[megadez]

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\Documents and Settings\Yuriy Horokhivskyy\Local Settings\temp\etilqs_yj0GD6dTgp2IdjadJwVo not found.
C:\Documents and Settings\Yuriy Horokhivskyy\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_0005cb moved successfully.
C:\Documents and Settings\Yuriy Horokhivskyy\Local Settings\Application Data\Mozilla\Firefox\Profiles\sos6lio5.default\Cache\_CACHE_001_ moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\YURIYH~1\LOCALS~1\Temp\Perflib_Perfdata_a18.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\YURIYH~1\LOCALS~1\Temp\Perflib_Perfdata_d3c.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\YURIYH~1\LOCALS~1\Temp\~DFCBD6.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_7c4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Opera cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02272009_183221

Files moved on Reboot...
File C:\DOCUME~1\YURIYH~1\LOCALS~1\Temp\Perflib_Perfdata_a18.dat not found!
File C:\DOCUME~1\YURIYH~1\LOCALS~1\Temp\Perflib_Perfdata_d3c.dat not found!
C:\DOCUME~1\YURIYH~1\LOCALS~1\Temp\~DFCBD6.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_7c4.dat not found!

[Advertisements]

Hi megadez,

So are you still getting the redirects?

What about the crashes? Are you still getting them, and if so, are they just restricted to Firefox?

And from the last but one reply. Are you saying you have another browser...Chrome, or is that just a reference to Firefox?

[emeraldnzl]

Hi megadez,

So are you still getting the redirects?

What about the crashes? Are you still getting them, and if so, are they just restricted to Firefox?

And from the last but one reply. Are you saying you have another browser...Chrome, or is that just a reference to Firefox?

[megadez]

I used OTMovit after posting virusscan results.

You didn't understand me about redirects. So, suppose I make arbitrary google search - e.g. "apple", page with results
appears, first result apple.com.....when I hover my mouse over that first link I can see in the lower right corner
googelsearchapi-bla-bla-bla which gives me the sign that if I click on that result I'd be redirected to hotlean.com. Now, if
I don't click on that result but redo google search clicking on search button again, I get a page with exactly the same result (naturally),
apple.com being on the first place, but know clicking on first search result wouldn't lead to redirect but to apple.com as it supposed.

And I'm saying this trick always works - redoing the search to get rid of redirect

[emeraldnzl]

Oh I see. And this is still happening the same way since those OTMoveIt3 deletions?

[megadez]

redirects are still there,

I had IE firefox and opera when I first asked you for help, I installed google chrome 3-4 days ago

crashes are only in firefox

[emeraldnzl]

And no problem with Chrome?

[emeraldnzl]

Further to last post.

I am wondering about Chrome because we deleted a cache item with OTMoveIt3. At that time I hadn't realised that you had installed Chrome so believed I was removing a Firefox cache item.

Shouldn't matter as Chrome should just regenerate the file if it was essential but I just want to make sure Chrome is still working OK.

We can always reverse the deletion if necessary.

[megadez]

no redirects with chrome so far

[emeraldnzl]

Lets run MBAM.

It is updated a lot, sometimes several times a day. Might be worth seeing if it picks anything up now.

You have used Malwarebytes before. If you still have it on your machine please update and run. Post the scan report back here.

If you no-longer have Malwarebytes please download from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

[megadez]

Mbam scans for 2-3 minutes and stalls, program is not responding in task manager, it always stops working somewhere
in the area of C:\windows\installer\*****.msi after having scanned about 24-25000 objects and found 0 infected by the moment
of stalling. When I look in task manager there are two identical entries Marwarebyte's Anti-Malware. It's impossible to end the task
or even the process! it won't. The only way to get mbam working againg is to restart the machine, and it takes 5-7 minutes to restart,
message "windows is shutting down" stays on for a couple of minutes.

keyword.url in firefox is at "user set" again and reverts to it on restart of mozilla

[megadez]

actually, mbam did struggle slowly through and quick scan didn't reveal anything

[emeraldnzl]

Mbam scans for 2-3 minutes and stalls, program is not responding in task manager, it always stops working somewhere
in the area of C:\windows\installer\*****.msi after having scanned about 24-25000 objects and found 0 infected by the moment
of stalling. When I look in task manager there are two identical entries Marwarebyte's Anti-Malware.

Looks like you had two instances running. Wonder if you have some corrupted system files too.

This might help:

Try running System File Checker, to make sure your protected files are not corrupt.

The scan will automatically replace any corrupt files that it finds.

Click Start
Select Run
At the prompt type sfc /scannow Please note that there is a single space between sfc and /scannow.

Typing this will start the program, and a box should appear telling you how much longer the process should take.

Sometimes the scan will prompt you for your Windows XP disc upon starting the scan. if this happens please make sure that you can view protected files:
My Computer
Tools
Folder Options
View
"Uncheck" Hide protected operating system files.

Then rerun the scan. If this still asks you to put in your windows XP CD, and you do not have the CD (If you bought it preinstalled) post back for more tips, otherwise enter Windows CD.

Once the scan is complete:

Check your Windows Updates! After using the File Protection Service, you might need to reapply some updates.

Please reboot, and let me know if anything has changed.

Also, please rehide the protected files:
My Computer
Tools
Folder Options
View
"Check" Hide protected operating system files.

[emeraldnzl]

Mbam scans for 2-3 minutes and stalls, program is not responding in task manager, it always stops working somewhere
in the area of C:\windows\installer\*****.msi after having scanned about 24-25000 objects and found 0 infected by the moment
of stalling. When I look in task manager there are two identical entries Marwarebyte's Anti-Malware.

Looks like you had two instances running. Wonder if you have some corrupted system files too.

This might help:

Try running System File Checker, to make sure your protected files are not corrupt.

The scan will automatically replace any corrupt files that it finds.

Click Start
Select Run
At the prompt type sfc /scannow Please note that there is a single space between sfc and /scannow.

Typing this will start the program, and a box should appear telling you how much longer the process should take.

Sometimes the scan will prompt you for your Windows XP disc upon starting the scan. if this happens please make sure that you can view protected files:
My Computer
Tools
Folder Options
View
"Uncheck" Hide protected operating system files.

Then rerun the scan. If this still asks you to put in your windows XP CD, and you do not have the CD (If you bought it preinstalled) post back for more tips, otherwise enter Windows CD.

Once the scan is complete:

Check your Windows Updates! After using the File Protection Service, you might need to reapply some updates.

Please reboot, and let me know if anything has changed.

Also, please rehide the protected files:
My Computer
Tools
Folder Options
View
"Check" Hide protected operating system files.

[emeraldnzl]

Mbam scans for 2-3 minutes and stalls, program is not responding in task manager, it always stops working somewhere
in the area of C:\windows\installer\*****.msi after having scanned about 24-25000 objects and found 0 infected by the moment
of stalling. When I look in task manager there are two identical entries Marwarebyte's Anti-Malware.

Looks like you had two instances running. Wonder if you have some corrupted system files too.

This might help:

Try running System File Checker, to make sure your protected files are not corrupt.

The scan will automatically replace any corrupt files that it finds.

Click Start
Select Run
At the prompt type sfc /scannow Please note that there is a single space between sfc and /scannow.

Typing this will start the program, and a box should appear telling you how much longer the process should take.

Sometimes the scan will prompt you for your Windows XP disc upon starting the scan. if this happens please make sure that you can view protected files:
My Computer
Tools
Folder Options
View
"Uncheck" Hide protected operating system files.

Then rerun the scan. If this still asks you to put in your windows XP CD, and you do not have the CD (If you bought it preinstalled) post back for more tips, otherwise enter Windows CD.

Once the scan is complete:

Check your Windows Updates! After using the File Protection Service, you might need to reapply some updates.

Please reboot, and let me know if anything has changed.

Also, please rehide the protected files:
My Computer
Tools
Folder Options
View
"Check" Hide protected operating system files.

[megadez]

where do i get system file checker?