I'm working on a client's Vista Home Premium machine. It had a couple of trojans that Norton found and removed on an external scan. I also removed several instances of fakeavalert using MalwareBytes and SuperAntiSpyware. Then I put the drive back in the system and scanned using the same 3 tools. Norton showed a few tracking cookies, as did SAS. MalwareBytes found and removed 2 more fakeavalert instances.
So the machine appears clean, but it continues to redirect, usually to a search page, but not always. It appears to only redirect from a search engine (google and the search bar from yahoo, for example. If I type the name in the address bar I get to the correct destination. I can follow links on those pages successfully (from adobe.com I am able to download Reader, Flash, etc) Also, a script error shows up when I Google something, as it redirects.
I've removed cookies, temporary internet files, etc. and I've re-set the browser settings to default. I also tried hard coding the dns, but that didn't help.
One final symptom: I wanted to see if it behaved the same in hte administrator profile, so I enabled it (net user administrator activate:yes). But it still doesn't show up for login.
I'm about to run another MalwareBytes scan to make sure it shows clean. I'll post my findings in a couple of hours.