Keep getting redirects

Viruses and worms
21

Hm … ok

Re-run OTL.exe.

[*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.



:OTL
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-73586283-261903793-725345543-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-73586283-261903793-725345543-1005\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
FF - prefs.js..extensions.enabledAddons: {02FB5EBB-E197-11E1-8270-B8AC6F996F26}:2.0.14
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{02FB5EBB-E197-11E1-8270-B8AC6F996F26}: C:\Documents and Settings\Charlie\Local Settings\Application Data\{02FB5EBB-E197-11E1-8270-B8AC6F996F26}\ [2012/08/08 16:24:20 | 000,000,000 | ---D | M]
[2012/08/08 16:24:20 | 000,000,000 | ---D | M] (Mozilla Safe Browsing) -- C:\DOCUMENTS AND SETTINGS\CHARLIE\LOCAL SETTINGS\APPLICATION DATA\{02FB5EBB-E197-11E1-8270-B8AC6F996F26}

:files
ipconfig /flushdns /c

:commands
[emptytemp]

[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.

Re-run OTL , click on QuickScan and attach here fresh OTL.txt log

22

Ok. Here are the logs

23

Ok, do you still have avast pop-ups?

And if you do, in which Browsers?

24

So far so good. :smiley:
I will keep an eye on it. Any other directions?

Thanks for your patience and help. You guys are the best.

Charlie

25

Nice. Monitor your system, how is works, any pop-ups and let me know tomorrow.

Used tools can be deleted. Keep OTL by tomorrow.

It is necessary to uninstall ComboFix :

[*] Click Start (or
http://amf.mycity.rs/pg/images/VistaStartButton.png
) then Run.

On Windows7 or Vista you may use Start Search field if Run is not available.

[*] In the line of text type in (Copy) the following:

ComboFix /Uninstall

Note that there is a space between " ComboFix " and " /Uninstall " .

[*] then click OK (or press Enter ).

Wait for the uninstall process is complete.

26

Everything seems fine, no redirects so far. What closing steps should I follow?

Thanks again for all your help,

Charlie

27

Hi,Charlie. I’m glad I could help. :wink:

Re-run OTL and click on CleanUp! button.

You will be asked to reboot the machine to finish the cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTL. Feel free to manually delete any tools it leaves behind.