Hijackthis log review and verification

My wife was having problems with her PC today, saying it was running very slowly. She noticed in google image search that the images were taking forever to come up and wondered if our cable internet was being throttled back. She checked a couple of speedmeters (2wire.com, etc.) and we are actually at a higher speed than normal.

She tried rebooting and got some error messages, eventually leading to this forum.

The main problem she is experiencing is that clicking on any Google results link leads to her be redirected to http://www.couponmountain.com/ and http://www.tooseeka.com/ instead of where she expected to go. Typing in the URL directly into the address field would take her to that page, but anything requiring a log in resulted in errors of various sorts.

I found this forum, and sent her the info. She was unable to join (since it required filling in username/passwords. So I joined, downloaded the MGTools.exe file and put it on the server. I then put it on her machine and ran it. The first time I wasnt' seeing the trendmicro dialog, so ended up running it a second time.

The first file "MGlogs1.zip" was quite a bit larger than the second "MGlogs2.zip" so have included both.

Can you tell anything from these?

If so, what do we do next?

Thanks,

David

 

Just as a follow up. I had followed the Malware removal Guide. The machine is running Windows XP. I downloaded and tried to install SUPERAntiSpyware (crashes when attempting to install), Spybot Search and Destroy (could get installed, but could not get it to run), Malwarebytes Anti-Malware (was able to install, but updates to defs didn't occur and could not get the app to run), and Combofix (could not get it to run).

After that I tried the MGlogs tool and was able to get that to run and uploaded those Zip files.

In the meantime, I tried running the MS AntiSpyware app, now dubbed "Windows Defender." I was able to get that installed, however after updating the definitions, and running it (which didn't actually take that long) it said there was "No unwanted or harmful software detected" and that "Your computer is running normally" (I beg to differ).

After doing all this, I tried to do some searches and access websites. However, just as before, clicking on link within google ends up taking you to another site... in this case, I ended up at Monster.com and the Realtor.com websites instead of where I thought I would end up. However, what shows up in the history list are actually sites like "lowpriceshopper.com" and "findfebruary.com" which seem to forward you on.

My wife went so far as to uninstall and then reinstall Firefox, but it made no difference.

I did run across this site as well, but am not sure how reputable they are, so not sure whether I want to attempt using any of the programs they recommend.

http://bcheck.scanit.be/bcheck/page.php?name=HIJACKED

Any suggestions on what can be done would be greatly appreciated.

Thanks,

David