Inactive Yahoo/Google Link Redirect

Yes, we participate in getting undetected samples to the vendors.

Here's a bit of good info about the infection causing the redirect.

http://miekiemoes.blogspot.com/2008/10/fake-sysaudiosys-causes-searchengine.html

 

Good to know. Thanks again.

Wednesday, February 11, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, February 11, 2009 19:34:36
Records in database: 1783550


Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes

Scan area My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan statistics
Files scanned 133910
Threat name 7
Infected objects 13
Suspicious objects 0
Duration of the scan 01:45:09

File name Threat name Threats count
C:\Program Files\Evrsoft First Page 2006\Iscripts\Page Details\crazy-window.izs Infected: Hoax.JS.BadJoke.RJump 1

C:\Documents and Settings\Peter Wroblewski\My Documents\LimeWire\Saved\shut down lil jon MTV.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1

C:\Documents and Settings\Peter Wroblewski\.housecall6.6\Quarantine\count.jar-6802df8c-74ba4019.zip.bac_a03812 Infected: Exploit.Java.ByteVerify 2

C:\Documents and Settings\Peter Wroblewski\.housecall6.6\Quarantine\count.jar-6802df8c-74ba4019.zip.bac_a03812 Infected: Trojan-Downloader.Java.OpenConnection.aa 1

C:\Documents and Settings\Peter Wroblewski\.housecall6.6\Quarantine\1927a628-7437d06a.bac_a00364 Infected: Trojan.Java.ClassLoader.ao 3

C:\Documents and Settings\Peter Wroblewski\.housecall6.6\Quarantine\crtdcghcn.jar-5649a13-5a293939.zip.bac_a00364 Infected: Trojan.Java.ClassLoader.ao 3

C:\Documents and Settings\Peter Wroblewski\.housecall6.6\Quarantine\put yo hood up.mp3.bac_a03656 Infected: Trojan-Downloader.WMA.GetCodec.c 1

C:\Documents and Settings\Peter Wroblewski\.housecall6.6\Quarantine\regrets jay z.mp3.bac_a03656 Infected: Trojan-Downloader.WMA.GetCodec.r 1

The selected area was scanned.

 

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, February 11, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, February 11, 2009 23:44:40
Records in database: 1784406
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan statistics:
Files scanned: 135529
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 01:47:21

No malware has been detected. The scan area is clean.

The selected area was scanned.

 

Looks great! Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing any infected files there as well.
Verify the C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.

Delete dds.scr from the desktop.
You can delete any other logs that were created/saved too.
Empty the recycle bin when done.

Don't forget about updating Java.
That should finish things up.