Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Web searches get redirected - Cannot run Hijackthis

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Web searches get redirected - Cannot run Hijackthis

Unread postby Vages » October 15th, 2009, 1:25 am

Hello,
My computer is infected with a virus that redirects web searches, on all search engines. I downloaded Hijackthis but the virus does not allow me to run the software.
Any help appreciated!
Vages
Active Member
 
Posts: 3
Joined: October 15th, 2009, 1:06 am
Advertisement
Register to Remove

Re: Web searches get redirected - Cannot run Hijackthis

Unread postby xixo_12 » October 15th, 2009, 5:25 am

Hello and Welcome to Malware Removal Forums.
  • My name is xixo_12 and i will guide you to encounter the problem that you have now.
  • We will work together and I need your attention to read all those instruction carefully.
  • You may wish to print them off or copy them into Notepad.
  • If you have any question please don't hesitate to ask.
  • The instructions that i will give to you later are specific to your current problem and shouldn't be used on other systems.
  • If you are receiving help or have received help on this problem elsewhere, please let us know.
  • Please post your replies to this thread only and keep interact with me until your computer is clean.

I am currently under the guidance of the MRU teachers, everything I post to you, has been reviewed by them.
This additional review process can add some extra time to my responses...but not too much. ;)


First,
Please reply to indicate you are ready and understand what we will facing onwards. ;)
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia

Re: Web searches get redirected - Cannot run Hijackthis

Unread postby Vages » October 15th, 2009, 10:59 am

Thanks for your reply!
I am ready.
Vages
Active Member
 
Posts: 3
Joined: October 15th, 2009, 1:06 am

Re: Web searches get redirected - Cannot run Hijackthis

Unread postby Vages » October 15th, 2009, 7:58 pm

Update to my problem: The redirecting to different web pages happens only with google, not with yahoo search engine. Also, my antivirus was not working so I unistalled it.
I was able, however, to run a Kaspersky scan on my computer. I am attaching a copy of the report here if it helps:


KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, October 15, 2009
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, October 15, 2009 20:37:01
Records in database: 3001101
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan statistics:
Objects scanned: 173809
Threats found: 5
Infected objects found: 51
Suspicious objects found: 0
Scan duration: 03:26:53


File name / Threat / Threats count
svchost.exe\DA04CA5A.x86.dll/svchost.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 4
globalroot\Device\__max++>\DA04CA5A.x86.dll/globalroot\Device\__max++>\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 22
spoolsv.exe\DA04CA5A.x86.dll/spoolsv.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
iTunesHelper.exe\DA04CA5A.x86.dll/iTunesHelper.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
wcescomm.exe\DA04CA5A.x86.dll/wcescomm.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
msa.exe\DA04CA5A.x86.dll/msa.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
rapimgr.exe\DA04CA5A.x86.dll/rapimgr.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
AppleMobileDeviceService.exe\DA04CA5A.x86.dll/AppleMobileDeviceService.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
mDNSResponder.exe\DA04CA5A.x86.dll/mDNSResponder.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
cvpnd.exe\DA04CA5A.x86.dll/cvpnd.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
jqs.exe\DA04CA5A.x86.dll/jqs.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
mcrdsvc.exe\DA04CA5A.x86.dll/mcrdsvc.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
alg.exe\DA04CA5A.x86.dll/alg.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
firefox.exe\DA04CA5A.x86.dll/firefox.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
LogitechUpdate.exe\DA04CA5A.x86.dll/LogitechUpdate.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
jucheck.exe\DA04CA5A.x86.dll/jucheck.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
java.exe\DA04CA5A.x86.dll/java.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
wmplayer.exe\DA04CA5A.x86.dll/wmplayer.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
googletalkplugin.exe\DA04CA5A.x86.dll/googletalkplugin.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\b.exe/C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\b.exe Infected: Packed.Win32.Krap.ag 1
b.exe\DA04CA5A.x86.dll/b.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\b.exe Infected: Packed.Win32.Krap.ag 1
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\DFF06LCY\index[1].htm Infected: Trojan.HTML.Fraud.d 1
C:\hp\bin\wbug\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
C:\WINDOWS\mplayerplgn.dll Infected: not-a-virus:AdWare.Win32.Agent.lmz 1
D:\I386\APPS\APP25744\src\CompaqPresario_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
D:\I386\APPS\APP25744\src\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1

Selected area has been scanned.
Vages
Active Member
 
Posts: 3
Joined: October 15th, 2009, 1:06 am

Re: Web searches get redirected - Cannot run Hijackthis

Unread postby xixo_12 » October 19th, 2009, 5:26 am

Hi,
Let's proceed.
Sorry for the delay ;)

First,
Please Uninstall HiJackThis program (if you installed it) and delete the executable file that you downloaded.

Next,
RSIT.
Please download Random's System Information Tool by random/random from HERE and save to the desktop.
  • Double-click RSIT.exe to run the tool.
  • Click Continue at the disclaimer screen.
  • Once it finishes, two logs will open...
    • log.txt will be opened maximized
    • info.txt will be opened minimized
  • Please post the contents of both logs in your next post.

Next,
GMER.
Please download from HERE and save to the desktop.
  • Unzip/extract the file to its own folder.
  • Disconnect from the Internet and close all running programs.
    There is a small chance this application may crash your computer so save any work you have open.
  • Double-click on Gmer.exe to start the program.
  • Allow the gmer.sys driver to load if asked.
  • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan,click NO.
  • Click on >>> symbol and choose on the Rootkit tab.
  • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
  • Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
  • Click on the Scan and wait for the scan to finish.
    Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
  • When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
  • Note: If you have any problems, try running GMER in SAFE MODE"
Important! Please do not select the "Show all" checkbox during the scan..

Next,
Checklist.
Please post.
  • Content of log.txt
  • Content of info.txt
  • Content of gmer.txt
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia

Re: Web searches get redirected - Cannot run Hijackthis

Unread postby xixo_12 » October 21st, 2009, 9:35 pm

Hi,

Notice.
Do you still need our help?
It's almost 3 days since my last replied. (Left approximate 8 hours)

Please let me know if you required more time to reply.

Regards,
xixo_12
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia

Re: Web searches get redirected - Cannot run Hijackthis

Unread postby xixo_12 » October 23rd, 2009, 7:38 pm

Hi :),

Important.
This thread remain open because a request for it.
We are still waiting your reply for this issue.
I'm in hope you will let me know the status of this system.
Bump for your attention.

Regards,
xixo_12
User avatar
xixo_12
MRU Master Emeritus
 
Posts: 2340
Joined: October 14th, 2008, 11:40 am
Location: Malaysia

Re: Web searches get redirected - Cannot run Hijackthis

Unread postby silver » October 25th, 2009, 10:59 pm

Due to a Lack of Response this topic is now closed.

If you still require help, please open a new thread in the Malware Removal forum.

If you have been helped and wish to donate to help with the costs of this volunteer site,
please read Donations For Malware Removal
User avatar
silver
Regular Member
 
Posts: 9219
Joined: August 7th, 2006, 9:40 pm
Location: GMT+7
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 36 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware