I think I have a redirect issue

[kingsburyGID]

I do not have McAfee installed, just scattered remnants which the above-mentioned remover didn't remove. I could not find a way to shutdown the TrendMicro, tried to see if it would see the issue (I hadn't known it was on the machine til this process started) but it did not. So I ran Combofix, still have the redirect, so I am not sure if TM hindered the operation of your tool. If it did, I will find out how to kill off that process if needed. Attached are logs.

[essexboy]

Again nothing untoward there - lets see if the new kid is around

Do the following:
Start -> Run
type diskmgmt.msc
Click "OK"
 
Disk Management will open.
 
Click and hold the right side of the Disk Management Window and drag it to the right until you can see all the columns.
 
Take a screen Shot of the Disk Management Window and attach the screen shot to your reply.

[kingsburyGID]

trying again screenshot

[essexboy]

Question time 

Where do you get redirected to ?
Is it a specific site ?

[kingsburyGID]

I see a few that repeat. Tazinga is the most common, but also: eZanga, monstermarketplace.com, amusementgeneral.com, and there may be others.

Eric

[essexboy]

OK I have revisited the logs and one oddball that CF did not get needs removing

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  [2011/11/18 08:50:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\zenuchsbvirmcx
  
  :Files
  ipconfig /flushdns /c
  C:\Documents and Settings\User\Local Settings\Temp\31qGM.exe
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[kingsburyGID]

Ok, I did that. Here's the log:

[essexboy]

Still getting the redirects and are they still restricted to Firefox

[kingsburyGID]

Yes, I still have the redirects. It is not, as I first thought, limited to Firefox, however it does seem worse with it. I have noticed that when it is going to redirect I see the google results I see links to www.google.co.uk and there is an option to block all results from that domain.

Eric

[essexboy]

Bear with me and I will have a look around to see what I can discover

[essexboy]

Hmm I may have found something

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  O1 - Hosts: 127.0.0.1       localhost
  O1 - Hosts: ::1             localhost
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[kingsburyGID]

Ok, ran that one, here's the log. It may be a couple days til I see and respond to your next message, assuming we don't have it all cleared out (Just checked firefox, still redirecting).

[essexboy]

OK I will need to see what I can find out about these sitees... Does it only happen from google ? Could you try a Bing dsearch and see if you get the same result

[kingsburyGID]

Sorry for the delay, had a couple days off. Yes it does the redirect with bing as well, with IE as well as Firefox.

Eric

[essexboy]

Could you download and run an updated copy of aswMBR please

Download aswMBR.exe ( 1.8mb ) to your desktop.
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan 



On completion of the scan click save log, save it to your desktop and post in your next reply



THEN

Download the latest version of TDSSKiller from here and save it to your Desktop.
 
 

• Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
   
  
   
  
• Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
   
  
   
  
• Click the Start Scan button.
   
  
   
  
• If a suspicious object is detected, the default action will be Skip, click on Continue.
   
  
   
  
• If malicious objects are found, they will show in the Scan results and offer three (3) options.
• Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
   
  
   
  
• Note: If [color="#0000FF"]Cure is not available, please choose Skip instead, do not choose Delete unless instructed.[/b][/color]
  

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.