This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Web search links are hijacked, cant seem to clean

24 min read

This thread's last reply is from August 19, 2009, 11:08 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

No need. The applet is known for being troublesome.

We'll use a different scanner.
  • Go here using Internet Explorer: http://www.eset.com/onlinescan/run_scanner.php
  • Put a checkmark next to Yes, I accept the Terms of Use and click the Start button
  • If prompted about installing ActiveX, allow it and click Install
  • If there is a checkmark next to Remove found threats, remove the checkmark and then click Start
  • The scanner will initialize and then start scanning. It will normally take 0.5 - 2 hours to complete.
  • When the scan has finished, close Internet Explorer
  • A log will be located here
    C:\Program Files\ESET\EsetOnlineScanner\log.txt
  • Include this log in your next reply
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\QMX4FM00\installb[1].exe a variant of Win32/Kryptik.ZE trojan
C:\Software\Fonts\fontsfree.exe multiple threats
this is the ESET.log

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6048
# api_version=3.0.2
# EOSSerial=53021cf5690efd44a2c3448fade94e9b
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-15 06:41:39
# local_time=2009-08-15 02:41:39 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# scanned=48695
# found=1
# cleaned=0
# scan_time=1799
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\QMX4FM00\installb[1].exe a variant of Win32/Kryptik.ZE trojan 00000000000000000000000000000000 I
esets_scanner_update returned -1 esets_gle=53251
# version=6
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6048
# api_version=3.0.2
# EOSSerial=53021cf5690efd44a2c3448fade94e9b
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-15 08:02:29
# local_time=2009-08-15 04:02:29 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# scanned=97548
# found=2
# cleaned=0
# scan_time=4787
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\QMX4FM00\installb[1].exe a variant of Win32/Kryptik.ZE trojan 00000000000000000000000000000000 I
C:\Software\Fonts\fontsfree.exe multiple threats 00000000000000000000000000000000 I
Download ATF-Cleaner by Atribune to your desktop.
Start the program and place a check next to the following items:
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Java Cache
  • Recycle Bin

Now click Empty Selected and click OK.

If you use FireFox, click the FireFox tab and place a check Select All. Click Empty Selected and answer No at the prompt.
If you use Opera, click the Opera tab and place a check Select All. Click Empty Selected and answer No at the prompt.

Submit a file for analysis
We need to have something checked for malware. Please go to Jotti's.
  • Click Browse next to File to upload & scan and copy and paste the first line of the following list into the browse box:
    C:\Software\Fonts\fontsfree.exe
  • Click Submit. The file will now be scanned for malware and the results will be displayed from the screen. Select the part where the virus scan results are shown and copy and paste this to notepad.
  • Copy and paste the whole notepad file you just made into your reply.



Update outdated software
Your version of Adobe Reader is old and may contain security leaks. Please first uninstall the older version, then download and install the newest version from here.
Your version of Sun Java is outdated and may contain security leaks. First uninstall all versions of Java you have installed. Then download and install the latest version of Java from java.com.

Also, do you connect to the internet through a wireless router?
a lack of response,