We help IT Professionals succeed at work.

Solution to remove spyware attached to search engine result links

My system is Window XP service pack 2, IE version 7

Only happened in internet explorer of any version.
After search engine (Yahoo, Google etc) displays search results, by clicking on any result link for the 1st time, i will be directed to some other search engines instead of the actual website i intended to visit.
I realize when i initially click any of the search result link, the status bar of the internet explorer first display the actual address of the search result link, subsequently pause for a while and redirect me to another "fake" search engine website. But when i click back button to go back to the valid search engine result page, another window of title "click2find" will pop up. When i click on the same search result link the 2nd time, i have no problem accessing the website i want.
 
There are numerous  "fake" search engine websites whenever i got redirected..
I have tried many solutions (scanning with various antivirus s/w in safe mode, checking Hijackthis etc) but none is working. Also tried downgraded from IE 7 to IE 6 and back to IE 7.
Please see more details in the attachments.
hijackthis.log
Click-Spyware-Problem.xls
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2007
Commented:
Looks like a wareout infection.

1.  Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://download.bleepingcomputer.com/lonny/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

At the end of the fix, you may need to restart your computer again.

Finally, please post a fresh HijackThis log, along with the contents of the logfile C:\fixwareout\report.txt




2.  If problem persists:
Please download ComboFix by sUBs from either of these locations:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

How to use Combofix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..


Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Author

Commented:
rpggamergirl, thank you so much for your great solution. I can finally use  search engine in IE again!!
CERTIFIED EXPERT
Top Expert 2007

Commented:
You're welcome, glad to help.

Thank you, :)

Explore More ContentExplore courses, solutions, and other research materials related to this topic.