Firefox redirects google search

Viruses and worms
1

I have spent the last 3 days trying to solve this problem, scanning several times with HijackThis, AVG Internet Security 2011, Spybot Search & Destroy, and Anti-Malware bytes, to no avail. Safe mode scans offer not relief either. Redirects are becoming more frequent and exponentially more annoying. Clicking a link after a Google search will redirect to a web address that looks like an IP address with similar subject matter and will only go to the correct web page after clicking back and tying the link again, most the time I will have to do this 3 times. Any help would be much appreciated.

2

Follow this guide from our expert malware remover Essexboy
http://forum.avast.com/index.php?topic=53253.0
( post the logs here and not in the guide )

To avoid using multiple post with copy and paste you have to attach the log`s
Lower left corner: Additional Options > Attach ( Malwarebytes log / OTL log / aswMBR log ) save OTL log as ANSI

Essexboy will look at the logs when he arrive… he is usually in here around 08:00pm - 11:59pm uk time

3

File Attached.

Malwarebytes’ Anti-Malware 1.50
www.malwarebytes.org

Database version: 7624

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

8/31/2011 10:09:39 PM
mbam-log-2011-08-31 (22-09-39).txt

Scan type: Quick scan
Objects scanned: 188848
Time elapsed: 3 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Dan\AppData\Local\Temp\7FBA.tmp (Malware.Gen) → Quarantined and deleted successfully.

4

On completion of this can you check for redirects please

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL IE - HKU\S-1-5-21-3937215263-2301013407-1252608191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 FF - prefs.js..extensions.enabledItems: {7571ee2c-b4ab-4cc2-8f69-575912508e90}:1.0 FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 50505 FF - prefs.js..network.proxy.type: 0 O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKU\S-1-5-21-3937215263-2301013407-1252608191-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKU\S-1-5-21-3937215263-2301013407-1252608191-1000\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKU\S-1-5-21-3937215263-2301013407-1252608191-1000\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found. O3 - HKU\S-1-5-21-3937215263-2301013407-1252608191-1000\..\Toolbar\WebBrowser: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found. [2010/08/17 22:33:10 | 000,000,000 | ---- | C] () -- C:\Users\Dan\AppData\Local\Umolapuhidonokec.bin [2010/08/17 22:33:09 | 000,000,120 | ---- | C] () -- C:\Users\Dan\AppData\Local\Wjidoqocefuwejat.dat

:Reg
[HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-21-3937215263-2301013407-1252608191-1000\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

5

After fix scan attached

6

Are you still experiencing redirects ?

7

yes, I am still getting redirects. Its seems that they are more frequent now.

8

OK phase two

Download and Install Combofix

Download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop *

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now