Redirect/Jump problem

[imps]

Hi,

I am experiencing what seems a common problem of search selections jumping to incorrect sites. Very annoying!

I have performed the AVG install and scan as per the Read Me post. The results are below along with the hijackthis log.

Can anyone help me please.

--------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 10:55:20 PM 5/14/2007
+ Scan result:

C:\Program Files\Common Files\DriveCleaner Free\dcsm.exe -> Not-A-Virus.Downloader.Win32.WinFixer.x : Cleaned with backup (quarantined).
[3844] C:\Program Files\Common Files\DriveCleaner Free\dcsm.exe -> Not-A-Virus.Downloader.Win32.WinFixer.x : Cleaned with backup (quarantined).
C:\Documents and Settings\Stephen Impey\Cookies\stephen impey@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@atoc.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@divx.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@heavycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@travelcomau.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@wotifcom.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen [EMAIL="impey@atdmt"]impey@atdmt[/EMAIL][2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@clickbank[1].txt -> TrackingCookie.Clickbank : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][2].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Falkag : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@kmpads[1].txt -> TrackingCookie.Kmpads : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Live : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen [e-mail][1].txt -> TrackingCookie.Msn : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][2].txt -> TrackingCookie.Netflame : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@pro-market[2].txt -> TrackingCookie.Pro-market : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@real[1].txt -> TrackingCookie.Real : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@revsci[2].txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail]-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Skype : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@skype[1].txt -> TrackingCookie.Skype : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@toplist[1].txt -> TrackingCookie.Toplist : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][2].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][2].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\[e-mail][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Stephen Impey\Cookies\stephen_impey@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\System Volume Information\_restore{ED1A31BE-8149-41CB-B15A-14B013B277CC}\RP29\A0001707.exe -> Trojan.PolyCrypt.b : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\kdxhs.ren -> Trojan.PolyCrypt.b : Cleaned with backup (quarantined).

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 9:15:41 PM, on 5/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Hijackthis\HiJackThis_v2.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://asg-i-syd.statestreet.com/dana-cached/setup/JuniperSetupSP1.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
--
End of file - 7705 bytes

[kylethedarkn]

Your log looks clean and AVG cleaned everything it found. Could you be more specific and tell me exactly what the problem is in detail. Thx.

[imps]

Hi,

Thankyou very much for taking the time to look at my log, after running AVG I didn't use the search again as I presumed it would still be a pain. But, all is ggod now ABG seems to have done the trick.

Thank again

[kylethedarkn]

Glad to hear everything is working now.

[emmit6378]

check this out, it has google redirect fix