1 Reply Latest reply on Sep 18, 2010 8:41 PM by johnnydoc

    After google search, I click on a link and am redirected to ad sites.

      When I get search results and then click on a link I am taken to random different sites.  Can anyone help?  I am running McAfee.  I ran RootRepeal and go the following:

      ROOTREPEAL (c) AD, 2007-2009
      ==================================================
      Scan Start Time:  2010/02/14 09:57
      Program Version:  Version 1.3.5.0
      Windows Version:  Windows XP SP3
      ==================================================

      Drivers
      -------------------
      Name: abc123.sys
      Image Path: C:\WINDOWS\system32\drivers\abc123.sys
      Address: 0xEEA73000 Size: 49152 File Visible: No Signed: -
      Status: -

      Name: dump_iastor.sys
      Image Path: C:\WINDOWS\System32\Drivers\dump_iastor.sys
      Address: 0xB3190000 Size: 872448 File Visible: No Signed: -
      Status: -

      SSDT
      -------------------
      #: 041 Function Name: NtCreateKey
      Status: Hooked by "PCTCore.sys" at address 0xf729fe52

      #: 047 Function Name: NtCreateProcess
      Status: Hooked by "PCTCore.sys" at address 0xf7280cde

      #: 048 Function Name: NtCreateProcessEx
      Status: Hooked by "PCTCore.sys" at address 0xf7280ed0

      #: 063 Function Name: NtDeleteKey
      Status: Hooked by "PCTCore.sys" at address 0xf72a0640

      #: 065 Function Name: NtDeleteValueKey
      Status: Hooked by "PCTCore.sys" at address 0xf72a08f4

      #: 119 Function Name: NtOpenKey
      Status: Hooked by "PCTCore.sys" at address 0xf729eb44

      #: 192 Function Name: NtRenameKey
      Status: Hooked by "PCTCore.sys" at address 0xf72a0d60

      #: 247 Function Name: NtSetValueKey
      Status: Hooked by "PCTCore.sys" at address 0xf72a0112

      #: 257 Function Name: NtTerminateProcess
      Status: Hooked by "PCTCore.sys" at address 0xf7280984

      ==EOF==