Windows update redirects to Google search page

[Wing]

I am having a few problems with my desktop. I am running windows XP SP3. Most things seem to work normally, but a little slow. But when I click on windows update under tools, it takes me to google search page. Also my windows restore points will not work. I followed the steps given by evilfantasy, except when I tried to go to SuperAntiSpyware website, the site would only appear for a couple of seconds and then go to "page not found".   Also Malwarebytes would download and install, but would not run. I have attached my Hyjack This log. Any help would be greatly appreciated.

[attachment deleted by admin]

[harry 48]

http://www.ccleaner.com/update/?v=2.18.878&l=1033

go to above , download and run take out what ever it shows , 3 short scans

until an expert comes along

[Wing]

I used CClean and did what it said to do. I also posted my Hijack this log on the Compute Hope process tool. I did what is said, and now I can use Windows update, but Malwarebytes and SUPERAntiSpyware still will not run.

I am posting my new Hijack this log to try to fing out what other issues I still have.

Thank You

[attachment deleted by admin]

[harry 48]

disable your anti-virus and try sas and malware

[Wing]

Disabled anti-virus,   No Change.

[evilfantasy]

Click Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.

* Scroll down to Non-plug and Play Drivers and click the plus icon to open those drivers.
* Search for any of the following:
* Important! The letters can appear in either upper case or lower case letters.

- UACd.sys <- Or anything beginning with UAC
- gaopdxserv.sys <- Or anything beginning with gaopd
- gxvxcserv.sys <- Or anything beginning with gxvx
- Seneka.sys <- Or anything beginning with Seneka
- clbdriver.sys <- Or anything beginning with clbdriver
- TDSSserv.sys <- Or anything beginning with TDSS
- ovfst.sys <- Or anything beginning with ovfst

* If you do find it, right click on it, and select Disable. Do not try to uninstall them.
* Now restart the computer and see if you can run the scans that would not run.
* Let me know if you found them or not.

[Wing]

None of those entries are present.

[evilfantasy]

If you already have Malwarebytes be sure to update it before running the scan!

Download Malwarebytes' Anti-Malware (MBAM)

Alternate MBAM download link

• Double-click mbam-setup.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to the following:
• Update Malwarebytes' Anti-Malware
  
• Launch Malwarebytes' Anti-Malware

• Then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and Paste the entire report in your next reply.

.
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

----------

Now run a new HijackThis scan and post that log along with the MBAM log.

[Wing]

I still cannot run Malwarebytes. I have downloaded it at least 10 times from different locations. It will install, but the program will not open. Each time I uninstall it, it prompts me to re-start windows. When I do re-start, Windows freezes up when it is re-starting. I have to manually shut off the computer and turn it back on. The second time it starts up fine, but when I re-install  Malwarebytes, it still doesn't open.

Also SUPERAntiSpyware will not even install. I have downloaded it several times as well. When I try to install it, I get an error message that says it has encountered a problem and needs to close.

I've attached a new Hijack This log if that will help.

[attachment deleted by admin]

[evilfantasy]

Have you tried running it in Safe Mode?

[evilfantasy]

Open HijackThis and select Do a system scan only

Vista users right click on HijackThis and select Run as Administrator. (you will receive a UAC prompt, please allow it)

Place a check mark next to the following entries: (if there)

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/MyFunCardsFWBInitialSetup1.0.0.15-3.exe
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Nestle/Coupons.cab
O18 - Filter hijack: text/html - {AE3B25B6-4C21-4038-BD35-99A05B5EF3EB} - (no file)
.
Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis and then restart the computer.

----------

Now try to run Malwarebytes again.

[Wing]

Ran Hijack This and selected the items you listed and clicked fix. Re-booted and Malwarebytes still didn't work. Then I tried safe mode. malwarebytes didn't work in safe mode either.

[evilfantasy]

Download Combofix by sUBs from one of the below links.

Link #1
Link #2

Combofix MUST be saved to the desktop.
 
Close all other browser windows.
 
Go to Start > Run and copy/paste in the following blue text:

"%userprofile%\desktop\combofix.exe" /killall

Press Enter and Combofix will begin to run.
 
When finished, it will produce a log file located at C:\ComboFix.txt
 
Post the contents of that log in your next reply.

Note: Do not mouseclick combofix's window while it is running. That may cause your system to stall.

[Wing]

Here is my combofix log

[attachment deleted by admin]

[evilfantasy]

Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]

KillAll::

File::
c:\program files\temp995.bat
c:\documents and settings\Tom\zGCJgvz.exe
c:\documents and settings\Tom\ahCKgvz.exe


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

----------

Open Malwarebytes' Anti-Malware.

• Click the Update tab.
• Click Check for Updates
  
• If an update is found, it will download and install.
• Click the Scanner tab.
  
• Select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy & Paste the entire report in your next reply along with a fresh HijackThis log.

.
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.