Malware Removal Forums

Google Redirecter

gmj1234 · 2009-02-26T23:19:03+00:00

Hi, I'm having big problem with a google redirector. Manually typing in addresses in the address bar is fine but half the time I try and access webpages via google I get redirected. The most common page I tend to get sent to is someting like "clickfraudmanager.com" and there is some mention of this on other forums about a possible trojan I've tried a range of removal tools (ad aware, spybot, AVG etc) but it's really persistent. If anyone could help I'd be really grateful! My Hijack this log is below: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:17:21, on 26/02/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program

9 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

dan12 MRU Honors Grad Emeritus

March 5, 2009, 9:18 AM UTC

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Double-click GooredFix.exe to run it.
Select 1. Find Goored (no fix) by typing 1 and pressing Enter.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: Do not run Option #2 yet.

gmj1234

March 5, 2009, 4:01 PM UTC

here is the log:

GooredFix v1.91 by jpshortstuff
Log created at 15:59 on 05/03/2009 running Option #1 (Administrator)
Firefox version 3.0.7 (en-GB)

=====Suspect Goored Entries=====

C:\Program Files\Mozilla Firefox\extensions\{9B203DEF-F42A-4BB9-A3CC-9EDDF7BDA334}

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[redacted]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[redacted]"="C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\"

dan12 MRU Honors Grad Emeritus

March 5, 2009, 4:25 PM UTC

Please double-click GooredFix.exe on your Desktop to run it.

Select "2. Fix Goored" by typing 2 and pressing Enter.
Make sure all instances of Firefox are closed at this point.
Type y at the prompt and press Enter again.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: If you receive a message saying that GooredFix needs your system to be restarted, please close all applications and reboot your system. Please also allow any registry changes that may be prompted by any of your security programs.

gmj1234

March 5, 2009, 9:30 PM UTC

Here it is:

GooredFix v1.91 by jpshortstuff
Log created at 21:28 on 05/03/2009 running Option #2 (Administrator)
Firefox version 3.0.7 (en-GB)

=====Goored Deletions=====
C:\Program Files\Mozilla Firefox\extensions\{9B203DEF-F42A-4BB9-A3CC-9EDDF7BDA334}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[redacted]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[redacted]"="C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\"

dan12 MRU Honors Grad Emeritus

March 5, 2009, 9:44 PM UTC

Let me know how things are and if that has resolved the issue.

NonSuch Administrator

March 11, 2009, 1:44 AM UTC

a lack of response,

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.