Firefox google redirect and Unable to Update Windows help!!

http://virusscan.jotti.org/en/scanresult/b54436acb7074658e6798859da41c89f38a81947/8fd4c8562eff91a56caacee6a2e62f9b97abbcec

Hi tyee.

i don't believe that i am being re-directed anymore! thank you!! and it seems as if my update problem was resolved too

You're welcome.
Excellent but Stay with me we still have work to do.

Your computer was infected with a ROOTKIT. In particular, the TDL3/TDSS rootkit, also known as Win32/Alureon. A rootkit is a set of software tools intended for concealing running processes, files or system data from the operating system.

Due to its rootkit functionality, it's impossible to tell what may have been done when the system was compromised.

Therefore once you're PC is clean it may be prudent to:

1. Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts.
   
2. Change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password)

What are rootkits from Wikipedia

How do I respond to a possible identity theft and how do I prevent it



I see you have CCleaner installed please run it now.
CAUTION: Please do NOT use the "Registry" button in the left pane.
This is a built-in registry cleaner. Removing certain entries can render your computer inoperable!

Next.

Disable AVG9

• Open AVG User Interface.
• Double-click on the Resident Shield.
• Un-tick the option Resident Shield active.
• Save the changes.
• Note: Don't forget to re-enable it after the below scan.

Next.

ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

• Hold down Control then click on the following link to open a new window to ESET online scannner
• Then click on:
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology


• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Logs/Information to Post in your Next Reply

• ESET log.
• Please give me an update on your computers performance.

infected:
C:\ProgramData\Spybot - Search & Destroy\Recovery\DNSFlushcws1.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\DNSFlushcws7.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\DNSFlushcws1.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\DNSFlushcws7.zip Win32/Bagle.gen.zip worm
C:\Users\Tim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\76911fc3-718b9691 multiple threats
C:\Users\Tim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\775493bf-3bb7f7e2 a variant of Java/Exploit.Agent.NAC trojan
C:\Users\Tim\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\6bd9d49-548e367d multiple threats
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\30feb821-64baa5d7 a variant of Java/TrojanDownloader.Agent.NAN trojan
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\31bba1f4-3b02fa50 Java/TrojanDownloader.Agent.NBL trojan
C:\Windows\Temp\jar_cache5562307172249811431.tmp a variant of Java/Exploit.Agent.NAC trojan
C:\Windows\Temp\jar_cache6473265857702048200.tmp multiple threats

Hi tyee.
Not much left to do, complete the following then if no other problems i will give you final instructions.


Clear Java cache

• Click on Start > Control Panel > Classic view then double-click the Java Icon. (looks like a coffee cup)
• On the General tab, under Temporary Internet Files, click the Settings button.
• Next, click on the Delete Files button.
• There are two options in the window to clear the cache - Leave BOTH Checked.
  
  • Applications and Applets
    
  • Trace and Log Files
• Click OK on Delete Temporary Files Window
• Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
• Click OK to leave the Temporary Files Window
• Click OK to leave the Java Control Panel.

Next.

Download and run OTM

Download OTM.exe by Old Timer and save it to your Desktop.

• Right-click OTM.exe And select " Run as administrator " to run it.
• Right-click then copy the following code, Do not include the word Code.
  

  
  
  :Files
  
  C:\ProgramData\Spybot - Search & Destroy
  
  C:\Users\All Users\Spybot - Search & Destroy
  
  C:\Windows\Temp\jar_cache5562307172249811431.tmp 
  
  C:\Windows\Temp\jar_cache6473265857702048200.tmp 
  
  
  
  :Commands
  
  [emptytemp]
  
  [start explorer]
  
  [Reboot]
  
  

  
  
  • Return to OTM, right-click then paste the code into the blank box below
  • Next click on the large button.
  • OTM may ask to reboot the machine. Please do so if asked.
  • Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



Logs/Information to Post in your Next Reply

• OTM log.
• Please give me an update on your computers performance.

_otm.txt:

All processes killed
========== FILES ==========
C:\ProgramData\Spybot - Search & Destroy\Recovery folder moved successfully.
C:\ProgramData\Spybot - Search & Destroy\Logs folder moved successfully.
C:\ProgramData\Spybot - Search & Destroy folder moved successfully.
File/Folder C:\Users\All Users\Spybot - Search & Destroy not found.
C:\Windows\Temp\jar_cache5562307172249811431.tmp moved successfully.
C:\Windows\Temp\jar_cache6473265857702048200.tmp moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Tim
->Temp folder emptied: 1720015 bytes
->Temporary Internet Files folder emptied: 145168026 bytes
->Java cache emptied: 14886 bytes
->FireFox cache emptied: 36721157 bytes
->Flash cache emptied: 111548 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 180320940 bytes
RecycleBin emptied: 366318908 bytes

Total Files Cleaned = 697.00 mb


OTM by OldTimer - Version 3.1.14.0 log created on 07132010_074713

Hi tyee.
Good work you did well

your latest set of logs appear to be clean!
This is my general post for when your logs show no more signs of malware.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

OTC

Download OTC by Old Timer and save it to your Desktop. This tool will remove all the tools we used to clean your pc.

• Right-click OTC.exe And select " Run as administrator " to run it.
• Click the CleanUp! button
• Select Yes when the Begin cleanup Process? Prompt appears
• If you are prompted to Reboot during the cleanup, select Yes
• The tool will delete itself once it finishes, if not delete it by yourself

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.


You can now delete any tools we used if they remain on your Desktop.



Create a new, clean System Restore point

• Click Start, Right Click on Computer, and select Properties.
• In the left pane, click System Protection > Creat.
• Give this restore point a descriptive name and click Create.
• Click Apply and OK.

Note: Do not clear infected/old System Restore points before creating a new System Restore point first!

Flush infected System Restore points

• Click Start, Right Click on Computer, and select Properties.
• In the left pane, click System Protection.
• untick the box labeled Vista C: an click Turn off system restore.
• Click Apply and OK.
• Restart your computer.

Protection Programs
Don't forget to re-enable any protection programs we disabled during your fix.

Here are some free programs I recommend that could help you improve your computer's security.

Install SiteAdvisor
SiteAdvisor is a toolbar for Microsoft Internet Explorer and Mozilla Firefox which alerts you if you're about to enter a potentially dangerous website.
You can find more information and download it from Here

Install WinPatrol
As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.
For more information, please visit HERE

MVPS Hosts

Install MVPS Hosts File From Here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
You can Find the Tutorial HERE

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Microsoft Windows Update
Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office products loopholes and fix any bugs found. Install the updates immediately if they are found.
To update Windows
Go to Start > All Programs > Windows Update > Check for updates.
To update Office
Open up any Office program.
Go to Help > Check for Updates

Read some information HERE On how to prevent Malware

Is your pc running slow?
Read What to do if your Computer is running slowly

I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Safe surfing!

hey i was able to do all of the steps except for flushing all system restore points. Do I delete the system restore point?

Hi tyee.

Note: Do not clear infected/old System Restore points before creating a new System Restore point first!

As it appears this issue has been resolved,