[leroj]

I'm having an issue with Firefox redirecting my google search results to malicious sites. I use the latest patches of WinXPSP3. It appears to have started when a rogue PDF crashed- I tried to control-alt-delete it but the damage was done.

Spybot and Ad-aware don't find anything.

BitDefender's online scan found:

C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll

Infected with: Trojan.Patched.EM

C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll

Disinfection failed

C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll

Deleted

C:\WINDOWS\SYSTEM32\DLLCACHE\ws2_32.dll

Infected with: Trojan.Patched.EM

C:\WINDOWS\SYSTEM32\DLLCACHE\ws2_32.dll

Disinfection failed

C:\WINDOWS\SYSTEM32\DLLCACHE\ws2_32.dll

Deleted

C:\WINDOWS\SYSTEM32\ws2_32.dll

Infected with: Trojan.Patched.EM

C:\WINDOWS\SYSTEM32\ws2_32.dll

Disinfection failed

C:\WINDOWS\SYSTEM32\ws2_32.dll

Delete failed

I'm a bit concerned that it's deleting this file which I presumably need rather than replacing it with a clean copy. My problem appears very similar to this one: http://www.spywarein...?...24353&st=30
Can anyone advise me on the steps to take to remove this from my computer and get a good copy of ws2_32.dll?

Hi,

Help us help you.

Please read this article and follow the protocol.
http://spywareinfofo...showtopic=23382
Then submit a fresh HijackThis log. One of our helpers will take care of you. It's the only way we can give you sound advice.

This post has been edited by nasdaq: 12 July 2009 - 08:38 AM
Reason for edit:: HijackThis log requested.

[miekiemoes]

Hi,

* Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingc...to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

[TheJoker]

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please tell the moderating team by replying here with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.