Malware Removal Forums

Google Redirect Victim

stillpressingtoward · 2013-10-01T15:31:48+00:00

Hello! My kids have managed to infect my personal laptop with one of the redirect viruses. When i try clicking on a google link, it shoots me to what appears to be random ad pages. I have McAfee Antivirus and I ran a complete scan with no success. I started at McAfee board's and they referred me here. I downloaded "hijackthis" and have the file I can paste if you like. If you can help me identify where this crap comes from, I will shut down all access to those sites and even lock the computers down if I have to. Thank you for your help. Here is the DDS file your team requests. Below this is the ATTACH file. DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 10.0.9200.16686 BrowserJavaVersion: 10.21.2 Run by [redacted] at 11:05:45 on 2013-10-01 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3767.1420 [GMT -4:00] . AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {16C7

16 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

stillpressingtoward

October 6, 2013, 4:43 PM UTC

OTL file

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== FILES ==========
File\Folder C:\Users\Philippians 3-14\AppData\Local\Acer\Microsoft Help\fcmgehga.dll not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: [redacted]
->Temp folder emptied: 52704 bytes
->Temporary Internet Files folder emptied: 805157 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 54171759 bytes
->Flash cache emptied: 602 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 10400 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 35574009 bytes

Total Files Cleaned = 86.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 10062013_123345

Files\Folders moved on Reboot...
C:\Users\[redacted]\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\[redacted]\AppData\Local\Temp\MMDUtl.log moved successfully.
C:\Users\[redacted]\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\LMutilps32.log scheduled to be moved on reboot.
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

pgmigg Admin/Teacher

October 6, 2013, 6:16 PM UTC

Hello stillpressingtoward,

I downloaded and installed Java, but I can not see how to do the "optional" steps you suggested - and i want to do them.

OK. Please try to run another set of steps and if something will be wrong agian let me know exactly what it was.

OPTIONAL:
To prevent some unnecessary JAVA components from running when you boot your computer each time...

Go to Control Panel and click on the JAVA icon.
Now press the Advanced tab and go down in menu until you see the "Miscellaneous" options which probably will be the last one.
UNCHECK "Java Quick Starter".
Press Apply and OK. Then close the Java Control Panel. Close and exit Control Panel.

Please don't hesitate to ask any additional questions.

Stay Safe!

pgmigg

Failure to post replies within 72 hours will result in this thread being closed

stillpressingtoward

October 6, 2013, 8:54 PM UTC

Done.

pgmigg Admin/Teacher

October 6, 2013, 9:05 PM UTC

Hello stillpressingtoward,

Done.

Glad to read it!

Please don't hesitate to ask any additional questions.

Stay Safe!

pgmigg

Failure to post replies within 72 hours will result in this thread being closed

NonSuch Administrator

October 10, 2013, 1:53 AM UTC

As this issue appears to be resolved,

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.