VIRUS- NOT BEING IDENTIFIED BY AVAST.

Viruses and worms
1

Can anyone help with a virus problem i am having? I’ve scanned with avast, but it hasn’t picked up on any infection. When i click links on the internet (google), i am re-directed to

hxxp ://mysearchcorp.com/se.php?aid=YmxhY2tvdXQA9D8&ver=&qk=weaver%20santaniello%20&rn0.8297890378276306=0.6635562510349128&or=http%3A//www.google.com.au/url%3Fsa%3Dt%26source%3Dweb%26cd%3D4%26ved%3D0CCgQFjAD%26url%3Dhttp%253A%252F%252Fmj.oxfordjournals.org%252Fcgi%252Freprint%252F17%252F1%252F97.pdf%26ei%3D-bMpTJDlF42gkQW0vvHxAw%26usg%3DAFQjCNEDeIVqwWEin65ct45E_7CzFFczQQ%26sig2%3DBHL3YuMWx_Iyu4fIaAXMtw

which then redirects to
hxxp://di-search.net/search.php?q=weaver+santaniello

and then redirects to another site
hxxp://www.directorslive.com/video/3887/Colin-Munroe–Artist-of-the-Week

does anyone know what’s going on or how to fix it?

2

First, please change your links to something like: hxxp
Thanks…!
asyn

Report 2010-06-29 12:03:47 (GMT 1)
Website mysearchcorp.com
Domain Hash 4774df75e6c42b02832bfc63f9488883
IP Address 93.190.139.152 [SCAN]
IP Hostname -
IP Country NL (Netherlands)
AS Number 49981
AS Name WORLDSTREAM WorldStream
Detections 3 / 19 (16 %)
Status DANGEROUS

Scanning site with: AMaDa CLEAN
Scanning site with: BrowserDefender UNRATED
Scanning site with: Finjan CLEAN
Scanning site with: Google Diagnostic CLEAN
Scanning site with: hpHosts DETECTED
Scanning site with: Malware Patrol CLEAN
Scanning site with: MalwareDomainList CLEAN
Scanning site with: McAfee SiteAdvisor CLEAN
Scanning site with: McAfee TrustedSource UNRATED
Scanning site with: MyWOT DETECTED
Scanning site with: Norton SafeWeb UNRATED
Scanning site with: ParetoLogic URL Clearing House CLEAN
Scanning site with: PhishTank CLEAN
Scanning site with: SURBL CLEAN
Scanning site with: Threat Log CLEAN
Scanning site with: TrendMicro Web Reputation DETECTED
Scanning site with: URIBL CLEAN
Scanning site with: Web Security Guard UNRATED
Scanning site with: ZeuS Tracker CLEAN

3

Run free Mbam and report back…!!
http://www.malwarebytes.org/mbam.php
asyn

4

Ran Mbam- seems to have solved the problem so far…

Malwarebytes’ Anti-Malware 1.46
www.malwarebytes.org

Database version: 4253

Windows 5.1.2600 Service Pack 3, v.3311
Internet Explorer 8.0.6001.18702

29/06/2010 9:49:22 PM
mbam-log-2010-06-29 (21-49-22).txt

Scan type: Quick scan
Objects scanned: 135131
Time elapsed: 11 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 4
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rthdbpl (Trojan.Agent) → Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Marianne\Application Data\SystemProc (Trojan.Agent) → Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions{9CE11043-9A15-4207-A565-0C94C42D590D} (Worm.Prolaco.M) → Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome (Worm.Prolaco.M) → Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content (Worm.Prolaco.M) → Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Mozilla Firefox\extensions{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest (Worm.Prolaco.M) → Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf (Worm.Prolaco.M) → Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul (Worm.Prolaco.M) → Quarantined and deleted successfully.

5

Good…!
Still, please make these links you posted unclickable, as I stated in my first reply…!!!
Thanks…!!
asyn

6

Hope that’s what you meant- thanks for your help :slight_smile:

7

Yes, that’s what I meant… :wink:
And, you’re welcome…!!
asyn