IE7/8 being redirected

I have a computer here that got several trojans(antivirus2009 and
antispywarexp2009) on the 30th. I have removed them and also downloaded
OneCare to finish removing what I could not find.

Several web addresses will not work or will be redirected to unrelated sites
now. I already checked the hosts file, its clean. I also checked the registry
entry that points to it. I removed several IE add-ons and replaced them. I
installed IE8b2. I reset IE. OneCare tells me the computer is missing several
updates, but I am unable to visit update.microsoft.com(redirected to
localhost 127.0.0.1) and can not access any downloads from the microsoft
download center. The network diagnostic tool tells me that FTP is not
working. Sites like norton.com redirect me to shopping sites.

Obviously I missed something. This is the 3rd computer I have worked on in
the last week that had these trojans and I ended up reinstalling windows on
the first 2 which was a bear due to ms licensing practices. Please help.

Looks like your computer is still infected.
---
Leonard Grey
Errare Humanum Est

nectaris wrote:
> I have a computer here that got several trojans(antivirus2009 and
> antispywarexp2009) on the 30th. I have removed them and also downloaded
> OneCare to finish removing what I could not find.
>
> Several web addresses will not work or will be redirected to unrelated sites
> now. I already checked the hosts file, its clean. I also checked the registry
> entry that points to it. I removed several IE add-ons and replaced them. I
> installed IE8b2. I reset IE. OneCare tells me the computer is missing several
> updates, but I am unable to visit update.microsoft.com(redirected to
> localhost 127.0.0.1) and can not access any downloads from the microsoft
> download center. The network diagnostic tool tells me that FTP is not
> working. Sites like norton.com redirect me to shopping sites.
>
> Obviously I missed something. This is the 3rd computer I have worked on in
> the last week that had these trojans and I ended up reinstalling windows on
> the first 2 which was a bear due to ms licensing practices. Please help.

You have much more work to do.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjunction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

nectaris wrote:
> I have a computer here that got several trojans(antivirus2009 and
> antispywarexp2009) on the 30th. I have removed them and also downloaded
> OneCare to finish removing what I could not find.
>
> Several web addresses will not work or will be redirected to unrelated
> sites
> now. I already checked the hosts file, its clean. I also checked the
> registry entry that points to it. I removed several IE add-ons and
> replaced
> them. I installed IE8b2. I reset IE. OneCare tells me the computer is
> missing several updates, but I am unable to visit
> update.microsoft.com(redirected to localhost 127.0.0.1) and can not access
> any downloads from the microsoft download center. The network diagnostic
> tool tells me that FTP is not working. Sites like norton.com redirect me
> to
> shopping sites.
>
> Obviously I missed something. This is the 3rd computer I have worked on
> in
> the last week that had these trojans and I ended up reinstalling windows
> on
> the first 2 which was a bear due to ms licensing practices. Please help.