redirect of google search results

It happens on all links.

I will try hijack this.

Dan

Dan, also look at your HOSTS file.  HOSTS is a hidden file, so you have to unhide hidden files.

Windows XP        =        C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K       =       C:\WINNT\SYSTEM32\DRIVERS\ETC
Win 98/ME       =       C:\WINDOWS

Open it with an editor and make sure there is nothing more than 127.0.0.1 localhost  Scroll down all the way to the bottom to check for hidden files.

here is my hijack this logfile:

http://www.hijackthis.de/logfiles/9a2db3f8c78b9953e46ffa1241bd825f.html


Dan

Does anybody know what dmvpu.exe is? I took it out with hijack this.

Dan

Dan,

Have HijackThis remove the following item

O4 - HKLM\..\Run: [dmvpu.exe] C:\WINDOWS\system32\dmvpu.exe

If you did not install these programs, have HijackThis remove them

D:\rpointpr.exe
O4 - Global Startup: RemotePoint Presenter.lnk = D:\rpointpr.exe

O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.lowrance.com/Software/Upgrades/LCX/LCX-104C_180/isetup.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = featherdownmedical.com                 
O17 - HKLM\Software\..\Telephony: DomainName = featherdownmedical.com               
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = featherdownmedical.com

>>Does anybody know what dmvpu.exe is? I took it out with hijack this.<<

Hi,
It looks like a "wareout" infection.

You must have an active Internet connection when running this fix, in order to download the Brute Force Uninstaller (BFU) from Merijn's page.

If you have problems with your connection:
Please go to Start -> Control Panel, and choose Network Connections.  Then right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and left click on properties.  Double-click on the Internet Protocol (TCP/IP) item and select the radio button that says Obtain DNS servers automatically.  Click OK twice, and restart your computer.


Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

Save it to your desktop and run it.  Click Next, then Install, then make sure "Run fixit" is checked and click Finish.  The fix will begin; follow the prompts.  You will be asked to reboot your computer; please do so.  Your system may take longer than usual to load; this is normal.

When your system reboots, follow the prompts.  Afterwards, HijackThis will launch.  Please click Scan, and check the following items:

O4 - HKLM\..\Run: [dmvpu.exe] C:\WINDOWS\system32\dmvpu.exe

Click Fix Checked.  Close HijackThis, and click OK to proceed.

At the end of the fix, you may need to restart your computer again.

Finally, please post the contents of the logfile C:\fixwareout\report.txt, along with a new HijackThis log.

After you've used "Fixwareout.exe" and when Hijackthis launch,
If you see a new item that wasn't in your last log in the O4 section of HijackThis, five-letters long, starting with dm... for example:
O4 - HKLM\..\Run: [dm***.exe] C:\WINDOWS\system32\dm***.exe (the *** stand for random letters)
or starting with hg***.exe for example:
O4 - HKLM\..\Run: [hg***.exe] C:\Windows\System32\hg***.exe
or starting with cs***.exe for example:
O4 - HKLM\..\Run: [cscyd.exe] cscyd.exe
Check it as well.

rpggamergirl,
here is the fix log:

Fixwareout ver 1.003
Last edited 1/12/2006
Post this report in the forums please
 
Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\petmd
 
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
 
»»»»» Search by size and names...
C:\WINDOWS\SYSTEM32\CSTUF.EXE
C:\WINDOWS\SYSTEM32\DMTEP.EXE
 
»»»»» Misc files
 
»»»»» Checking for older varients covered by the Rem3 tool

I removed the cstuf file but not the dmtep file as it has been there for 2 years. Is that a malicious file?


Here is my last Hijack this logfile:

http://www.hijackthis.de/logfiles/9a2db3f8c78b9953e46ffa1241bd825f.html

rpggamergirl,

google has now stopped redirecting me and I get the link that I click on after a search. Thanks.

I did a file search and found several files in the windows system and windows SP2 that were cs***.exe and dm***.exe. They have been there since 2004. Are they malicious?

Dan

War 1,

Localhost file was clean. All 127.0.0.1

Dan

>>I did a file search and found several files in the windows system and windows SP2 that were cs***.exe and dm***.exe. They have been there since 2004. Are they malicious?<<

If they're malicious hijackthis would've picked them up.
If they have been there since 2004 and your pc were alright then, i think just leave those files alone. Did it tell you any info when you rightclick on them?

Just run a scanner like Ewido, download update first, then run it in Safe Mode.
Download and install the free version of Ewido anti-malware.
http://www.ewido.net/en/download/
Update first then scan in safe mode.