I got a couple of things happening. I’m getting a system error balloon in the bottom corner then IE opens with fake window error messages. After I close those out and use Goggle and I click on a search item, it redirects to non related crap. It first shows an IP address then search-daily.com then advertisement.
Norton comes up with a “downloader.misleadAAP” virus. I delete the thing and do a full scan and it doesn’t show but it keeps returning. Also ran spysweeper, and nothing. I’ve checked processes running, startip items, services and I can’t find nothing.
Disable System Restore and reenable it after step 3.
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on.
Use SUPERantispyware and/or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
Sounds like a wareout infection, if you could post a hijackthis log to confirm I will clear it for you
Download & Run HijackThis.exe
[*]Download HJTInstall.exe to your Desktop.
[*]Doubleclick HJTInstall.exe to install it.
[*]By default it will install to C:\Program Files\Trend Micro\HijackThis .
[*]Click on Install.
[*]It will create a HijackThis icon on the desktop.
[*]Once installed, it will launch Hijackthis.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Copy/Paste the log to your next reply please.
Don’t use the Analyse This button, its findings are dangerous if misinterpreted. Don’t have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
Logfile of HijackThis v1.99.1
Scan saved at 6:42:57 PM, on 1/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
One snag you may get caught on is the fact that it may embed .dll files into your Windows login files, and listed antispyware may not fix the problem. Manually deleting these files may be the only way to fix this problem, as most anti-spyware programs do not run before login.
This is a particularly nasty bug. It’s apparently a mimic, as I see many people posting here and other forums with similar events, but many different names for the bug.
From my own experience, this bug is attaching itself to IE, as an BHO, or Browser Helper Object. I have tried many, (10-12 at least) different combinations of spy detection/virus detection programs to relieve this problem, including all those mentioned here on this forum. As these programs can identify the problem, none as of yet can fix it. I cannot change the attributes of the file thru any cmd processes, and the file continues to tell me that access is denied. (Even thru a DOS CMD) What they did fix however, was the registry changes this bug makes and they partially disable it successfully. (Control Panel restoration, and the nasty camouflaged buttons that look like actual windows alert scareens and redirect your click to another virus laden website.)
As far as the pop up message in your start bar, and the redirect of your browser clicks is concerned, I have found a work around, however it requires some diligence on your part to make it go away.
At the top of your IE window, are several standard window choices, or pull down menus. Choose Tools>Manage add ons. Allow a few seconds for the window to populate with the add ons currently loaded in IE at which time you should identify the unremovable add on and disable it with a click. My monster was named crypt3.dll.
Restart your browser and you will no longer be redirected, or receive those nasty balloons. The next time you start your computer, first thing to do is check the Tools> manage add ons options again, to assure that your add on has not returned.