malicious URLs when searching Google

Viruses and worms
1

A while back I was having problems with Google. Every time I searched something and clicked on a link, I would be redirected to spam sites. I would click back, click the link again, and it would work properly. Assuming I had some sort of virus or malware, I ran scans with both AVG and Malwarebytes, but found no solution. I downloaded Avast, which has solved the problem somewhat. Instead of getting redirected, I get a “Malicious URL Blocked” popup from Avast every time I search Google. How do I remove the source of the problem??

I have seen Adwcleaner recommended to others, but it didn’t seem to do the trick either.

Any help would be greatly appreciated! Thanks!

(logs are attached in replies below)

2

Follow this guide: http://forum.avast.com/index.php?topic=53253.0

and attach ( Do not copy/paste ) logs for AdwCleaner, malwarebytes’, OTL, and aswMBR.exe

an expert in the removal of malware will help you.

3

Here are the relevant logs…

4

And the last one…

Thanks in advance for any help!

5

Hi there was a zero access infection

We will need to remove Norton and AVG

Download to your desktop the Norton removal tool

Download to your desktop the AVG removal tool

From Control Panel > Programs and Features
Uninstall All Norton/Symantec entries
After reboot repeat for AVG

Run the Norton removal tool
Reboot
Run the AVG removal tool
Reboot

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
FF - prefs.js..extensions.enabledAddons: {cd74118c-bd8a-11e2-8275-b8ac6f996f26}:3.0.1
[2013/05/15 11:15:13 | 000,003,989 | ---- | M] () (No name found) -- C:\Users\Sam\AppData\Roaming\Mozilla\Firefox\Profiles\i079haba.default\extensions\{cd74118c-bd8a-11e2-8275-b8ac6f996f26}.xpi
O4 - HKCU..\Run: [wepts] "C:\Windows\System32\rundll32.exe" "C:\Users\Sam\AppData\Roaming\wepts.dll",read_init_2 File not found

:Reg
[-HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

6

Thank you Essexboy! That seems to have worked. Here is the OTL log from the quick scan.

7

How is the computer now ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
O2:64bit: - BHO: (Symantec VIP Access Add-On) - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Symantec VIP Access Add-On) - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation)

:Files
C:\Program Files (x86)\Symantec
C:\Program Files (x86)\McAfee Security Scan

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

8

It’s good. The first fix solved my problem. Do I need the additional fix? What does it do?

9

The additional fix is just to remove the last bits of Norton and McAfee no need to run it if you are happy

10

Got it. Thanks!!

11

Run OTL and press the cleanup button to remove it and associated folders

12

I ran the second fix, and everything seems great. Thanks for all of your help!

13

Keep safe :slight_smile: