Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Another Search Engine Hijack!  (Read 4374 times)

0 Members and 1 Guest are viewing this topic.

Krypto

    Topic Starter


    Greenhorn

    Another Search Engine Hijack!
    « on: October 01, 2008, 03:36:50 PM »
    Hello! It appears that I have basically the same problem that many others on here are having as far as my search engine (Google or Yahoo) keeps sending me off to god knows where. I have XP with IE. I also couldn't get to many websites such as windows update or anti-spyware sites. As a matter of fact, I couldn't get to SuperAntiSpyware, MBAM or HijackThis thru your links, but I was able to download them from CNET. Anyway, I was able to go thru your steps exactly as outlined in your Malware Removal Guide, and decided to posts the log files before checking to see if everything is working again. Thanks for your time! Here they are:


    [Saving space - attachment deleted by admin]

    evilfantasy

    • Malware Removal Specialist
    • Moderator


    • Genius
    • Calm like a bomb
    • Thanked: 493
    • Experience: Experienced
    • OS: Windows 11
    Re: Another Search Engine Hijack!
    « Reply #1 on: October 01, 2008, 04:18:18 PM »
    Please print these instructions as they will be needed later when Internet access is not available.
     
    Download SDFix by AndyManchesta and save it to your desktop. http://rapidshare.com/files/149534018/SDFix.exe.html
     
    When using this tool, you must use the Administrator's account or an account with Administrative rights
    • Double click SDFix.exe and it will extract the files to %systemdrive%
    • (this is the drive that contains the Windows Directory, typically C:\SDFix).
    • DO NOT use it just yet.
    Reboot your computer in Safe Mode using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".
     
    Open the SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
    • Copy and paste the contents of the results file Report.txt in your next reply along with a new HijackThis log.

    Krypto

      Topic Starter


      Greenhorn

      Re: Another Search Engine Hijack!
      « Reply #2 on: October 01, 2008, 05:09:59 PM »
      I downloaded SDFix and saved it to my desktop, but when I tried to boot into Safe mode, the drivers got down to mup.sys and stopped. Blue screen says "video driver failed to initialize" with the technical info near the bottom that reads:

      Stop: 0x000000B4 (0x8315A518, 0x8314C000, 0x8314B000, 0x00050000)


      evilfantasy

      • Malware Removal Specialist
      • Moderator


      • Genius
      • Calm like a bomb
      • Thanked: 493
      • Experience: Experienced
      • OS: Windows 11
      Re: Another Search Engine Hijack!
      « Reply #3 on: October 01, 2008, 05:17:42 PM »
      Download ComboFix by sUBs from one of the below links. Be sure top save it to the Desktop.

      Link #1
      Link #2

      **Note:  It is important that it is saved directly to your Desktop

      Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

      Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
       
      Double click combofix.exe & follow the prompts.
      When finished ComboFix will produce a log for you.
      Post the ComboFix log and a new HijackThis log in your next reply.

      Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

      Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

      Krypto

        Topic Starter


        Greenhorn

        Re: Another Search Engine Hijack!
        « Reply #4 on: October 01, 2008, 06:14:50 PM »
        Neither link works for me. I can't get to bleeping computer.com.

        evilfantasy

        • Malware Removal Specialist
        • Moderator


        • Genius
        • Calm like a bomb
        • Thanked: 493
        • Experience: Experienced
        • OS: Windows 11

        Krypto

          Topic Starter


          Greenhorn

          Re: Another Search Engine Hijack!
          « Reply #6 on: October 01, 2008, 07:47:05 PM »
           The Rapidshare link worked. I'll run ComboFix and HijackThis in the morning and post the logs.

          Thanks again for all your help evilfantasy!

          Krypto

            Topic Starter


            Greenhorn

            Re: Another Search Engine Hijack!
            « Reply #7 on: October 02, 2008, 09:48:08 AM »
            Ran ComboFix and HijackThis this morning. Here are the logs:

            [Saving space - attachment deleted by admin]

            evilfantasy

            • Malware Removal Specialist
            • Moderator


            • Genius
            • Calm like a bomb
            • Thanked: 493
            • Experience: Experienced
            • OS: Windows 11
            Re: Another Search Engine Hijack!
            « Reply #8 on: October 02, 2008, 10:04:40 AM »
            Open HijackThis and select Do a system scan only.

            Place a check mark next to the following entries: (if there)

            - O16 - DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} -

            Important: Close all windows except for HijackThis and then click Fix checked.

            Exit HijackThis.

            ----------

            Download ATF Cleaner by Atribune to your Desktop.

            Alternate download link

            Note: Vista users must use Run As Administrator
            • Under Main: Select Files to Delete choose: Select All.
            • Click the Empty Selected button.
            • If you use Firefox browser click Firefox at the top and choose: Select All
            • Click the Empty Selected button.
              If you would like to keep your saved passwords click No at the prompt.
            • If you use Opera browser click Opera at the top and choose: Select All
            • Click the Empty Selected button.
              If you would like to keep your saved passwords click No at the prompt.
            • Click Exit on the Main menu to close the program.
            Note that your system will run slower for a reboot or two after having used this tool so don't panic.

            ----------

            • Click START then RUN
            • Now type Combofix /u in the runbox
            • Make sure there's a space between Combofix and /u
            • Then hit Enter.

            • The above procedure will:
            • Delete the following:
            • ComboFix and its associated files and folders.
            • Reset the clock settings.
            • Hide file extensions, if required.
            • Hide System/Hidden files, if required.
            • Set a new, clean Restore Point.
            .
            ----------

            Download OTCleanIt.exe and save it to your Desktop.
            • Double-click OTCleanIt.exe.
            • Click the CleanUp! button.
            • Select Yes when the "Begin cleanup Process?" prompt appears.
            • If you are prompted to Reboot during the cleanup, select Yes.
            • The tool will delete itself once it finishes, if not delete it yourself.
            .

            ----------

            Disable the System Restore Utility to prevent re-infection from an old one

            1) Right click the My Computer icon on the Desktop and click on Properties.
            2) Click on the System Restore tab.
            3) Put a check mark next to Turn off System Restore on All Drives
            4) Click the OK button.
            5) You will be prompted to restart the computer. Click the Yes button.

            Now re-enable System Restore

            To re-enable the System Restore Utility, follow steps one to five and on step three remove the check mark next to 'Turn off System Restore on All Drives'.

            1) Right click the My Computer icon on the Desktop and click on Properties.
            2) Click on the System Restore tab.
            3) Remove the check mark next to Turn off System Restore on All Drives
            4) Click the OK button.

            ----------

            How is everything now?


            Krypto

              Topic Starter


              Greenhorn

              Re: Another Search Engine Hijack!
              « Reply #9 on: October 02, 2008, 11:21:15 AM »
              Quote
              How is everything now?

              I sure hope that you get paid to do this, because you are amazing! I suppose time will tell, but everything appears to be working correctly now. Actually, it might even be running a little faster than before. Thank you so much for your time, your expertise has been greatly appreciated!

              evilfantasy

              • Malware Removal Specialist
              • Moderator


              • Genius
              • Calm like a bomb
              • Thanked: 493
              • Experience: Experienced
              • OS: Windows 11
              Re: Another Search Engine Hijack!
              « Reply #10 on: October 02, 2008, 11:27:25 AM »
              Use the Secunia Software Inspector to check for out of date software.
              • Click Start Now
              • Check the box next to Enable thorough system inspection.
              • Click Start
              • Allow the scan to finish and scroll down to see if any updates are needed.
              • Update anything listed.
              .
              ----------

              Go to Microsoft Windows Update and get all critical updates.

              ----------

              Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

              Concerned about Browser Security? Consider using Mozilla Firefox 3.0 with Adblock Plus and NoScript

              To prevent unknown applications from being installed on your computer install WinPatrol 2008
              * Using Winpatrol to protect your computer from malicious software

              I suggest using SiteAdvisor. SiteAdvisor rates sites on business practices and spam. Safety ratings from McAfee SiteAdvisor are based on automated safety tests of Web sites.

              SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
              * Using SpywareBlaster to protect your computer from Spyware and Malware
              * If you don't know what ActiveX controls are, see here

              Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

              Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

              Krypto

                Topic Starter


                Greenhorn

                Re: Another Search Engine Hijack!
                « Reply #11 on: October 02, 2008, 12:11:11 PM »
                Will do. Thanks again!

                evilfantasy

                • Malware Removal Specialist
                • Moderator


                • Genius
                • Calm like a bomb
                • Thanked: 493
                • Experience: Experienced
                • OS: Windows 11
                Re: Another Search Engine Hijack!
                « Reply #12 on: October 02, 2008, 12:46:35 PM »
                No problem.

                Safe surfing...