Malware has hijacked Google searches, PC runs slow

Hi,
Good. Almost done.
Let's move.

First,
Remove programs.
Please Click on Start > Control Panel > Add/Remove Programs
Remove the listed program(s) by clicking Remove

Adobe Reader 6.0.1

If some programs listed above are not in present, please do not panic and proceed to the next step.

Next,
Java is out of date.
It can be updated by the Java control panel

• Click on Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now.
• An update should begin.
• Follow the prompts.

Next,
Update Adobe Reader.
Any versions numbered lower than 9.2 should be replaced.

• Go HERE and click on AdbeRdr920_en_US.exe to download the latest version of Adobe Acrobat Reader.
• Save this file to your desktop and run it to install the latest version.

Next,
CCleaner - Clear temp.

• Double click the CCleaner shortcut on the desktop to start the program.
• On the Windows tab, under Internet Explorer, uncheck Cookies if you do not want them deleted.
  (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
• If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.
• Click on the Options icon at the left side of the window, then click on Advanced. Untick Only delete files in Windows Temp folders older than 48 hours.
• Click on the Cleaner icon on the left side of the window, then click Run Cleaner to run the program.

Caution: It is not recommended that you use the Issues feature unless you are very familiar with the registry as it has been known to find legitimate items.
After CCleaner has completed its process, click Exit.

Next,
Kaspersky Online AV Scan
Note: Internet Explorer should be used.
Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
  • Archives
  • Mail databases
• Click on My Computer under Scan and then put the kettle on!
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place like your Desktop. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Copy and paste the report into your next.

Next,
Checklist.
Please post.

• Content of kaspersky log
• How is your system now? Any problem left?

Thanks once again for all your assistance!

I have removed Adobe Reader 6.0.1 from my PC and replaced it with Adobe Reader version 9.2.
I have also updated my Java.

As you instructed, I ran CCleaner and did an Kaspersky Online AV Scan.
Here is the Kaspersky log:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, December 28, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, December 28, 2009 01:34:22
Records in database: 3411904
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Objects scanned: 106361
Threats found: 1
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 04:03:21


File name / Threat / Threats count
C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1

Selected area has been scanned.
_________________________

My system is running great now, better than it has in some time! Thanks!

Hi,
Good to hear.
Let's proceed with this one. Your system still appear to have a few infection.

First,
OTM by Old Timer.
Please download from HERE and save to the desktop.

• Double-click on OTM.exe. (Vista users, please right click on OTM.exe and select Run as an Administrator)
• Copy the lines in the codebox below.
  

  :processes
  explorer.exe
  :files
  C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys\WebSys.mmz
  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz
  :commands
  [emptytemp]
  [start explorer]
  [reboot]
  

• Return to OTM, right click in the Paste Instructions for Items to be Moved window (under the yellow bar, Code box into OTMoveIt3 (1).) and choose Paste.
• Click the red Moveit! button.
• Close OTM.

Note:

• If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.
• If you are asked to reboot the machine choose Yes.

Other than that,

Good!
Your system now is clean.
Let's do some cleaning and management.
You may proceed to delete all tools that we use.

Next,
OTM - Cleaning
Double Click on OTM.exe.

• Click on CleanUp!.
• Select Yes when the "Begin cleanup Process?" prompt appears.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.

Additional Information :

SpywareBlaster.

• SpywareBlaster help your Internet Explorer more strong as it will help to block known malicious ActiveX
• A tutorial on installing & using this product can be found HERE

Antivirus.

• Antivirus help you to give the maximum protection for the system.
• You are advice to have only ONE antivirus running on the system.
• Please keep it update regurlarly.

WinPatrol.

• Unwanted things always occur behind your knowledge. Let's this software take the snapshot of it.
• For more information and installation can be found HERE

Windows/Program Update.
Please make sure to have your Windows Automatic Update turn ON or you can do it manually.
Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office products loopholes and fix any bugs found. Install the updates immediately if they are found.
To update Windows

• Go to Start > All Programs > Windows Update

To update Office

• Open up any Office program.
• Go to Help > Check for Updates

You always can refer at both website to check either any updates are needed for your system.

• Secunia Software Inspector
• F-secure Health Check

Information.

• Please check out Tony Klein's article "How did I get infected in the first place?"
• Read some information here how to prevent Malware.
• Is your pc running slow? Read What to do if your Computer is running slowly

Safe surfing!

I just finished the OTM cleaning and everything appears to be running normal!

Two quick questions:

1) Should I now turn on Windows system restore? (I turned it off when I first attempted to fix the problem.)

2) Can I now re-install Spysweeper?

I am taking your advice and downloading the programs and tools that you recommended.

Thanks so much for all your help! And thanks to all the people who help run this forum! You guys are awesome!

I'm very grateful!

Hi,

1) Should I now turn on Windows system restore? (I turned it off when I first attempted to fix the problem.)

Yes, you should.

Next,
Please create the Restore Point for this current condition.
If you don't know how to do that, please refer below

• Windows XP

2) Can I now re-install Spysweeper?

It's up to you.

Thanks so much for all your help! And thanks to all the people who help run this forum! You guys are awesome

You're welcome

I will have this topic archive. Please reply one more time to make sure you have read this.

Yes, thanks again for all your help!

As it appears this issue has been resolved,