Norton Internet Security / Norton AntiVirus

[89strat]

Hi-

I can't get rid of the Trojan.Happili redirect. Norton AntiVirus can't find it and Malwarebytes says it's quarantined and deleted it, but I'm still getting redirected from Google search result links. I had this issue last month, it seemed to be resolved, but now it's back. I've attached the Malwarebytes logs from today and from the last infection. Any help would be greatly appreciated.

Thanks

[Quads]

Please do not run any tools unless instructed to do so. 

• We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.

Please read every post completely before doing anything. 

• Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes )
  
  
•  Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

Please read carefully

1. Please download aswMBR hxxp://public.avast.com/~gmerek/aswMBR.exe to your desktop. (replace the hxxp with http)
Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT / Yes
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and Please attach the log in the post back, Don't have the program fix anything.

Quads

[89strat]

Thanks for your quick and detailed response.I've attached the log file for review. I appreciate the help.

[Quads]

Please read carefully Read all of this message first

Download Combofix http://www.bleepingcomputer.com/download/anti-virus/combofix

• Ensure that Combofix is saved directly to the Desktop <--- Very important
  
  
• Disable all security programs as they will have a negative effect on Combofix, Disabled for say 1 hour or more.
• Close any open browsers and any other programs you might have running

Doiwnload the attached CFscript.txt, , For some browsers Right Click the attachment on the forum and select "Save AS" or similar to Download it. See screenshot below.

Now  drag the CFScript.txt into the ComboFix.exe  

• If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
• When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

*EXTRA NOTES*

• If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
• If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
• If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Quads

[89strat]

OK, Combofix has run. The requested report is attached. I left Combofix run unattended and it rebooted the system, so does that mean it detected Rootkit/Bootkit activity? Also I did get a warning message about registry keys being listed for deletion when I tried to open items, so I rebooted again per your instructions and it seemed to fix that. After the reboot, I tested a Google search and was NOT redirected.

Does this mean the issue is resolved? If no, what's next? If yes, how can I avoid this hassle again in the future?

Thanks again for your help.

[Quads]

OK,  

With your browsers go into the options and clear all the Browsing data,   The browser will give options like Browser Cache, Temp files, History etc.   select all.

Quads

[89strat]

Thanks, Quad. All browsing info is now deleted. Are there any more steps to complete. Anything I can do to avoid this going forward?

[Quads]

Are you getting the redirects now??

Quads

[89strat]

Argh! Just tested and I'm getting redirects AGAIN! After running Combofix last night I was NOT getting redirects for a while...now the issue is back. What's the next step?

Thanks for all your time and expertise~

[Quads]

Please read carefully and Slowly

 Please scan with ESET next 

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the  button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on  to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the  icon on your desktop.
• Check 
• Click the  button.
• Accept any security warnings from your browser.
• Under scan settings, check  and DON'T (NO) check Remove found threats (reason for this is we don't want something deleted and then Windows won't load).
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• Attach the resulting log in your next reply

If you think a log should have been generated then go to C:\Program Files\ESET\ESET Online Scanner\log.txt to find it. 

Quads