[BlackOxide]

Very strange. What I need you to do is to see if the red links appear when using a different browser like Firefox or Chrome. If you could install one of these, then check for me please. At least this will then tell us whether we are looking at solely an Internet Explorer problem or not.


With your laptop, we'll look at that once things are sorted on this one

[Advertisements]

I actually had google chrome but dont use it--checked and they are red there as well
i am busy most of the day today-may tonight i will try firefox if you think that will make a difference
It is just strange to me b/c I always thought the red link meant danger but I cant find anything about it

[lmd46]

I actually had google chrome but dont use it--checked and they are red there as well
i am busy most of the day today-may tonight i will try firefox if you think that will make a difference
It is just strange to me b/c I always thought the red link meant danger but I cant find anything about it

[BlackOxide]

Yep, I'm struggling to find much on it as well. Will have a more thorough look tomorrow as I am out most of this evening. In the meantime, can you run a scan with ESET Online for me please. I wouldn't mind seeing if ESET detects anything that shouldn't be on your machine. My suspicions are that this red links issue is not malware related though.



Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

• Tick the box next to YES, I accept the Terms of Use
• Click Start
• When asked, allow the ActiveX control to install
• Click Start
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
• Click Scan (This scan can take several hours, so please be patient)
• Once the scan is completed, you may close the window
• Use Notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt
• If you are running a 64bit version of Windows, the log should be found at C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt
• Copy and paste that log as a reply to this topic

[lmd46]

the scan came back clear but I cant find the log-It is very late-I will look in the morning

[lmd46]

here it is
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK

is this all?

[BlackOxide]

Yep, as there was nothing found, this is normal. It does appear that the malware has now gone. I think these red links are unrelated to be honest with you. Can you try logging out of Google to see if this makes the red links disappear, as in the screenshot you originally posted, you are logged into Google. You should be able to logout by clicking the little arrow next to your email address at the top right, then choose sign out.

If this still hasn't made a difference, can you get back to me with the answers to the questions below and I'll run it past other members of staff here, to see if they know why it's doing this.

• Do the red links appear on other search engines, such as Bing.com, Yahoo.com etc
• Roughly how many different links have you come across that are red (American Idol being one etc)
• How long have you noticed these red links, were they apparent before the malware got on.

[lmd46]

the links are still there when I sign out of google

no red links with yahoo or bing--seems to be google related

more than half are red

dont remember when it started-I think it was the same time but I really dont remember

[BlackOxide]

Thanks for the info. I'll see if any other staff members can shed any light as to why it might be doing this. I'll be in touch shortly when I have any info or things for you to try

[lmd46]

thanks for all the help

[BlackOxide]

No problem I've had word with other members here and it does appear as though this is not going to be malware related and is more than likely just a bit of a 'glitch'. It could be very tough in finding out what is making it do this, but I have been given one thing to quickly try to see if it makes a difference or not. Give this a try, and I've also put my cleanup steps below, as the malware looks to be gone, you can now safely remove the tools we have used and have a read of some tips on updating and staying safe. Let me know if you have any joy with this.



In Control Panel > Display > Adjust Clear Type text, is the box Turn on ClearType checked?

If not, see if checking it works.

Note: to see the control panel like that in Windows 7 you will probably have to change to "View by Large icons" top right in Control Panel.




Good stuff, your logs now appear clean

Please go through the Cleanup section below and have a read of the other information which will help keep your PC protected


Thank you for following the procedures, your system now appears free from Malware. Below is a list of steps that are well worth following, they help finalize the fixes we have been doing and will help minimize the risk of a smilar situation happening again by protecting your PC and helping secure it.

Please make sure you follow the Cleanup stage just below.


========== CLEANUP ==========

Remove the Tools used in this cleanup

1)
Tools on the Desktop:
You can now safely remove aswMBR from the Desktop (if present)

2)
Remove ComboFix

• Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
• In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK
  
• Follow the prompts on the screen
• A message should appear confirming that ComboFix was uninstalled

3)
Clear Old Restore Points

• Run OTL, copy and paste the following into the Custom Scans/Fixes area at the bottom
  

  :Commands
  [CLEARALLRESTOREPOINTS]

• Then Click Run Fix

4)
OTL Cleanup

• Open OTL
• Click the CleanUp button at the top, it will ask to reboot your PC, please allow it to do so

5)
We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

========== Anti Malware Protection ==========

MalwareBytes Anti-Malware
This is an excellent Anti-Malware product. It is recommended to periodically run a Quick Scan to keep your PC as clean as possible. Remember to check for updates before running a scan, so click the Update tab along the top, then click Check for Updates.

Spyware Blaster
Spyware Blaster is a useful program that creates a huge list of known suspect/dangerous sites and blocks any attempts to visit those sites by embedding the list into Internet Explorer and Firefox.

Free Anti Virus Protection...
If you haven't got an AntiVirus or are thinking of changing, my personal recommendations are Microsoft Security Essentials and Avast, both are free to use. Remember though, you can only have one Anti Virus installed at any one given time.

Paid Anti Virus Protection...
If you want a bit more than just an Anti Virus and would like extra features such as Firewall and Anti Spam, you will have to look at purchasing an Anti Virus product. A lot of people do use free AV software as these products use the same virus databases as the paid ones, but some people prefer to have the extra features and the help and support that the paid products tend to offer. If you are looking into purchasing one, my recommendations would be Kaspersky Internet Security or ESET Smart Security. There are however many different ones out there and it is wise to just download trial versions to see which ones suit you best, before actually buying.



========== Updates ==========

Keeping your PC updated is vital in the battle against infections and exploits. There are many infections which will exploit loopholes within Windows itself, Java and Adobe Reader. Keeping these updated is a very good habit to get into.

Automatic Updates

Updates to your Operating System are vital in closing loopholes and fixing bugs which some infections exploit.
To keep your Windows updated, ensure that 'Automatic Updates' is enabled on your PC so updates are downloaded and installed automatically. Click on your version of Windows below to find out how...
Windows XP
Windows Vista
Windows 7

Java updates

• Click the Start button
• Click Control Panel
• Double Click Java
• Click the Update tab
• Click Update Now
• Allow any updates to be downloaded and installed

Adobe Reader updates

• Open Adobe Reader
• Click Help on the menu at the top
• Click Check for Updates
• Allow any updates to be downloaded and installed

========== Alternate Browsers ==========

Using an alternative web browser can help protect your PC from infections which exploit security holes within Internet Explorer. They can also be quicker to load pages and offer more tools and features such as Firefox's huge addon list.

Firefox - My personal choice, easy to use and has a large number of excellent addons that can be installed to help keep you away from malicious sites and reduce advertisements and popups etc. AdBlockPlus and WOT are very useful addons that are well worth having installed.

Google Chrome - Very nippy browser that's easy to use and is well worth a go if you are trying out different browsers.


Have fun and stay safe online
BlackOxide

[lmd46]

Error: Unable to interpret <:Commands[CLEARALLRESTOREPOINTS]> in the current context!

OTL by OldTimer - Version 3.2.22.3 log created on 05182011_155051

[BlackOxide]

This error usually happens when the code is on one line such as...

:Commands[CLEARALLRESTOREPOINTS]

Just double check it reads like this in the OTL window....

:Commands
[CLEARALLRESTOREPOINTS]

and it should go through fine then.

[lmd46]

ok-now not finding the steps fpr step 5---nothing called my computer that opens into tools--if I click Computer-it opens into disk drives and devices

[BlackOxide]

Ok, try this method, this should hopefully work for you:

• Click the Start Button
• Click Computer
• Hold down the Alt key, then whilst still holding it, press T on your keyboard
• On the Tools drop down menu which has now appeared, click Folder Options
• Click the View tab
• Select Do not show hidden files and folders
• Click OK

[lmd46]

clear type was checked as was dont show show hdden folders

thanks for the help!!

is there a free firewall available?

If I can get my other laptop to turn on tomorrow I will log on and try to contact you

you guys are great!!! I will def recommend your help!

Donna