Malware Removal Forums

Google Redirect Victim

stillpressingtoward · 2013-10-01T15:31:48+00:00

Hello! My kids have managed to infect my personal laptop with one of the redirect viruses. When i try clicking on a google link, it shoots me to what appears to be random ad pages. I have McAfee Antivirus and I ran a complete scan with no success. I started at McAfee board's and they referred me here. I downloaded "hijackthis" and have the file I can paste if you like. If you can help me identify where this crap comes from, I will shut down all access to those sites and even lock the computers down if I have to. Thank you for your help. Here is the DDS file your team requests. Below this is the ATTACH file. DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 10.0.9200.16686 BrowserJavaVersion: 10.21.2 Run by [removed] at 11:05:45 on 2013-10-01 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3767.1420 [GMT -4:00] . AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {16C7C

126 min read

stillpressingtoward

October 6, 2013, 4:43 PM UTC

OTL file

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== FILES ==========
File\Folder C:\Users\Philippians 3-14\AppData\Local\Acer\Microsoft Help\fcmgehga.dll not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Phillippians 3-14
->Temp folder emptied: 52704 bytes
->Temporary Internet Files folder emptied: 805157 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 54171759 bytes
->Flash cache emptied: 602 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 10400 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 35574009 bytes

Total Files Cleaned = 86.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 10062013_123345

Files\Folders moved on Reboot...
C:\Users\Phillippians 3-14\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Phillippians 3-14\AppData\Local\Temp\MMDUtl.log moved successfully.
C:\Users\Phillippians 3-14\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\LMutilps32.log scheduled to be moved on reboot.
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

pgmigg

October 6, 2013, 6:16 PM UTC

Hello stillpressingtoward,

I downloaded and installed Java, but I can not see how to do the "optional" steps you suggested - and i want to do them.

OK. Please try to run another set of steps and if something will be wrong agian let me know exactly what it was.

OPTIONAL:
To prevent some unnecessary JAVA components from running when you boot your computer each time...

Go to Control Panel and click on the JAVA icon.
Now press the Advanced tab and go down in menu until you see the "Miscellaneous" options which probably will be the last one.
UNCHECK "Java Quick Starter".
Press Apply and OK. Then close the Java Control Panel. Close and exit Control Panel.