Google search results problem

imdaman972 · Jun 15, 2009

When I try and do a google search, all the results that I click on bring me to a website with abunch of pop up ads. I completed the malware removal guide, I had 2 problems with the guide. One, when i run combofix after i agree with the disclaimer, i get an error: "route.exe - Application Error, The application failed to initialize properly (0xc0000142). Click on OK to terminate the application" I clicked Ok, then it popped up again. CLicked Ok again and then combofix started running. I decided not to run it until I told you guys about this error, and got feedback. My 2nd problem was with MBAM, everytime i tried to run it, it froze when scanning "C:\Program Files\podmena" Attached is everything else that ran successfully. Thanks in advance

chaslang · Jun 18, 2009

Welcome to Major Geeks!

Why are you running this PC with no antivirus and no real true firewall?

Is the copy of Spyware Doctor you are using a licensed copy or just a free trial? If free trial, uninstall it.

What is the below that you have installed?
-=CASH=- SOF Minimizer

Do you know what the below folder is for? If not then delete it
C:\Program Files\podmena

Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,

After clicking Fix, exit HJT.

Now download The Avenger by Swandog46, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.

Do not change any check box options!!

Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\WINDOWS\system32\sdra64.exe
C:\816129230
C:\ddxkfhqb.exe
C:\pcwr.exe
C:\x345.bat
C:\WINDOWS\bf23567.dat
C:\WINDOWS\zaponce53290.dat
C:\WINDOWS\zaponce53198.dat
C:\WINDOWS\zaponce53222.dat
C:\WINDOWS\system32\CF1554.exe
C:\WINDOWS\system32\CF255.exe
C:\WINDOWS\system32\CF31674.exe
C:\WINDOWS\system32\crash
C:\WINDOWS\Temp\4157527310.exe
C:\WINDOWS\Temp\jisfije9fjoiee.tmp
C:\WINDOWS\Temp\setup.exe
C:\WINDOWS\Temp\sfj938wjkdmf8w793g.tmp
C:\WINDOWS\Temp\win.exe
C:\Documents and Settings\Ken\Local Settings\Temp\107272948.exe
C:\Documents and Settings\Ken\Local Settings\Temp\134929198.exe
C:\Documents and Settings\Ken\Local Settings\Temp\3188319476.exe
C:\Documents and Settings\Ken\Local Settings\Temp\3223319476.exe
C:\Documents and Settings\Ken\Local Settings\Temp\3693530240.exe
C:\Documents and Settings\Ken\Local Settings\Temp\8k614.tmp
C:\Documents and Settings\Ken\Local Settings\Temp\c.exe
C:\Documents and Settings\Ken\Local Settings\Temp\d.exe
C:\Documents and Settings\Ken\Local Settings\Temp\e.exe
C:\Documents and Settings\Ken\Local Settings\Temp\g.exe
C:\Documents and Settings\Ken\Local Settings\Temp\h.exe
C:\Documents and Settings\Ken\Local Settings\Temp\set21B.tmp
C:\Documents and Settings\Ken\Local Settings\Temp\set223.tmp
C:\Documents and Settings\Ken\Local Settings\Temp\setup.exe
C:\Documents and Settings\Ken\Local Settings\Temp\sfj938wjkdmf8w793g.tmp
C:\Documents and Settings\Ken\Local Settings\Temp\svchost.exe
C:\Documents and Settings\Ken\Local Settings\Temp\zjhufhdfe.exe

Folders to delete:
C:\WINDOWS\system32\lowsec
Click to expand...

Now click the Execute button.

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\TEMP
C:\Documents and Settings\Ken\Local Settings\Temp

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Then attach the below logs:

C:\avenger.txt

C:\MGlogs.zip

Make sure you tell me how things are working now!

See if you can run Malwarebytes now. If you can then attach the log from it.

Log in or Sign up

Google search results problem

imdaman972 Private E-2

Attached Files:

SASlog.txt

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member