Experiencing a Google Redirect Virus, Would Appreciate Help Solving (Ran Malwarebytes, Clean GMER scan, OTL txt included)

[bennig3]

Ok,

Here's what ESET found and deleted on the scan:

C:\Users\Ben\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\630H2099\evwdlf[1].htm Win32/Agent.QNF trojan cleaned by deleting - quarantined

C:\Users\Ben\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\630H2099\oytnvg[1].htm a variant of Win32/Kryptik.GCY trojan cleaned by deleting - quarantined

C:\Users\Ben\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\630H2099\qghoquc[1].htm Win32/Adware.SpywareProtect2009 application cleaned by deleting - quarantined

C:\Users\Ben\AppData\Local\Temp\ybklmw.exe Win32/Agent.QNF trojan cleaned by deleting - quarantined

C:\Users\Ben\AppData\Local\Temp\NERO1002529\unit_app_75\Toolbar.exe Win32/Toolbar.AskSBar application cleaned by deleting - quarantined

C:\Users\Ben\AppData\Local\Windows Server\hlp.dat Win32/Bamital.DT trojan cleaned by deleting - quarantined

C:\Users\Ben\Documents\Nero 9\Nero.9.0.9.4.Ultra.Edition.WinALL.Cracked.by.TAMer\Patch\Patch.exe probably a variant of Win32/Agent.EUXWFOV trojan cleaned by deleting - quarantined

C:\Users\Ben\Documents\Nero 9\Nero.9.0.9.4.Ultra.Edition.WinALL.Cracked.by.TAMer\Setup\Nero-9.0.9.4.exe Win32/Toolbar.AskSBar application deleted - quarantined

[bennig3]

I just searched Google for "resort" clicked the top link to Hyatt, and here's what I got:

http://shopcompareus.com/ac/search.php?phr...6f&src=miva

Still getting hijacked!

[LDTate]

C:\Users\Ben\Documents\Nero 9\Nero.9.0.9.4.Ultra.Edition.WinALL.Cracked.by.TAMer\Patch\Patch.exe probably a variant of Win32/Agent.EUXWFOV trojan cleaned by deleting - quarantined

C:\Users\Ben\Documents\Nero 9\Nero.9.0.9.4.Ultra.Edition.WinALL.Cracked.by.TAMer\Setup\Nero-9.0.9.4.exe Win32/Toolbar.AskSBar application deleted - quarantined

Mind telling me where those came from?

I do not help anyone with stolen / illegal software.

[bennig3]

I noticed those as well and deleted them. I think they were from a friend of mine who was using this computer. I checked and they were never actually installed, it was just the downloaded files.

[LDTate]

Lets see if it's an Add-On

IE Add-ons

http://support.microsoft.com/kb/956196

You can open Internet Explorer without add-ons in 2 ways. One way to open is to navigate to start menu-> All Programs-> Accessories-> System Tools-> Internet Explorer (no Add-ons). This opens up IE without ActiveX controls and browser extensions.

[bennig3]

I should probably note that I never use IE to browse, I always use Mozilla. I haven't experienced a redirect in IE b/c I never use it.

Could it be possible that it is an add on in Firefox? Thinking we should probably try to address problems within Firefox as that is my browser.

Open to any thoughts, thanks again for all of your help so far!

[LDTate]

http://www.watchingthenet.com/firefox-tip-...ng-add-ons.html

Firefox Tip: Save Memory Usage By Disabling Add Ons

[bennig3]

Ok I've pretty much removed all of my Firefox Add Ons.

Still getting redirected, this virus is tricky to catch.

Any more ideas?

[LDTate]

IF you connect via a router

do this:

Let

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!