Firefox keeps getting redirected- Help :(

Hi Snake3190,

Take your own time to do it ,
I still need the kaspersky or ESET log before I can proceed further.

Regards,
xixo_12

I thank you for your patience with me

Here is the contents of the Kaspersky log

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Friday, November 27, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, November 27, 2009 07:13:29
Records in database: 3295915
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 151057
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 03:30:24


File name / Threat / Threats count
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8Z6BG3S7\djgtguhvvf[1].htm Infected: Packed.Win32.Krap.ah 1

Selected area has been scanned.

Hi,

KEYLOGGER
I'm afraid I have some bad news for you. Your computer is infected with KEYLOGGER. KEYLOGGER are the most dangerous and most widespread type of Trojan. KEYLOGGER provide the author or "master" of the Trojan with remote "administration" of victims machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, KEYLOGGER can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer, change settings on the computer and more. Please read this article by Roger A. Grimes on Remote Access Trojans it will give you an idea of the severity of the type of infection you have.

You are strongly advised to do the following:

• Disconnect the computer from the Internet and from any networked computers until it is cleaned.
• Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
• Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all youraccount numbers.
• From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).

Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.

Because of the severity and the capabilities of this type of virus, (it cannot be known what changes to your system it has made or if it opened up other ways into your system) The only responsible course of action I can advise is to reformat your computer and reinstall windows.

Further reading:

• How do I respond to a possible identity theft and how do I prevent it
• When should do a reformat and reinstallation of my OS
• Where to backup your files
• How to backup your files in Windows XP
• Restoring your backups

Post any question if you have.
Please let us know what you have decided to do in your next post.

"In a case where only search hijackers and pop-up producing adware are found we should not automatically recommend re-formatting provided the malware can be removed another way, and providing the computer requires only normal levels of security. Hijackers and adware are written for advertising money, and their authors are not normally interested in anything more malicious than getting click-through payments from advertisers. Seldom is a backdoor in adware used by the maker to install anything other than more hijackers and ad-ware."

I'm not trying to be a pain, I'd just like to use reformatting as an absolute last resort. I don't have my Windows Disk, I lent it to a friend and I remember bringing it home but i dont know what I did with it. I have a small passport harddrive so saving my personal files wouldnt be an issue. I also don't remember the steps to reformatting, the last time I did it was last Christmas.

So I would love to know if there is ANY possible solution that could at least guarantee some protection, or if you could somehow direct me to a way I can obtain a way to either purchase a windows disk, somehow download it online and put it on a CD where it would function ideally as if it was a normal CD, and if you could show me the steps in reformatting my computer as to make sure there are no messups (Last time i reformatted i accidentally partitioned my harddisk into two seperate drives). I thank you so at least I know what I'm dealing with. I'll go onto my sisters computer and change all my passwords when I start the process. For now I have noticed no difference in any of my accounts that I have accessed and I do not store credit card information or anything on this system.

Additional information.
I found a few files all created on a date when this started happening. I dont know if I can clean my computer of any files downloaded from
Wednesday, November 18, 2009, 7:01:19 PM to Today.
I've also found files from
Friday, November 20, 2009, 6:44:59 AM which is when my computer was attacked and had software downloaded unto it.

I found these files in C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8Z6BG3S7

I wouldn't mind cleaning every file put on my computer from that date, although I know a system restore is out of the question.

Also GMER.exe said there was a suspicious modification to
File C:\WINDOWS\system32\drivers\iaStor.sys suspicious modification
And the file was created back to may 2006, so im hopeful it hasnt created a permanent backdoor or something into my system with that.

Last comment, do you recommend a reliable and safe Firewall rather than Zonealarm or would you agree Zonealarm is a good firewall?

I again thank you for your time, and apologize for this long post.

Hi Snake3190,

I again thank you for your time, and apologize for this long post.

You're welcome. We are glad to help you .

When we're dealing with the KEYLOGGER infection (not only for this case), we will recommended Reformat and Reinstall is the best option.
That's the best advice that we could offer. Due to the behaviour of this type of infection (modification towards unknown file), there is a high possibilities the files will remain in the system and we can't detect it.

This system belongs to you. You have to let us know your decision! Clean the machine OR Reformat & Reinstall.
But please remember, my best advice still Reformat and Reinstall.
Try to clean the system is not recommended. You should know the risk involved. In other word, "looks clean, but it's not".

I don't have my Windows Disk, I lent it to a friend and I remember bringing it home but i dont know what I did with it.

You have to find it!
Below is a few websites that you can use to purchase the original Windows XP (In case, you can't find your XP CD) :

• PCWorld
• Amazon

You have to decide now, then I would love to give some other comment/advice to you.

do you recommend a reliable and safe Firewall rather than Zonealarm or would you agree Zonealarm is a good firewall?

Using any Firewall is a good choice. But the bad is, sometimes user overlook during installation. Beware! Don't install any related with AskBar or any other toolbar.

Next,
Checklist.
Please post.

• Your decision.

Heh, I guess I was a bit hopeful that maybe I wouldn't have to . I'll keep trying to find mine or try to borrow one from a friend. But I have to reluctantly agree that reformatting would be the best choice because of the fact I've already seen this virus hide files all over my computer =/.

So I suppose my final decision would be to reinstall and reformat my computer. If I knew that I could get a disk and the reformat would go smoothly I would love to do it, My computer ran so well the last time I did it haha.

If you have any last tips for the process, maybe some suggestions to stop this from happening again (I didn't install anything suspicious recently so I have no idea how it could have happened). would be greatly appreciated .

Hi Snake3190 ,

I'll respect your decision to do a clean install.

Below link will give an idea for the things that you will face :
When should I re-format? How should I reinstall?
Windows XP Clean install

Then there are a couple of things you should do immediately after installing Windows and before surfing the net.

SpywareBlaster.

• SpywareBlaster help your Internet Explorer more strong as it will help to block known malicious ActiveX
• A tutorial on installing & using this product can be found HERE

Antivirus.

• Antivirus help you to give the maximum protection for the system.
• You are advice to have only ONE antivirus running on the system.
• Please consider one of this program:
  
  • Avast
  • AVG
  • AntiVir
  • Microsoft Security Essentials

Malwarebytes' Anti-Malware.

• Malwarebytes' Anti-Malware is a new and powerful anti-malware tool
• Only realtime protection need to pay.
• Tutorial on installing & using this product can be found below:
  
  • Description and download
  • How to install and run?

WinPatrol.

• Unwanted things always occur behind your knowledge. Let's this software take the snapshot of it.
• For more information and installation can be found HERE

Windows/Program Update.
Please make sure to have your Windows Automatic Update turn ON or you can use as below :
Windows XP
Important : Make sure you use the Internet Exporer 5 and above

• Please download Update for windows at HERE
• This site required ActiveX controls. Allow it to install at your system.
• Click Express button and let the web checking the lastest update.
• Follow the instruction by the web until updating process finish

You always can refer at both website to check either any updates are needed for your system.

• Secunia Software Inspector
• F-secure Health Check

Information.

• Please check out Tony Klein's article "How did I get infected in the first place?"
• Read some information here how to prevent Malware.
• Is your pc running slow? Read What to do if your Computer is running slowly

Happy Safe Surfing

my best advice still Reformat and Reinstall.
Try to clean the system is not recommended. You should know the risk involved. In other word, "looks clean, but it's not".

Just as a last check, I would like to go with what you recommended, to reinstall and reformat.

since you said

I'll respect your decision to do a clean install.

I don't know if you mean clean install as an analogy for Reformatting.

I'm wondering if I made my decision sound differently then what you recommended

I'm sorry for the confusion I just want to make fully sure you know I'm doing what you advised since you've been very helpful up to this point as it is.

Thanks again, and thanks for the program recommendations as well

Reformat&Reinstall = Clean install

You're welcome.

As this issue will be resolved with a reformat and pertinent questions have been answered, this topic is now closed.

You can help support this site from this link:
Donations For Malware Removal