Google and Yahoo searches redirect to a blank page

By TimJFowler
Dec 29, 2009
Topic Status:
Not open for further replies.
  1. Hello all,

    I'm working on a WinXP pc that is being redirected to a blank page for Google and Yahoo searches. I've run Malwarebytes and HiJack This and attached the most recent log files. I have also flushed DNS and reset the DSL modem (no router).

    I appreciate any help you can offer.

    Thanks in advance,
    Tim
  2. TimJFowler

    TimJFowler Newcomer, in training Topic Starter

    Am I missing anything?

    I removed / fixed the obvious "O1 - Hosts: 78.159.110.41 ...." entries
    and the "R3 - URLSearchHook: (no name) ... " entry.

    So, the redirect problem appears to be fixed.

    But, there are a few things in the HijackThis log I'm not sure about. I've attached the most recent log file and would appreciate another opinion.

    Thanks again,
    Tim
  3. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Welcome to TechSpot Tim. I'll help with the malware.

    But you are both ahead of me and behind me! HijackThis entries shouldn't be removed until your helper tells you which ones to remove. That's ahead of me. Behind is the lack of the Superantispyware log.

    There is still a Norton service running: Norton Removal Tool and save it to your desktop. Don't run it yet.

    Please temporarily disable Tea Timer. It is Real Time Protection and can interfere with the scans:
    Spybot Search & Destroy TeaTimer
    • Right click the TeaTimer icon in the system Tray [​IMG]
    • Then click Exit Spybot-S&D Resident
    • (One you are clean you can restart TeaTimer by going to C:\Program Files\Spybot - Search & Destroy, and double clicking on TeaTimer.exe
    You have a Rogue Spyware program. > Spyware Cleaner.The removal is optional, but strongly suggested for the following reasons:
    • They use deceptive means to get the user to buy their program
    • The programs give 'false positives' meaning an entry is presented as 'bad' when is usually is not.
    • Their scanning techniques are not thorough and their databases may not be current.
    • There is no privacy policy
    • See SpywareWarrior for specifics.
    Please reopen HijackThis to 'do system scan only.' Check the following if present:

    O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot>> Rogue Spyware

    Close all Windows except HijackThis and click on "Fix Checked."

    Boot into Safe Mode
    • Restart your computer and start pressing the F8 key on your keyboard.
    • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

    Show hidden files and folders
    • Control Panel> Folder Options> View tab
    • Check 'show hidden files and folders'
    • Uncheck 'hide system and protected files- Recommended
    • Click on Apply> OK

    Go to Add/Remove Programs in the Control Panel and uninstall Spyware Cleaner

    Using Windows Explorer go to Local Drive (C)> Programs> delete the Spyware Cleaner folder.

    Rehide the files and folders.Empty the Recycle Bin
    Double click on the Norton removal setup and run it.

    Rescan with HJT and leave new log.

    Recap:
    1. Download Norton removal Tool
    2. Disable TeaTimer
    3. ScSuperantispywareispyware
    4.Remove Rogue Spyware
    5. Run Norton Removal HijackThis
    jackThis
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.