Redirect To Google on Microsoft Update

[midgetwars]

Whenever I try to Update my computer it goes to Google.

My computer is XP and it is running at SP1

HERE is the DDS log


DDS (Ver_09-02-01.01) - NTFSx86
Run by Family at 11:23:57.75 on Sat 02/21/2009
Internet Explorer: 6.0.2800.1106
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.511.334 [GMT 11:00]


============== Running Processes ===============

E:\WINDOWS\system32\svchost -k rpcss
E:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
C:\Program Files\TP-LINK\TL-WN310G_350G_351Gv5.0_TL-WN360Gv1.0\TWCU.exe
E:\Program Files\Autorun Eater\oldmcdonald.exe
E:\WINDOWS\System32\RunDll32.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Autorun Eater\billy.exe
e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
e:\program files\mcafee.com\agent\mcdetect.exe
e:\PROGRA~1\mcafee.com\vso\mcshield.exe
e:\PROGRA~1\mcafee.com\vso\OasClnt.exe
e:\program files\mcafee.com\vso\mcvsshld.exe
e:\progra~1\mcafee.com\vso\mcvsescn.exe
e:\progra~1\mcafee.com\vso\mcvsftsn.exe
E:\Documents and Settings\Family\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://microsoft.com/
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - e:\progra~1\mcafee.com\vso\mcvsshl.dll
EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll
uRun: [MsnMsgr] "e:\program files\windows live\messenger\MsnMsgr.Exe" /background
mRun: [TWCU] "c:\program files\tp-link\tl-wn310g_350g_351gv5.0_tl-wn360gv1.0\TWCU.exe" -nogui
mRun: [Autorun Eater] e:\program files\autorun eater\oldmcdonald.exe
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [VSOCheckTask] "e:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [VirusScan Online] e:\program files\mcafee.com\vso\mcvsshld.exe
mRun: [OASClnt] e:\program files\mcafee.com\vso\oasclnt.exe
mRun: [MCAgentExe] e:\progra~1\mcafee.com\agent\mcagent.exe
mRun: [MCUpdateExe] e:\progra~1\mcafee.com\agent\McUpdate.exe
mRun: [CleanUp] e:\progra~1\mcafee.com\shared\mcappins.exe /v=3 /cleanup
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - e:\program files\messenger\MSMSGS.EXE
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0401
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0404
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0405
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0406
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0407
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0408
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0409
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang040b
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang040c
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang040d
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang040e
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0410
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0411
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0412
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0413
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0414
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0415
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0416
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0419
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang041b
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang041d
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang041f
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0424
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0804
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0816
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683}\Lang0c0a
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1235043347018
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1235043743148
TCP: NameServer = 85.255.112.39,85.255.112.40
TCP: {5C4056BD-3459-4749-9707-7B54D09044F5} = 85.255.112.39,85.255.112.40
TCP: {5CF36078-CCE1-47AB-89C0-D478A0E90709} = 85.255.112.39,85.255.112.40

================= FIREFOX ===================

FF - ProfilePath - e:\docume~1\family\applic~1\mozilla\firefox\profiles\mrwrefol.default\
FF - component: e:\program files\mozilla firefox\components\iamfamous.dll

============= SERVICES / DRIVERS ===============

R2 McDetect.exe;McAfee WSC Integration;e:\program files\mcafee.com\agent\Mcdetect.exe [2009-2-21 126976]
R2 McShield;McAfee.com McShield;e:\progra~1\mcafee.com\vso\mcshield.exe [2009-2-21 221184]
R2 McTskshd.exe;McAfee Task Scheduler;e:\progra~1\mcafee.com\agent\mctskshd.exe [2009-2-21 122368]
R3 NaiAvFilter1;NaiAvFilter1;e:\windows\system32\drivers\naiavf5x.sys [2009-2-21 114464]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;e:\progra~1\mcafee.com\agent\mcupdmgr.exe [2009-2-21 245760]
S3 WSIMD;wsimd Service;e:\windows\system32\drivers\wsimd.sys [2009-2-19 55840]

=============== Created Last 30 ================

2009-02-21 11:11 114,464 ac------ e:\windows\system32\drivers\naiavf5x.sys
2009-02-21 11:09 <DIR> --d----- e:\docume~1\alluse~1\applic~1\McAfee.com
2009-02-21 11:09 288,320 ac---r-- e:\windows\system32\mcgdmgr.dll
2009-02-21 11:09 349,760 ac---r-- e:\windows\system32\mcinsctl.dll
2009-02-21 11:09 <DIR> --d----- e:\program files\McAfee.com
2009-02-21 10:35 <DIR> --d----- e:\documents and settings\family\Contacts
2009-02-20 23:06 <DIR> --d----- e:\program files\Alex Feinman
2009-02-20 21:01 664 ac------ e:\windows\system32\d3d9caps.dat
2009-02-20 20:52 3,541 ac------ e:\windows\Ascd_tmp.ini
2009-02-20 20:52 5,824 ac------ e:\windows\system32\drivers\ASUSHWIO.SYS
2009-02-20 20:38 <DIR> --d----- e:\program files\Foxit Software
2009-02-20 20:38 <DIR> --d----- e:\docume~1\family\applic~1\Foxit
2009-02-20 19:05 <DIR> --d----- e:\docume~1\family\applic~1\uTorrent
2009-02-20 18:40 1,172 ac------ e:\windows\mozver.dat
2009-02-20 17:43 <DIR> --d----- e:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
2009-02-20 17:15 <DIR> --d----- e:\program files\Autorun Eater
2009-02-20 16:54 172,672 ac------ e:\windows\system32\dllcache\mrxdav.sys
2009-02-20 16:54 61,952 ac------ e:\windows\system32\webclnt.dll
2009-02-20 16:54 61,952 ac------ e:\windows\system32\dllcache\webclnt.dll
2009-02-20 16:54 172,672 a------- e:\windows\system32\drivers\mrxdav.sys
2009-02-20 16:51 8,351,232 ac------ e:\windows\system32\dllcache\shell32.dll
2009-02-20 16:51 700,928 ac------ e:\windows\system32\sxs.dll
2009-02-20 16:51 700,928 ac------ e:\windows\system32\dllcache\sxs.dll
2009-02-20 16:51 594,944 ac------ e:\windows\system32\xpsp2res.dll
2009-02-20 16:51 82,432 ac------ e:\windows\system32\fldrclnr.dll
2009-02-20 16:51 82,432 ac------ e:\windows\system32\dllcache\fldrclnr.dll
2009-02-20 16:49 50,688 ac------ e:\windows\system32\dllcache\agentdpv.dll
2009-02-20 16:48 107,008 ac------ e:\windows\system32\umpnpmgr.dll
2009-02-20 16:48 61,440 ac------ e:\windows\system32\mtxclu.dll
2009-02-20 16:44 782,336 ac---r-- e:\windows\system32\tmp3E4.tmp
2009-02-20 16:44 409,600 ac------ e:\windows\system32\wrap_oal.dll
2009-02-20 16:44 114,688 ac------ e:\windows\system32\OpenAL32.dll
2009-02-20 16:44 <DIR> --d----- e:\program files\OpenAL
2009-02-20 16:20 83,968 a------- e:\windows\system32\mtxoci.dll
2009-02-20 16:18 170,112 ac------ e:\windows\system32\dllcache\rdbss.sys
2009-02-20 16:18 116,736 ac------ e:\windows\system32\dllcache\shsvcs.dll
2009-02-20 16:18 92,160 ac------ e:\windows\system32\dllcache\cscdll.dll
2009-02-20 16:18 92,160 ac------ e:\windows\system32\cscdll.dll
2009-02-20 16:18 681,984 ac------ e:\windows\system32\dllcache\lsasrv.dll
2009-02-20 16:16 25,600 -c------ e:\windows\system32\verclsid.exe
2009-02-20 16:12 582,656 a------- e:\windows\system32\catsrvut.dll
2009-02-20 16:12 215,040 a------- e:\windows\system32\catsrv.dll
2009-02-20 16:09 <DIR> -cd----- e:\windows\RegisteredPackages
2009-02-20 16:03 493,056 ac------ e:\windows\system32\hypertrm.dll
2009-02-20 15:59 991,232 ac------ e:\windows\system32\esent.dll
2009-02-20 15:57 218,112 ac------ e:\windows\system32\dllcache\c_g18030.dll
2009-02-20 15:56 479,744 ac------ e:\windows\system32\PINTLGNT.IME
2009-02-20 15:55 118,272 ac------ e:\windows\system32\dllcache\dhtmled.ocx
2009-02-20 06:38 3,072 ac------ e:\windows\system32\drivers\audstub.sys
2009-02-20 06:38 24,960 ac------ e:\windows\system32\drivers\usbprint.sys
2009-02-20 06:37 56,576 ac------ e:\windows\system32\drivers\redbook.sys
2009-02-20 06:37 23,070 ac------ e:\windows\system32\drivers\RTL8139.sys
2009-02-20 06:36 67,072 ac------ e:\windows\system32\usbui.dll
2009-02-20 06:35 <DIR> --d----- e:\program files\common files\ODBC
2009-02-20 06:35 <DIR> --d----- e:\program files\common files\SpeechEngines
2009-02-20 06:35 <DIR> --d--r-- e:\documents and settings\all users\Documents
2009-02-20 06:32 261 ac------ e:\windows\system32\$winnt$.inf
2009-02-19 22:35 <DIR> --ds---- e:\documents and settings\family\UserData
2009-02-19 22:26 <DIR> --d----- e:\docume~1\alluse~1\applic~1\TP-LINK
2009-02-19 22:06 <DIR> --d----- e:\docume~1\alluse~1\applic~1\Symantec
2009-02-19 19:47 <DIR> --dsh--- e:\documents and settings\all users\DRM
2009-02-19 19:46 <DIR> --d----- e:\program files\common files\MSSoap
2009-02-19 19:44 <DIR> --d-h--- e:\program files\WindowsUpdate
2009-02-19 19:44 <DIR> --d----- e:\program files\Online Services
2009-02-19 19:44 <DIR> --d----- e:\program files\Messenger
2009-02-19 19:44 <DIR> --d----- e:\program files\MSN Gaming Zone
2009-02-19 19:43 <DIR> --d----- e:\program files\Windows NT

==================== Find3M ====================

2009-02-19 22:21 129,636 ac------ e:\windows\pchealth\helpctr\config\cache\Personal_32_1033.dat
2009-02-19 19:47 70,691 ac------ e:\windows\pchealth\helpctr\offlinecache\index.dat
2009-02-19 19:45 21,640 ac------ e:\windows\system32\emptyregdb.dat
2009-01-10 19:13 3,183,233,024 a------- e:\program files\Brian Lara International Cricket 2007 [PC][DVD][English][www.emwreloaded.com].iso

============= FINISH: 11:24:07.76 ===============

[Angelfire777]

Why wasn't this updated to sp2 a long time ago?

Please download MGADiag.exe to your desktop.

Double-click MGADiag.exe and click Continue in the bottom right of the window to run the tool.

When it's done, capture a screenshot of the finished scan, and post that.

In Windows a screenshot of the entire monitor, complete with taskbar, can be copied to the system clipboard by pressing the Print screen key (normally located in the top row on the right-hand side of the keyboard)..

You can then paste the clipboard into a program like MS Paint to save it as an image file or paste it directly into a document.

1. Press the Print screen key
2. Click the "Start" button (normally located in the bottom left of your screen).
3. Click "Run" & type "mspaint" (without quotes) & click the "OK" button.
4. Wait while the application "Paint" opens. Once it is open, proceed to the next step.
5. Click the "Edit" menu and select "Paste".
6. Click the "File" menu and select "Save As...". A dialog box will appear.
7. In the "File name" field, enter a name of your choice.
8. Click the "Save as type" drop-down and select "JPEG (*.JPG;*.JPEG;*.JPE*;.JFIF)".
9. Click the "Save" button.

Attach it in your next reply, please.

To attach a file to a new post, simply

1. Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, browse to where you saved the file, and
2. Click Upload.

[midgetwars]

I don't have SP2 because i reintalled XP.

Also I can't seem to download anything from Microsoft
ON firefox it comes with this "Firefox can't establish a connection to the server at download.microsoft.com."

So What else can i do?

[Angelfire777]

Do you have the GMER log from following the instructions here?

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

If for some reason, you can't run it, rename it first to something else then run it again. I will need the log in your next reply.

[midgetwars]

Here's the Gmer Thing

[Angelfire777]

Please visit this webpage for download links, and instructions for running combofix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Note: Please rename combofix.exe to cfix.exe

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

[midgetwars]

Here's MY Combo Fix Thing

By the Way can you find any problems so far?

[Angelfire777]

Hi,

e:\program files\Brian Lara International Cricket 2007 [PC][DVD][English][www.emwreloaded.com].iso

I assume this file was downloaded via illegal methods like p2p. If so, please avoid engaging in such activities again since a LOT of files distributed through those torrent or p2p sites are usually infected with some form of malware. Recently, a new file infector has re-surfaced and spreading through cracks and other 'illegal' files so it is best to avoid such activities.


*I would like you to scan a file for me.

Please go HERE. Copy and paste the following file path in to the box.

e:\windows\system32\tmp3E4.tmp

Then click submit.

do the same for this file: c:\documents and settings\Family\Desktop\Nelson\Window Hide.exe

Please post the results to your next reply.


*Go here to run an online scannner from ESET.

• Note: You will need to use Internet explorer for this scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
• Click Scan
• Wait for the scan to finish
• Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic

[midgetwars]

I'm not actually what the results are in the Virustotal.com Can you tell me which are the results.

[Angelfire777]

This is what results look like:



I want you to copy and paste it here.

[midgetwars]

THE VIRUS TOTAL RESULTS
Here's The e:\windows\system32\tmp3E4.tmp Results
Antivirus Version Last Update Result
a-squared 4.0.0.93 2009.02.11 -
AhnLab-V3 5.0.0.2 2009.02.10 -
AntiVir 7.9.0.76 2009.02.10 -
Authentium 5.1.0.4 2009.02.10 -
Avast 4.8.1335.0 2009.02.10 -
AVG 8.0.0.229 2009.02.10 -
BitDefender 7.2 2009.02.11 -
CAT-QuickHeal 10.00 2009.02.10 -
ClamAV 0.94.1 2009.02.10 -
Comodo 973 2009.02.10 -
DrWeb 4.44.0.09170 2009.02.11 -
eSafe 7.0.17.0 2009.02.09 -
eTrust-Vet 31.6.6349 2009.02.11 -
F-Prot 4.4.4.56 2009.02.10 -
F-Secure 8.0.14470.0 2009.02.11 -
Fortinet 3.117.0.0 2009.02.11 -
GData 19 2009.02.11 -
Ikarus T3.1.1.45.0 2009.02.11 -
K7AntiVirus 7.10.626 2009.02.10 -
Kaspersky 7.0.0.125 2009.02.11 -
McAfee 5522 2009.02.10 -
McAfee+Artemis 5522 2009.02.10 -
Microsoft 1.4306 2009.02.10 -
NOD32 3844 2009.02.11 -
Norman 6.00.02 2009.02.09 -
nProtect 2009.1.8.0 2009.02.10 -
Panda 10.0.0.10 2009.02.10 -
PCTools 4.4.2.0 2009.02.10 -
Prevx1 V2 2009.02.11 -
Rising 21.16.12.00 2009.02.10 -
SecureWeb-Gateway 6.7.6 2009.02.11 -
Sophos 4.38.0 2009.02.10 -
Sunbelt 3.2.1851.2 2009.02.10 -
Symantec 10 2009.02.11 -
TheHacker 6.3.1.5.252 2009.02.11 -
TrendMicro 8.700.0.1004 2009.02.10 -
VBA32 3.12.8.12 2009.02.11 -
ViRobot 2009.2.10.1599 2009.02.10 -
VirusBuster 4.5.11.0 2009.02.10 -

Here's the Window Hide Result:
Antivirus Version Last Update Result
AhnLab-V3 2008.11.18.2 2008.11.19 -
AntiVir 7.9.0.34 2008.11.19 -
Authentium 5.1.0.4 2008.11.18 -
Avast 4.8.1281.0 2008.11.18 -
AVG 8.0.0.199 2008.11.19 -
BitDefender 7.2 2008.11.19 -
CAT-QuickHeal 10.00 2008.11.18 -
ClamAV 0.94.1 2008.11.19 -
DrWeb 4.44.0.09170 2008.11.19 -
eSafe 7.0.17.0 2008.11.18 Suspicious File
eTrust-Vet 31.6.6214 2008.11.18 -
Ewido 4.0 2008.11.18 -
F-Prot 4.4.4.56 2008.11.18 -
F-Secure 8.0.14332.0 2008.11.19 -
Fortinet 3.117.0.0 2008.11.19 -
GData 19 2008.11.19 -
Ikarus T3.1.1.45.0 2008.11.19 -
K7AntiVirus 7.10.527 2008.11.18 -
Kaspersky 7.0.0.125 2008.11.19 -
McAfee 5438 2008.11.18 -
Microsoft 1.4104 2008.11.19 -
NOD32 3623 2008.11.18 -
Norman 5.80.02 2008.11.18 -
Panda 9.0.0.4 2008.11.19 -
PCTools 4.4.2.0 2008.11.18 -
Prevx1 V2 2008.11.19 -
Rising 21.04.21.00 2008.11.19 -
SecureWeb-Gateway 6.7.6 2008.11.19 -
Sophos 4.35.0 2008.11.19 -
Sunbelt 3.1.1801.2 2008.11.14 -
Symantec 10 2008.11.19 -
TheHacker 6.3.1.1.158 2008.11.19 -
TrendMicro 8.700.0.1004 2008.11.19 PAK_Generic.001
VBA32 3.12.8.9 2008.11.18 -
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.18 -

[Angelfire777]

Thanks, please proceed to the ESET scan.

[midgetwars]

Oh Yeah, the eset scan says I prohibit Active X how do i allow it. Because there is no direct link

[Angelfire777]

If you can't click the warning and choose "allow", please try this:

1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click on the Security tab
3. Click the Internet icon so it becomes highlighted.
4. Click on Default Level and click Ok
5. Click on the Custom Level button.
   • Change the Download signed ActiveX controls to Prompt
   • Change the Download unsigned ActiveX controls to Disable
   • Check that Script ActiveX controls marked safe for scripting is set to Enabled or Prompt
   • Check that Run ActiveX controls and plugins is Enabled
   • Change the Initialise and script ActiveX controls not marked as safe to Disable
   • Change the Installation of desktop items to Prompt
   • Change the Launching programs and files in an IFRAME to Prompt
   • Change the Navigate sub-frames across different domains to Prompt
   • Check that Active Scripting is set to Enabled
   • When all these settings have been made, click on the OK button.
   • If it prompts you as to whether or not you want to save the settings, press the Yes button.
6. Next press the Apply button and then the OK to exit the Internet Properties page.

Open a new IE window and try to run the online scan.

[midgetwars]

It still won't work

[Angelfire777]

Are you using firefox or IE? Please use IE.

[midgetwars]

I was Using IE. But Anyways it now works, IT won't redirect to GOOGLE anymore. Thanx for your help. I think it was
e:\program files\Brian Lara International Cricket 2007 [PC][DVD][English][www.emwreloaded.com].iso

THAT CAUSED THE PROBLEM

[Angelfire777]

I'm sorry what works?

If it's the ESET scan, please post the log. If we don't finish it up, you may be back in a matter of days and all our efforts will be wasted.

[midgetwars]

Uh..
SORRY, i wasn't as clear
I MEANT THAT IT WON"T REDIRECT TO GOOGLE ANYMORE

[midgetwars]

Thanks for the help