Our November Competition
User Reviews - Add Yours!
The PCHF Lounge
Go Back   PC Help Forum » Security & Safety » [Fixed] Hijackthis! Logs
Register for a Free Account

[Fixed] Hijackthis! Logs - Search links hijacked and go to wrong sites posted in the Security & Safety forums; Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\Program Files\Apoint\bak C:\Program Files\Dell Support\bak ...


Reply
Free PC Performance Scan
Old 4 Weeks Ago   #8
Senior Security Analyst
 
Pancake's Avatar
 
Join Date: Jun 2006
Location: Victoria, Australia
Posts: 6,867
PC Experience: Elite PC Guru
Default Re: Search links hijacked and go to wrong sit

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\Apoint\bak
C:\Program Files\Dell Support\bak
C:\Program Files\Lexmark X1100 Series\bak
C:\Program Files\QuickTime\bak
C:\Program Files\SymNetDrv\bak
C:\Program Files\ATI Technologies\ATI Control Panel\bak
C:\Program Files\Common Files\Symantec Shared\bak
C:\Program Files\CyberLink\PowerDVD\bak
C:\Program Files\Dell\Media Experience\bak
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak
C:\Program Files\Real\RealPlayer\bak
C:\Program Files\Common Files\InstallShield\UpdateService\bak
C:\Program Files\Java\j2re1.4.2_03\bin\bak
C:\QooBox\Quarantine\C\Program Files\Ultimate Cleaner\bak
C:\QooBox\Quarantine\C\Program Files\Ultimate Defender\bak
C:\QooBox\Quarantine\C\Program Files\Ultimate Defender\bak
C:\QooBox\Quarantine\C\Program Files\Ultimate Cleaner\bak
C:\QooBox\Quarantine\C\Program Files\Ultimate Defender\bak
C:\QooBox\Quarantine\C\Program Files\Ultimate Cleaner\bak
C:\QooBox\Quarantine\C\Program Files\Ultimate Defender\bak
C:\QooBox\Quarantine\C\WINDOWS\system32\bak
C:\Program Files\Intel\Wireless\Bin\bak
C:\Program Files\Java\jre1.5.0_06\bin\bak
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\bak
C:\Program Files\epson\Creativity Suite\Event Manager\bak
C:\WINDOWS\system32\dla\bak
C:\WINDOWS\ehome\bak
C:\Program Files\iTunes\bak
C:\Program Files\DellSupport\bak

Double-click on the FindAWF.exe file to run it.
It will open a command prompt and ask you to "Press any key to continue".
Select option 3 from the menu and press Enter.
Press any key to continue.
A Notepad document FindAWF.txt will appear with instructions to click below the line and paste the list of folders to be removed.
Right click below this line and select Paste, to paste the list of folders copied to the clipboard earlier. Save and close the document.
The program will proceed to remove the bak folders and will perform another scan for bak folders.
It may take a few minutes to complete so be patient.
Post the log please...
__________________
  • An Australian Member of
  • and
My real name is Eddy
Pancake is offline   Reply With Quote
Advertisement - Register to Remove
Old 4 Weeks Ago   #9
Bronze Member
 
CandyK's Avatar
 
Join Date: Oct 2009
Posts: 18
PC Experience: Some Experience
Default Re: Search links hijacked and go to wrong sit

Here's the log.
------------------------
Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully
The current date is: Sat 10/24/2009
The current time is: 23:48:44.67

bak folders found
~~~~~~~~~~~

Directory of C:\PROGRA~1\APOINT\BAK
09/13/2004 05:33 PM 155,648 Apoint.exe
1 File(s) 155,648 bytes
Directory of C:\PROGRA~1\DELLSU~1\BAK
03/15/2007 11:09 AM 460,784 DSAgnt.exe
1 File(s) 460,784 bytes
Directory of C:\PROGRA~1\ITUNES\BAK
12/20/2005 09:54 PM 278,528 iTunesHelper.exe
1 File(s) 278,528 bytes
Directory of C:\PROGRA~1\MSNMES~1\BAK
0 File(s) 0 bytes
Directory of C:\PROGRA~1\QUICKT~1\BAK
02/04/2006 10:52 AM 155,648 qttask.exe
1 File(s) 155,648 bytes
Directory of C:\WINDOWS\EHOME\BAK
08/10/2004 05:04 AM 59,392 ehtray.exe
1 File(s) 59,392 bytes
Directory of C:\WINDOWS\SYSTEM32\BAK
03/10/2004 03:26 PM 406,016 PSDrvCheck.exe
1 File(s) 406,016 bytes
Directory of C:\PROGRA~1\ATITEC~1\ATICON~1\BAK
05/12/2005 10:00 PM 344,064 atiptaxx.exe
1 File(s) 344,064 bytes
Directory of C:\PROGRA~1\CYBERL~1\POWERDVD\BAK
02/23/2005 05:19 PM 53,248 DVDLauncher.exe
1 File(s) 53,248 bytes
Directory of C:\PROGRA~1\DELL\QUICKSET\BAK
03/04/2005 12:26 PM 606,208 quickset.exe
1 File(s) 606,208 bytes
Directory of C:\PROGRA~1\MUSICM~1\MUSICM~3\BAK
09/14/2004 09:50 AM 53,248 mmtask.exe
1 File(s) 53,248 bytes
Directory of C:\WINDOWS\SYSTEM32\DLA\BAK
05/31/2005 05:33 AM 122,941 tfswctrl.exe
1 File(s) 122,941 bytes
Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK
07/27/2004 05:50 PM 81,920 issch.exe
07/27/2004 05:50 PM 221,184 ISUSPM.exe
2 File(s) 303,104 bytes
Directory of C:\PROGRA~1\EPSON\CREATI~1\EVENTM~1\BAK
04/08/2005 03:09 PM 102,400 EEventManager.exe
1 File(s) 102,400 bytes
Directory of C:\PROGRA~1\INTEL\WIRELESS\BIN\BAK
10/30/2004 03:59 PM 385,024 ifrmewrk.exe
1 File(s) 385,024 bytes
Directory of C:\PROGRA~1\JAVA\JRE15~2.0_0\BIN\BAK
11/10/2005 02:03 PM 36,975 jusched.exe
1 File(s) 36,975 bytes
Directory of C:\PROGRA~1\PINNACLE\SHARED~1\PROGRAMS\USBTIP\BAK
04/23/2004 12:00 PM 192,512 USBTip.exe
1 File(s) 192,512 bytes

Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~
176128 Oct 7 2005 "C:\dell\drivers\R113813\Apoint.exe"
155648 Sep 13 2004 "C:\Program Files\Apoint\bak\Apoint.exe"
460784 Mar 15 2007 "C:\Program Files\DellSupport\bak\DSAgnt.exe"
305440 Sep 21 2009 "C:\Program Files\iTunes\iTunesHelper.exe"
278528 Dec 20 2005 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
102400 Oct 6 2009 "C:\WINDOWS\Installer\{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}\iTunesIco.exe"
417792 Sep 5 2009 "C:\Program Files\QuickTime\QTTask.exe"
155648 Feb 4 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
59392 Aug 10 2004 "C:\WINDOWS\ehome\ehtray.exe"
59392 Aug 10 2004 "C:\WINDOWS\ehome\bak\ehtray.exe"
406016 Mar 10 2004 "C:\WINDOWS\system32\PSDrvCheck.exe"
406016 Mar 10 2004 "C:\WINDOWS\system32\bak\PSDrvCheck.exe"
344064 May 12 2005 "C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
53248 Feb 23 2005 "C:\Program Files\CyberLink\PowerDVD\bak\DVDLauncher.exe"
606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\quickset.exe"
53248 Sep 14 2004 "C:\Program Files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe"
122941 May 31 2005 "C:\WINDOWS\system32\dla\tfswctrl.exe"
122941 May 31 2005 "C:\Program Files\Sonic\DLA\install\tfswctrl.exe"
122941 May 31 2005 "C:\WINDOWS\system32\dla\bak\tfswctrl.exe"
81920 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe"
221184 Jul 27 2004 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\ISUSPM.exe"
102400 Apr 8 2005 "C:\Program Files\epson\Creativity Suite\Event Manager\bak\EEventManager.exe"
970752 Feb 21 2007 "C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe"
385024 Oct 30 2004 "C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe"
32881 Nov 19 2003 "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
36975 Aug 26 2005 "C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe"
36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\bak\jusched.exe"
192512 Apr 23 2004 "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\bak\USBTip.exe"

end of report
CandyK is offline   Reply With Quote
Old 4 Weeks Ago   #10
Senior Security Analyst
 
Pancake's Avatar
 
Join Date: Jun 2006
Location: Victoria, Australia
Posts: 6,867
PC Experience: Elite PC Guru
Default Re: Search links hijacked and go to wrong sit

Can you run it again and use option 3.For some reason they failed to be fixed...
__________________
  • An Australian Member of
  • and
My real name is Eddy
Pancake is offline   Reply With Quote
Old 3 Weeks Ago   #11
Bronze Member
 
CandyK's Avatar
 
Join Date: Oct 2009
Posts: 18
PC Experience: Some Experience
Default Re: Search links hijacked and go to wrong sit

I ran it again and here's the log.


Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully
The current date is: Sun 10/25/2009
The current time is: 10:02:10.07

bak folders found
~~~~~~~~~~~

Directory of C:\PROGRA~1\MSNMES~1\BAK
0 File(s) 0 bytes
Directory of C:\WINDOWS\SYSTEM32\BAK
03/10/2004 03:26 PM 406,016 PSDrvCheck.exe
1 File(s) 406,016 bytes
Directory of C:\PROGRA~1\DELL\QUICKSET\BAK
03/04/2005 12:26 PM 606,208 quickset.exe
1 File(s) 606,208 bytes

Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~
406016 Mar 10 2004 "C:\WINDOWS\system32\PSDrvCheck.exe"
406016 Mar 10 2004 "C:\WINDOWS\system32\bak\PSDrvCheck.exe"
606208 Mar 4 2005 "C:\Program Files\Dell\QuickSet\bak\quickset.exe"

end of report
CandyK is offline   Reply With Quote
Old 3 Weeks Ago   #12
Senior Security Analyst
 
Pancake's Avatar
 
Join Date: Jun 2006
Location: Victoria, Australia
Posts: 6,867
PC Experience: Elite PC Guru
Default Re: Search links hijacked and go to wrong sit

Ok.Still these last two to fix..

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\bak
C:\Program Files\Dell\QuickSet\bak

Double-click on the FindAWF.exe file to run it.
It will open a command prompt and ask you to "Press any key to continue".
Select option 3 from the menu and press Enter.
Press any key to continue.
A Notepad document FindAWF.txt will appear with instructions to click below the line and paste the list of folders to be removed.
Right click below this line and select Paste, to paste the list of folders copied to the clipboard earlier. Save and close the document.
The program will proceed to remove the bak folders and will perform another scan for bak folders.
It may take a few minutes to complete so be patient.
__________________
  • An Australian Member of
  • and
My real name is Eddy
Pancake is offline   Reply With Quote
Old 3 Weeks Ago   #13
Bronze Member
 
CandyK's Avatar
 
Join Date: Oct 2009
Posts: 18
PC Experience: Some Experience
Default Re: Search links hijacked and go to wrong sit

Okay. All done. Here's the log. Now what?


Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully
The current date is: Sun 10/25/2009
The current time is: 19:33:40.95

bak folders found
~~~~~~~~~~~

Directory of C:\PROGRA~1\MSNMES~1\BAK
0 File(s) 0 bytes

Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

end of report
CandyK is offline   Reply With Quote
Old 3 Weeks Ago   #14
Bronze Member
 
CandyK's Avatar
 
Join Date: Oct 2009
Posts: 18
PC Experience: Some Experience
Unhappy Re: Search links hijacked and go to wrong sit

I tried another google search and still get redirected to ad sites.
CandyK is offline   Reply With Quote

Reply


Bookmarks

Tags
hijacked, links, search, sites, wrong
Similar discussions...
Thread Thread Starter Forum Replies Last Post
Pending: Search Links Hijacked sirwinador [Pending] HJT Logs 7 08-24-2009 06:58 AM
Pending: Google links sending me to the wrong sites. Windmill [Pending] HJT Logs 5 05-28-2009 05:02 AM
Fixed: Search results links are hijacked!! jaelliott04 [Fixed] Hijackthis! Logs 11 05-02-2009 07:09 PM
Google search links hijacked masecase [Fixed] Hijackthis! Logs 5 11-27-2008 09:27 PM
Links from search results redirect to other sites. hoff0839 [Fixed] Hijackthis! Logs 7 09-19-2008 11:38 PM

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are On




All times are GMT. The time now is 06:25 AM.
Powered by vBulletin
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.3.2