Web searches get redirected - Cannot run Hijackthis

[Vages]

Hello,
My computer is infected with a virus that redirects web searches, on all search engines. I downloaded Hijackthis but the virus does not allow me to run the software.
Any help appreciated!

[xixo_12]

Hello and Welcome to Malware Removal Forums.

• My name is xixo_12 and i will guide you to encounter the problem that you have now.
• We will work together and I need your attention to read all those instruction carefully.
• You may wish to print them off or copy them into Notepad.
• If you have any question please don't hesitate to ask.
• The instructions that i will give to you later are specific to your current problem and shouldn't be used on other systems.
• If you are receiving help or have received help on this problem elsewhere, please let us know.
• Please post your replies to this thread only and keep interact with me until your computer is clean.

I am currently under the guidance of the MRU teachers, everything I post to you, has been reviewed by them.
This additional review process can add some extra time to my responses...but not too much.

First,
Please reply to indicate you are ready and understand what we will facing onwards.

[Vages]

Thanks for your reply!
I am ready.

[Vages]

Update to my problem: The redirecting to different web pages happens only with google, not with yahoo search engine. Also, my antivirus was not working so I unistalled it.
I was able, however, to run a Kaspersky scan on my computer. I am attaching a copy of the report here if it helps:

KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, October 15, 2009
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, October 15, 2009 20:37:01
Records in database: 3001101
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan statistics:
Objects scanned: 173809
Threats found: 5
Infected objects found: 51
Suspicious objects found: 0
Scan duration: 03:26:53


File name / Threat / Threats count
svchost.exe\DA04CA5A.x86.dll/svchost.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 4
globalroot\Device\__max++>\DA04CA5A.x86.dll/globalroot\Device\__max++>\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 22
spoolsv.exe\DA04CA5A.x86.dll/spoolsv.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
iTunesHelper.exe\DA04CA5A.x86.dll/iTunesHelper.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
wcescomm.exe\DA04CA5A.x86.dll/wcescomm.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
msa.exe\DA04CA5A.x86.dll/msa.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
rapimgr.exe\DA04CA5A.x86.dll/rapimgr.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
AppleMobileDeviceService.exe\DA04CA5A.x86.dll/AppleMobileDeviceService.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
mDNSResponder.exe\DA04CA5A.x86.dll/mDNSResponder.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
cvpnd.exe\DA04CA5A.x86.dll/cvpnd.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
jqs.exe\DA04CA5A.x86.dll/jqs.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
mcrdsvc.exe\DA04CA5A.x86.dll/mcrdsvc.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
alg.exe\DA04CA5A.x86.dll/alg.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
firefox.exe\DA04CA5A.x86.dll/firefox.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
LogitechUpdate.exe\DA04CA5A.x86.dll/LogitechUpdate.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
jucheck.exe\DA04CA5A.x86.dll/jucheck.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
java.exe\DA04CA5A.x86.dll/java.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
wmplayer.exe\DA04CA5A.x86.dll/wmplayer.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
googletalkplugin.exe\DA04CA5A.x86.dll/googletalkplugin.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\b.exe/C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\b.exe Infected: Packed.Win32.Krap.ag 1
b.exe\DA04CA5A.x86.dll/b.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\b.exe Infected: Packed.Win32.Krap.ag 1
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\DFF06LCY\index[1].htm Infected: Trojan.HTML.Fraud.d 1
C:\hp\bin\wbug\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
C:\WINDOWS\mplayerplgn.dll Infected: not-a-virus:AdWare.Win32.Agent.lmz 1
D:\I386\APPS\APP25744\src\CompaqPresario_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
D:\I386\APPS\APP25744\src\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1

Selected area has been scanned.

[xixo_12]

Hi,
Let's proceed.
Sorry for the delay

First,
Please Uninstall HiJackThis program (if you installed it) and delete the executable file that you downloaded.

Next,
RSIT.
Please download Random's System Information Tool by random/random from HERE and save to the desktop.

• Double-click RSIT.exe to run the tool.
• Click Continue at the disclaimer screen.
• Once it finishes, two logs will open...
  
  • log.txt will be opened maximized
  • info.txt will be opened minimized
• Please post the contents of both logs in your next post.

Next,
GMER.
Please download from HERE and save to the desktop.

• Unzip/extract the file to its own folder.
• Disconnect from the Internet and close all running programs.
  There is a small chance this application may crash your computer so save any work you have open.
• Double-click on Gmer.exe to start the program.
• Allow the gmer.sys driver to load if asked.
• If it gives you a warning at program start about rootkit activity and asks if you want to run a scan,click NO.
• Click on >>> symbol and choose on the Rootkit tab.
• Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
• Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
• Click on the Scan and wait for the scan to finish.
  Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
• When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
• Note: If you have any problems, try running GMER in SAFE MODE"

Important! Please do not select the "Show all" checkbox during the scan..

Next,
Checklist.
Please post.

• Content of log.txt
• Content of info.txt
• Content of gmer.txt

[xixo_12]

Hi,

Notice.
Do you still need our help?
It's almost 3 days since my last replied. (Left approximate 8 hours)

Please let me know if you required more time to reply.

Regards,
xixo_12

[xixo_12]

Hi ,

Important.
This thread remain open because a request for it.
We are still waiting your reply for this issue.
I'm in hope you will let me know the status of this system.
Bump for your attention.

Regards,
xixo_12

[silver]

Due to a Lack of Response this topic is now closed.

If you still require help, please open a new thread in the Malware Removal forum.

If you have been helped and wish to donate to help with the costs of this volunteer site,
please read Donations For Malware Removal