# Why are my Google searches redirected?

This machine was infected with various malware. I have scanned the system with Malwarebytes. It found and removed some 600 or so infected files.

Now the machine seems to be running well with only one exception.

Some Google search results are being redirected to some shady search engines.

If I were to copy the URL from the Google Search results and paste it in the address bar it would go to the correct site, but if I click the link, I will be redirected somewhere else.

Here is my log file from HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:55:16 AM, on 7/14/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T3418
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O2 - BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINDOWS\system32\oobe\msoobe.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {6E704581-CCAE-46D2-9C64-20D724B3624E} (UnagiAx Class) - http://radaol-prod-web-rr.streamops.aol.com/mediaplugin/3.0.84.2/win32/unagi3.0.84.2.cab
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

-
This is probably just your proxy settings in IE they will stay there even after removing the virus. –  Kyle Jan 17 '11 at 20:46
I had this for a long time, and I finally fixed it. It's not a virus, it has to do with DNS servers. You just have to start using a public DNS like OpenDNS or Google DNS. –  ixtmixilix Jan 31 '11 at 12:59

Disable these under safe mode:

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINDOWS\system32\oobe\msoobe.exe


And use CWShredder as you might be infected with CoolWebSearch.

Reboot and post a new HijackThis log in your post, also do this so I can do a more detailed view:

1. Download AutoRuns, run it and accept the EULA, let it scan.
2. When the scanning is done, go to File and then Save it as a .arn file.

For virus scanning purposes, check Mouche's post... I'm more the 'manual cleaning' type.
I hate resource consuming virus scanners that take their time... :-D

Regarding CT his comment...

In Safe Mode, run Autoruns as an administrator and untick the following items,
Look in the first column for the name before the ; symbol and in the last column for the path after the ;:

0; File not found: About:Home


Please note that Defense Center is a fake rogue antivirus which should be removed!

When you have removed these four entries, reboot and tell me if you still have the problem.
It is wise to update and scan with your virus scanner to remove any files left.

-
How do I disable them as stated in your first statement? Use 'Fix' within HijackThis? –  CT. Jul 14 '10 at 16:49
Select them and then indeed click 'Fix'. –  Tom Wijsman Jul 14 '10 at 16:54
dl.dropbox.com/u/694102/hijackthislog.txt dl.dropbox.com/u/694102/AutoRunsLog.arn Appreciate your assistance. –  CT. Jul 14 '10 at 17:16
HijackThis seem clean, be sure to install a anti-virus and firewall to stay protected. Regarding AutoRuns, check my updated post in a moment... I see some things. –  Tom Wijsman Jul 14 '10 at 17:54

There is no other explanation : Your machine is still infected.

It is unlikely after such a massive infection as you describe, that any AV product will completely clean up everything. There is no other safe solution than to restart from a clean slate.

My advice is to save your data, reformat the hard disk, and reinstall Windows (or restore the computer to factory image, as the case may be).

-
Massive infections can be cured just by removing all possible ways to start the malware and then removing any infected files during Safe Mode, if you want to take it to the next level you still have AutoRuns for checking the low-level stuff and other performance analysis tools like XPerf, XBootMgr, Process Monitor, ... Reinstalling your Windows is a solution that tends to werk, but it's not a solution to spend a lot of time reinstalling everything every time you are infected. –  Tom Wijsman Jul 14 '10 at 16:34
@TomWij: Getting infected shouldn't happen very frequently ... And to succeed he would need such a high level of knowledge that excludes him asking his question in the first place. –  harrymc Jul 14 '10 at 16:43
@TomWij: You have the knowledge to answer questions in superuser.com and to avoid infection. Not everybody does. –  harrymc Jul 14 '10 at 16:49
Yes, indeed, but for some people it does and for those people it isn't helpful to keep reinstalling their system, he has 600 infections so he tends to be such guy... Reinstalling is always an easy fix, but you better learn to prevent viruses and how to get rid of them. –  Tom Wijsman Jul 14 '10 at 16:55
I took "Getting infected shouldn't happen very frequently" a bit personal but it wasn't about me, that's why I typed the first part of my answer after the second, adjusted my answer to the right context of your response to avoid confusion... –  Tom Wijsman Jul 14 '10 at 16:55
show 1 more comment

I agree that it would be best to do a clean install after a backup, but you have some options.

First, reboot into safe mode with networking.

Next, run ESET Online Scanner, an excellent, free scanner that is a scan/remove-only version of ESET NOD32. I've had great success with this product. This will scan for viruses along with other malware in its definitions.

Next, run Spybot Search & Destroy to clean up remaining spyware and malware.

Finally, reboot into normal mode and look through Add/Remove Programs to get rid of anything that looks suspect. Typically, they will have already been removed, and you're just getting them out of the list ("Adhelper" for example).

I've had great success with this method. I usually do some clean up using Disk Cleanup or CCleaner afterwards. I've never had anything escape me through this process, but I don't deal with viruses or malware very frequently.

-