When I use Firefox and then google as a search engine, I have been getting redirects. I had run MBAM which found a problem, and then installed Avast, which in it’s boot scan found and fixed problems, but the redirect remains. Neither MBAM nor Avast find anything now. I had not taken any notes on just what they found originally, but from my memory it had to do with Java, and one piece of advice I read said it needed updated, so I uninstalled, and then installed the latest version. This issue does not seem to happen when I use IE/google. I have run the OTL and aswMBR scans, but don’t know what to make of it.
My OTL log exceeds the 10,000 character limit, is there a more important part I should post?
here is the aswMBR:
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-12-06 10:06:49
10:06:49.843 OS Version: Windows 5.1.2600 Service Pack 3
10:06:49.843 Number of processors: 2 586 0x401
10:06:49.843 ComputerName: RECEPTION UserName: User
10:06:51.031 Initialize success
10:06:51.515 AVAST engine defs: 11120602
10:07:26.203 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\Ide\IdeDeviceP2T0L0-17
10:07:26.203 Disk 0 Vendor: ST380817AS 3.42 Size: 76319MB BusType: 3
10:07:28.218 Disk 0 MBR read successfully
10:07:28.218 Disk 0 MBR scan
10:07:28.218 Disk 0 Windows XP default MBR code
10:07:28.218 Disk 0 scanning sectors +156280320
10:07:28.281 Disk 0 scanning C:\WINDOWS\system32\drivers
10:07:45.187 Service scanning
10:07:46.312 Service ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys LOCKED 32
10:07:46.390 Service FXDRV D:\Fxdrv.sys LOCKED 21
10:07:47.484 Modules scanning
10:07:52.937 Disk 0 trace - called modules:
10:07:52.953 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys >>UNKNOWN [0x8a5e5209]<<
10:07:52.953 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0x8a9b2ab8]
10:07:52.953 3 CLASSPNP.SYS[f7647fd7] → nt!IofCallDriver → \Device\00000081[0x8a9cb750]
10:07:52.953 5 ACPI.sys[f75ae620] → nt!IofCallDriver → \Device\Ide\IdeDeviceP2T0L0-17[0x8a9b6d98]
10:07:53.234 AVAST engine scan C:\WINDOWS
10:08:21.578 AVAST engine scan C:\WINDOWS\system32
10:10:32.031 AVAST engine scan C:\WINDOWS\system32\drivers
10:10:48.968 AVAST engine scan C:\Documents and Settings\User
10:22:15.140 AVAST engine scan C:\Documents and Settings\All Users
10:23:40.656 Scan finished successfully
13:49:22.031 Disk 0 MBR has been saved successfully to “C:\Documents and Settings\User\Desktop\MBR.dat”
13:49:22.046 The log file has been saved successfully to “C:\Documents and Settings\User\Desktop\aswMBR.txt”
[*]Ensure all Firefox windows are closed.
[*]To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
[*]When prompted to run the scan, click Yes.
[*]GooredFix will check for infections, and then a log will appear.
Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).
Pondus, there is a Trend Micro client/server security program on the machine, however it does not show running like Avast does (I did not install it, so I canmnot speak to just what it is for) however, if I start it, it seems to be something akin to MBAM in that it has scan options for various things. It was on this machine when the infection occured, which is another reason I don’t think it’s an active AV program.
Did the company you work for require you to install Trend Micro so that you can remotely connect to your company’s servers? If so, do not remove that software or you might find yourself out of a job
McAfee was installed before, and yes it is a company machine, but it doesn’t directly access our servers. It was used to set up the router for a small branch network where another machine can access the servers. If I need to, I can certainly remove Avast, and clean out the remains from McAfee. I do understand the multiple AV issue. I still have this redirect that nothing seems to find, and I was mistaken that it only affected Firefox, as IE has started doing it as well.
Hmm lets get the big boy on the job to check out the locked file reported by aswMBR
Download and Install Combofix
Download ComboFix from one of the following locations: Link 1 Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
I do not have McAfee installed, just scattered remnants which the above-mentioned remover didn’t remove. I could not find a way to shutdown the TrendMicro, tried to see if it would see the issue (I hadn’t known it was on the machine til this process started) but it did not. So I ran Combofix, still have the redirect, so I am not sure if TM hindered the operation of your tool. If it did, I will find out how to kill off that process if needed. Attached are logs.
