Is Machine infected or not?

I have a customer who's machine occasionally will redirect to unwanted websites.

It only does this sometimes and only whem click on link from search enginge page (e.g google or yahoo). Can click on link 3 times goes to right page, click on link again goes to unwanted webbsite. Try again goes to expected website.

Have run Malwarebytes and Super Anti Spyware both say nothing found.
Have run HJT log doesn't seem to show anything wrong.

Have tried in both IE and Firefox does the same.

If type url directly into address bar always seems to go direct to expected website.
If done from websearch then will go to expected website say 60-70% of time otherwise will go to unexpected site.

Any ideas please as at loss as what may be causing problem and only remedy would appear to be complete clean install of Windows.

Running WinXP sp3.

I had this infuriating thing last year. Try http://housecall.trendmicro.com/uk/ which did the trick for me, it found some bit of adware which popped up its unwanted page at intervals, and quarantined it for me. I think Kaspersky offers an online scan as well. Hope this helps!

Installing Javacool's SpywareBlaster may stop the redirects from loading but won't cure the infection.
Superantispyware should be run in Safe Mode for greatest effectiveness.
Also try the updated A-Squared and Trojan Remover in Safe Mode.

Edited by Deadbeat (Wed 05-May-10 21:37:46)

This is probably not his/her machine that is infected, rather the particular website has been hacked into. The hackers modify the site so that if you visit it from a search engine link you are redirected to the rogue site. If you type in the address directly you get the proper site. These hacks were well publicised on the web a few months ago. I am not sure why it sometimes redirects and sometimes doesn't, maybe the hackers are getting clever and putting some sort of randomnisation into their code...

But don't try and look for infections on his machine, it is in all likelihood clean.

I had a major, major problem and had to finally use ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-... running in safe mode. I had to run it four times to finally clear everything. These were items missed by McAfee, Malwarebytes and others. It was Malwarebytes that suggested it and checked the CombiFix logs for me.

Problem is, is more than one website it happens with
so can't believe that every site that has been tried would of been hacked