Google searches redirected, Virus Scan disabled at startup (page 2)

epb · 2009-01-05T20:31:26+00:00

Hello, I seem to have downloaded virus or trojan that's caused a few problems for me. Originally, I had a program named Spyware Protect 2009 running in my system tray. I was also getting a number of Internet Explorer popups (and a couple links saved to my desktop) even though I was running Firefox. After running Malwarebytes Anti-Malware, I removed a number of Trojans (Agent, Vundo, Vundo.h, FakeAlert and Downloader). That seemed to clear up those issues, but I still have a couple problems. First off, even though Virus Scan is loaded at startup, the On-Access scan is disabled. I can turn it back on, but it occasionally, I'll find it turned off again on its own. The other issue is, when I do a Google search and click on a link, I'll be redirected to info.com, shopica or some other advertisement site. This happens about once every ten times. In addition to running Anti-Malware, I've also run Ad-Aware with updated definitions, but that didin't find anything. My HijackThis logs are below.

Google searches redirected, Virus Scan disabled at startup

10 min read

epb

January 13, 2009, 6:33 PM UTC

Still clean:

GooredFix v1.81 by jpshortstuff
Log created at 13:32 on 13/01/2009 running Option #1 (epb3)
Firefox version 3.0.5 (en-US)

=====Suspect Goored Entries=====

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[redacted]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\"

peku006 MRU Emeritus

January 13, 2009, 6:50 PM UTC

Hi epb

Congratulations, your log looks clean!

Next we remove all used tools.

Uninstall GooredFix
Click Start >> Run and then copy/paste the following into the box and hit Enter:
"%userprofile%\Desktop\GooredFix.exe" /uninstall
If any of your security programs query a new Registry/AutoStart value being added please allow the changes.

Uninstall ComboFix

Click START then RUN
Now type Combofix /u in the runbox and click OK

Here are some free programs I recommend that could help you improve your computer's security.

Spybot Search and Destroy 1.6
Download it from here. Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install SpyWare Blaster 4.0
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install FireTrust SiteHound
You can find information and download it from here

Install MVPS Hosts File from here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com

Please check out Tony Klein's article "How did I get infected in the first place?"

Read some information here how to prevent Malware.

Is your pc running slow?
Read What to do if your Computer is running slowly

Happy surfing and stay clean! :thumbup:

NonSuch Administrator

January 18, 2009, 8:45 AM UTC

As this issue appears to be resolved,

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.