Malware Removal Forums

Dewsperately need any help with redirecting or disappearing.

Frederick · 2010-11-04T02:04:53+00:00

Why would somebody do this. I lost 6 days of my life trying to fix this. A few friends also helped and one finds out who they are. It all started with Google redirecting me all over the place. Then I would get code 404 (i think)" web site does not exist". I would suddenly receive pages on how to change the size of a particular place on my anatomy. I would end up on Yahoo or to a new Google blank page. A friend found out that my original page would be covered by the new redirected page...troubling for me because I'm not computer savvy. The oddest thing: when i'm redirected and end up on some page I can close it (red cross top right) and I would fall back on the initial Google page, I can click on my chosen site and most of the times it would come on. Sometimes I'm reading a page and my pointer would lazily stop on a picture, a news item on a newspaper site and suddenly google will appear. The Cirque du Soleil has nothing like this for sure. I'm protected by Malwarebytes 1.46 but for som

140 min read

Frederick

November 9, 2010, 8:19 PM UTC

Oh...I was finally able to download (and accepted) the latest Malwarbytes downloads.

askey127

November 9, 2010, 8:21 PM UTC

This is what I would suggest. It will leave only the MyBabylon toolbar running.
First I do want to find that Advertising center scoundrel.
---------------------------------------------
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:regfind

Advertising
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

----------------------------------------------
Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:



:processes

killallprocesses



:OTL

O2 - BHO: (Aide pour le lien d'Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)

O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\siteadvisor\mcieplg.dll File not found

O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\siteadvisor\mcieplg.dll File not found

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()

O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)



:Commands

[Reboot]

Then click the Run Fix button at the top.
Let the program run unhindered and reboot the PC when it is done.
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

----------------------------------------------
Then please uninstall these, using Add/Remove programs:
Google Toolbar for Firefox
Google Toolbar for Internet Explorer
Google Update Helper

Hope you feel better soon.

Frederick

November 9, 2010, 10:35 PM UTC

SystemLook 04.09.10 by jpshortstuff
Log created at 17:32 on 09/11/2010 by Propriétaire
Administrator - Elevation successful

========== regfind ==========

Searching for "Advertising"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.net]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dollaradvertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\exactadvertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\gatoradvertisinginformationnetwork.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dollaradvertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\exactadvertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gatoradvertisinginformationnetwork.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\83a4ce2b545b00a4284131efe019e5d6]
"ProductName"="Advertising Center"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BF35A546-B97C-4F53-8062-6CFB6087BE2D}]
@="IAdvertisingSession2"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Dynamic Directory\Conference]
"advertisingScope"="local"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Adobe\Adobe Contribute CS3\Configuration\Content\StarterPages\60-professional_services\advertising_design\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Adobe\Adobe Contribute CS3\Configuration\Content\StarterPages\60-professional_services\advertising_design\_notes\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files\Adobe\Adobe Flash CS3\fr\Configuration\Templates\Advertising\"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3E77053FB362CFF4AAD4618EE8D1FDD4]
"1793DF0828488C94ABC86B64A45188F2"="C:\Program Files\Adobe\Adobe Flash CS3\fr\Configuration\Templates\Advertising\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4DC11E875D37AA945AD05A0CF5C2CCD3]
"E4EDA48F0229423499D408E1DDD92D15"="C:\Program Files\Adobe\Adobe Contribute CS3\Configuration\Content\StarterPages\60-professional_services\advertising_design\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4EBBA5CCA284EA646874E688A12D47A2]
"E4EDA48F0229423499D408E1DDD92D15"="C:\Program Files\Adobe\Adobe Contribute CS3\Configuration\Content\StarterPages\60-professional_services\advertising_design\_notes\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\83a4ce2b545b00a4284131efe019e5d6\InstallProperties]
"DisplayName"="Advertising Center"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.net]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\gatoradvertisinginformationnetwork.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b2ec4a38-b545-4a00-8214-13fe0e915e6d}]
"DisplayName"="Advertising Center"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.net]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dollaradvertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\exactadvertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\gatoradvertisinginformationnetwork.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dollaradvertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\exactadvertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gatoradvertisinginformationnetwork.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]
[HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]

-= EOF =-

Frederick

November 9, 2010, 10:41 PM UTC

========== PROCESSES ==========
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
File move failed. C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll scheduled to be moved on reboot.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{074C1DC5-9320-4A9A-947D-C042949C6216}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{074C1DC5-9320-4A9A-947D-C042949C6216}\ deleted successfully.
C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3049C3E9-B461-4BC5-8870-4C09146192CA}\ deleted successfully.
C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE7CD045-E861-484f-8273-0445EE161910}\ deleted successfully.
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully.
C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ deleted successfully.
File C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{517BDDE4-E3A7-4570-B21E-2B52B6139FC7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{517BDDE4-E3A7-4570-B21E-2B52B6139FC7}\ deleted successfully.
File C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\swg deleted successfully.
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
File C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll not found.
========== COMMANDS ==========

OTL by OldTimer - Version 3.2.17.3 log created on 11092010_173604

Files\Folders moved on Reboot...
C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll moved successfully.

Registry entries deleted on Reboot...

Frederick

November 9, 2010, 10:56 PM UTC

Thank you for your well wishes. These past days have been traumatic.
I removed Google toolbar for firefox.
They (?) tell me that Google toolbar for Internet Explorer is already gone, do I want to remove the listing? Yes....I did.
And Google update helper is nowhere to be seen.
Thank you.

askey127

November 10, 2010, 2:05 AM UTC

Now we need to see if you still get popups, etc. that are unwanted.
If so, we will clean out some more.

Frederick

November 10, 2010, 2:45 AM UTC

Let's clean some more........I get redirected to: 40report.com....

About 10 times now.....

Or I get: Internet Explorer cannot display the webpage

I close, come back, click again...once , twice, thrice...finally get to where I am looking for.

askey127

November 10, 2010, 10:41 AM UTC

Frederick,
------------------------------------------------------------
Backup Your Registry with ERUNT:

Download erunt.zip to your Desktop from here:
http://aumha.org/downloads/erunt.zip
Right-click erunt.zip, select Extract All... and follow the prompts to extract ERUNT to your Desktop. It will create a new folder.
Inside the new folder, if you have XP, double click ERUNT.exe. If you have Vista, right click ERUNT.exe and choose "Run as administrator"
OK all the prompts to back up your registry to the default location.

Note: If you ever need to restore your registry later, you would go to the default backup folder and start ERDNT.exe
(The default backup folder is C:\Windows\ERDNT\ and the backups are saved according to date stamp)
----------------------------------------------
Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:



:Reg

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.net]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dollaradvertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\exactadvertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\gatoradvertisinginformationnetwork.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dollaradvertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\exactadvertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gatoradvertisinginformationnetwork.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\83a4ce2b545b00a4284131efe019e5d6]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BF35A546-B97C-4F53-8062-6CFB6087BE2D}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\83a4ce2b545b00a4284131efe019e5d6\InstallProperties]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.net]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\gatoradvertisinginformationnetwork.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b2ec4a38-b545-4a00-8214-13fe0e915e6d}]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]

[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\directnetadvertising.net]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\dollaradvertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\exactadvertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\gatoradvertisinginformationnetwork.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dollaradvertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\exactadvertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gatoradvertisinginformationnetwork.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]

[-HKEY_USERS\S-1-5-21-2000478354-1425521274-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\advertising.com]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ero-advertising.com]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\servedby.advertising.com]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\advertising-money.info]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\jackpot-advertising.info]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\klikadvertising.com]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\paltalk.com\advertising]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\worldwideadvertisingservices.info]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\advertising-money.info]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\jackpot-advertising.info]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\klikadvertising.com]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\paltalk.com\advertising]

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\worldwideadvertisingservices.info]



:Commands

[EMPTYTEMP]

[Reboot]

Then click the Run Fix button at the top.
Let the program run unhindered and reboot the PC when it is done.
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

askey127

Frederick

November 10, 2010, 11:28 AM UTC

I went up to create a new folder of ERUNT on my desktop.
I opened it up by double clicking, there are 11 sub folders inside. i'm sorry for my incompetence, what do i do now? On which ones do I click?

askey127

November 10, 2010, 2:54 PM UTC

Go ahead and skip the ERUNT task.
Then do the OTL task.
There is nothing very risky in the actions we are taking, as long as you copy and paste the code box contents.

Frederick

November 10, 2010, 11:08 PM UTC

Hi there and good evening.
The situation was getting so bad. I decided to reformat my computer and it took all day.
The greatest surprise was when I started up again and....the problem was still there. This was impossible as the hard drive had been emptied.
The malware, virus, pain in the neck was hidden in.......the router! I reinitialised it and now I am stuck without my printer, I need a new IP adress, I just don't know where to get it. I knew that the problem started when I had downloaded a picture to print on my Canon CL1120. ( a big printer).
I will immediately download Malawarebytes. I installed AVG also.

I GREATLY THANK YOU FOR YOUR TIME AND UNMITIGATED EFFORT IN HELPING this total stranger.
I always thought of New Hampshire as my favorite state, one more reason to add to my list.
How can I repay you?
Frederick.

askey127

November 11, 2010, 12:36 AM UTC

Does that sound familiar?
You don't need to repay me, except to change the password on your Router admin user .!

Frederick

November 11, 2010, 12:58 AM UTC

How do I do that ? Please tell me. Nobody uses this computer but me.
I found the new IP for the computer that powers the printer... now I have to set it up in Photoshop, very confusing...
If I could tell you how fed up I am....my mouse won't double click...it will....trust me it will.

askey127

November 11, 2010, 11:35 AM UTC

Frederick,
You will need to determine the maker and model number of the Router.
Then if possible, locate the instructions that came with it.

You should be able to plug the name and Model into Google and get some information on it,
For example, for mine, I would type "Netgear RP614 router"
If you can find the instruction manual at home or online, that will be a bit easier.
The default username and password that comes with each router model are published here: http://www.phenoelit-us.org/dpl/dpl.html
Look up the username and default password for your router model and write them down.

To change the settings on your router you will need to find its home address
Go to Start, Run
Type cmd and hit OK
Now type ipconfig and hit <Enter>

Write down the numbers and dots showing for Default Gateway
My IP address shows 192.168.0.7
My Default gateway shows 192.168.0.1 <=== Yours will likely be slightly different.
If you open Firefox or Internet Explorer and type the Default Gateway number into the address box at the top, it will come up on the website you need for the instructions and settings for YOUR router.
It will ask for a username and password. If you never changed them, you will use the name and password that you wrote down.

Two things need to be done when you bring up the website:

You need to look at the IP addresses showing in the settings, call your Internet Company, ask for Tech Support for router settings, and determine which IP addresses are correct and which need to be removed.
If you see an extra one that shows 85.255.xx.xx for example, that is a bad one and needs to be removed. Tech support will tell you which ones are correct and which ones are bad.
Next, you need to change your password. (The one you used to get into the website). You use that same set of screens to change the password.

Not having changed the password when you first got the router is what allowed criminals to hack your router and enter their own number(s).
I can't tell you every keystroke to use, because each router and internet provider has a different group of settings. But, there are only a few things to do, and you should be able to do it.
Getting it done is now between you and your Internet Company.
If you don't get it done, you will continue to have redirects, and your PC will likely get infected.

Your PC itself is probably clean right now, since you just reformatted and re-installed Windows.
Be sure You have Automatic updates turned ON (Control Panel) and you have one Antivirus installed.

askey127

Frederick

November 11, 2010, 11:48 AM UTC

Thank you very much, I'm going there now. I have a D link.
A LOT of work to catch up to.
I'm still trying to connect my big printer. It has it's own IP address.
Thank you again....and again....