Malware Removal Forums

Google Redirecter

gmj1234 · 2009-02-26T23:19:03+00:00

Hi, I'm having big problem with a google redirector. Manually typing in addresses in the address bar is fine but half the time I try and access webpages via google I get redirected. The most common page I tend to get sent to is someting like "clickfraudmanager.com" and there is some mention of this on other forums about a possible trojan I've tried a range of removal tools (ad aware, spybot, AVG etc) but it's really persistent. If anyone could help I'd be really grateful! My Hijack this log is below: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:17:21, on 26/02/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program

31 min read

dan12

March 5, 2009, 9:18 AM UTC

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Double-click GooredFix.exe to run it.
Select 1. Find Goored (no fix) by typing 1 and pressing Enter.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: Do not run Option #2 yet.

gmj1234

March 5, 2009, 4:01 PM UTC

here is the log:

GooredFix v1.91 by jpshortstuff
Log created at 15:59 on 05/03/2009 running Option #1 (Administrator)
Firefox version 3.0.7 (en-GB)

=====Suspect Goored Entries=====

C:\Program Files\Mozilla Firefox\extensions\{9B203DEF-F42A-4BB9-A3CC-9EDDF7BDA334}

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[removed]"="C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\"

dan12

March 5, 2009, 4:25 PM UTC

Please double-click GooredFix.exe on your Desktop to run it.

Select "2. Fix Goored" by typing 2 and pressing Enter.
Make sure all instances of Firefox are closed at this point.
Type y at the prompt and press Enter again.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: If you receive a message saying that GooredFix needs your system to be restarted, please close all applications and reboot your system. Please also allow any registry changes that may be prompted by any of your security programs.

gmj1234

March 5, 2009, 9:30 PM UTC

Here it is:

GooredFix v1.91 by jpshortstuff
Log created at 21:28 on 05/03/2009 running Option #2 (Administrator)
Firefox version 3.0.7 (en-GB)

=====Goored Deletions=====
C:\Program Files\Mozilla Firefox\extensions\{9B203DEF-F42A-4BB9-A3CC-9EDDF7BDA334}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.7\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[removed]"="C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\"

dan12

March 5, 2009, 9:44 PM UTC

Let me know how things are and if that has resolved the issue.

NonSuch

March 11, 2009, 1:44 AM UTC

a lack of response,