Malicious URL, Logs Attached

Viruses and worms
1

I followed the instructions on this page, http://forum.avast.com/index.php?topic=53253.0 and got just one log (not two like the post said) and here it is. I am in the process of running the second scan and will attach it when its finished.

2

Second scan attached

3

OTL only create the extra log first time it is run…have you run it before?
anyway the extra log is not important

also attach AdwCleaner and Malwarebytes log

malware removers are notified. it may take hours before one arrive, so be patient

4

Hi let me know if this stops it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&q={searchTerms}
IE - HKU\S-1-5-21-1819889651-3178588521-3356282684-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.jzip.com/
IE - HKU\S-1-5-21-1819889651-3178588521-3356282684-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&q={searchTerms}
FF - prefs.js..browser.startup.homepage: "http://search.jzip.com/"
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=0&systemid=102&q="
[2012/09/17 15:02:48 | 000,000,000 | ---D | M] ("Codec-V") -- C:\Users\Pat\AppData\Roaming\Mozilla\Firefox\Profiles\ons9jy9i.default\extensions\crossriderapp435@crossrider.com
O2:64bit: - BHO: (UrlHelper Class) - {41C4AA37-1DDD-4345-B8DC-734E4B38414D} - C:\Program Files (x86)\Windows jZip Toolbar\Datamngr\x64\IEBHO.dll (Discordia, LTD)
O2 - BHO: (jZip Toolbar) - {1e48c56f-08cd-43aa-a6ef-c1ec891551ab} - C:\Program Files (x86)\Windows jZip Toolbar\Datamngr\ToolBar\jzipdtx.dll ()
O2 - BHO: (UrlHelper Class) - {41C4AA37-1DDD-4345-B8DC-734E4B38414D} - C:\Program Files (x86)\Windows jZip Toolbar\Datamngr\IEBHO.dll (Discordia, LTD)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (jZip Toolbar) - {1e48c56f-08cd-43aa-a6ef-c1ec891551ab} - C:\Program Files (x86)\Windows jZip Toolbar\Datamngr\ToolBar\jzipdtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1819889651-3178588521-3356282684-1000\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files (x86)\Windows jZip Toolbar\Datamngr\datamngrUI.exe (Discordia, LTD)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WI83E4~1\Datamngr\x64\datamngr.dll) - C:\Program Files (x86)\Windows jZip Toolbar\Datamngr\x64\datamngr.dll (Discordia, LTD)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WI83E4~1\Datamngr\x64\IEBHO.dll) - C:\Program Files (x86)\Windows jZip Toolbar\Datamngr\x64\IEBHO.dll (Discordia, LTD)
O20 - AppInit_DLLs: (C:\PROGRA~2\WI83E4~1\Datamngr\datamngr.dll) - C:\Program Files (x86)\Windows jZip Toolbar\Datamngr\datamngr.dll (Discordia, LTD)
O20 - AppInit_DLLs: (C:\PROGRA~2\WI83E4~1\Datamngr\IEBHO.dll) - C:\Program Files (x86)\Windows jZip Toolbar\Datamngr\IEBHO.dll (Discordia, LTD)

:Files
C:\Program Files (x86)\Windows jZip Toolbar
C:\Users\Pat\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.