX
    Steam
    Synaptics Pointing Device Driver
    Texas Instruments PCIxx21/x515/xx12 drivers.
    TIPCI
    VoiceOver Kit
    WebFldrs XP
    Windows Driver Package - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
    Windows Driver Package - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
    Windows Internet Explorer 8 Beta 2
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows XP Hotfix - KB883667
    Windows XP Hotfix - KB884575
    Windows XP Hotfix - KB885464
    Windows XP Hotfix - KB885855
    Windows XP Hotfix - KB888239
    Windows XP Hotfix - KB888402
    Windows XP Hotfix - KB889673
    Windows XP Hotfix - KB892559
    Windows XP Service Pack 2

    ==== End Of File ===========================
     
    gursh123,
    #3
  5. 2009/11/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're running two AV programs, ParetoLogic Anti-Virus PLUS and Avast.
    One of them has to go.

    When done....

    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    - Close browsers before scanning.
    - Terminate memory threats before quarantining.
    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    - Click Preferences, then click the Statistics/Logs tab.
    - Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    - If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    - Please copy and paste the Scan Log results in your next reply.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 3. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log to your next reply.

    RESTART COMPUTER

    STEP 4. Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Download HijackThis Installer
    Install, and run it.
    Post HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #4

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...