[cybertech]

I would have to repeat my comment in post #13. Move or rename and delete if no problems are created by my actions.

It all looks rogue to me.

[ska4dragons]

None of the previous symptoms have come back. Whcih is why I haven't come back because I had nothing to report.

Till now. I can't use any google services. GMAIL my primary email is completely unavailable. Google search result links are being hijacked by a search site. Nothing outside google seams to be affected.

attached a new hijackthis log and an image of what firefox tells me when I try to go to gmail.com. All browser say the same thing. And if I make a security exception it leads to a 404 page not found.

[cybertech]

While we try our hardest to avoid them, accidents do happen. With today's malware being as it is, we will not be held responsible for any loss of your data. You are following the instructions given at your own risk. We recommend that you back up any data that’s important to you beforehand, just in case the worst happens.

1. As a general rule, to offset any unexpected mishaps, your personal data should be backed up regularly. If you do not already have a process in place that backs up your data, it is highly recommended you do this now. Click here here for guidelines on what to back up and how to do it.

2. Uninstall the following via Add or Remove Programs in Control Panel:

If you have more than one antivirus software installed, leave only ONE and uninstall the others.
CD emulation software, such as DAEMON Tools or Alcohol, see this page for complete instructions. These can be reinstalled once any malware removal efforts are completed.

p2p programs like uTorrent, Bittorrent, LimeWire, Morpheus, etc., as they are a major conduit for malware and a likely source of your current issues.



Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.
If you are not sure how to disable see this help page.



Download ComboFix from one of these locations:

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**


Double click on ComboFix.exe & follow the prompts.

• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:





Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

[ska4dragons]

I installed Daemon Lite before and I don't remember uninstalling it but I can't find it on my PC. I followed the directions to uninstall the SPTD driver but there was nothing to uninstall. Am I good?

Should I remove Malwarebytes? Let me know if there's anything else I should remove(program list attached)

[ska4dragons]

I can't download ComboFix

"could not be saved, because an unknown error occurred.

Try saving to a different location."

Tried to save it to Desktop, C:\, and Download Folder.

ok I think I got it with Opera instead of Firefox. Firefox now tells me the Combofix links are broken.

[ska4dragons]

nevermind I apparantly do not have the permission to save Combofix to my computer.

[cybertech]

I'm not clear on why you don't have permissions. Is this a work computer or is your account limited by the administrator?

[ska4dragons]

no neither. I am the administrator running as the administrator. That error should not occur.

[cybertech]

Click here to download Dr.Web CureIt and save it to your desktop.

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, look if you can click next icon next to the files found:
• If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
  
  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web you saved previously in your next reply along with a new Hijack This log.

[ska4dragons]

Quickscan picked up a lot but my computer has crashed twice on the full scan and it takes over 24 hours to complete. I'm about to try it again.

But whatever program blocking Google services was removed and also the one hijacking my google search results.

[cybertech]

Download to Desktop: DDS by sUBs from one of these locations:

http://download.bleepingcomputer.com/sUBs/dds.com
http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.forospyware.com/sUBs/dds

double click DDS.scr to run

When complete, DDS.txt will open.

Click Yes for Optional Scan.
Save both reports to your desktop.
DDS.txt
Attach.txt

Attach the contents of both logs back here.

=====
GMER:
=====

Download GMER Rootkit Scanner from here or here.

Ensure you have uninstalled any CD Emulation programs before you run GMER as outlined here

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe.
• If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
  
  
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
  
• Save it where you can easily find it, such as your desktop post it back here

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

[ska4dragons]

Ran DDS and started that other one but did not finish. computer started turning off randomly and got worse till i would boot it up and it would shut off within a few minutes. Then it started booting up system repair but would crash. till system repair nor windows would load at all. finally my mom got windows to load but now it's going really reallly reeeaaalllllyyy slow!

[cybertech]

After a month I would think you are ready to format and reload this machine.