Browser Hijacking

[darinsharp]

I updated the java as specified. I can not get the online antivirus to post a report when i click to get the report it restarts and clears the list and I have to redownload it and run the test agian.

[dan12]

Let's try another online scanner.

Note for Vista Users: Eset is compatible but Internet Explorer must be run as Administrator. To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select "Run as Administrator" from the context menu.

Please go to Eset website to perform an online scan. Please use Internet Explorer as it uses ActiveX.

1. Check (tick) this box: YES, I accept the Terms of Use.
   
2. Click on the Start button next to it.
   
3. When prompted to run ActiveX. click Yes.
   
4. You will be asked to install an ActiveX. Click Install.
   
5. Once installed, the scanner will be initialized.
   
6. After the scanner is initialized, click Start.
   
7. Uncheck (untick) Remove found threats box.
   
8. Check (tick) Scan unwanted applications.
   
9. Click on Scan.
   
10. It will start scanning. Please be patient.
    
11. Once the scan is done, you will find a log in C:\Program Files\esetonlinescanner\log.txt. Please post this log in your next reply.

[darinsharp]

# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3954 (20090323)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=fe3b03b856bafc4dbc6e1d73e1d10435
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2009-03-23 05:48:07
# local_time=2009-03-23 12:48:07 (-0600, Central Daylight Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# scanned=530852
# found=3
# scan_time=12026
C:\Program Files\Uninstall My Web Search.dll Win32/Adware.Toolbar.MyWebSearch application 9162C0B890BB1297339715D5D76224BE
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1771\A0114139.dll a variant of Win32/Kryptik.JY trojan 9CD33A7F9592B61CB0A24D5B460D4B06
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP1771\A0114154.dll a variant of Win32/Adware.Virtumonde.NEM application 3BC33400EC672574E09447656BB8DD2D

[dan12]

Can you manually find and delete this file

Try add and remove programs in control panel first if there.

C:\Program Files\Uninstall My Web Search.dll << This file

Post a fresh HJT log

[NonSuch]

Due to a lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.