Google search results re-directed

[Poppa Bear]

I am helping fix a friend's computer. Every time he runs a Google search and opens a search result it is re-directed to another site, other than the search results.

If he runs bing search engine, it works fine. It's only Google that causes the re-direct.

I have read the Techspot posts on this problem and taken the following actions:

1. Run anti-virus, anti-spy and malicious software removal programs as directed in cleaning guide.

2. Super Antispyware found two browser hijacking programs which were quarantined and deleted totally.

The browser is Internet Explorer 8 on OS WinXP Home, with all available Microsoft updates installed, including SP3.

The details of the hijack software removed were listed in Super Antispyware log as follows:

Browser Hijacker.Internet Explorer Zone Hijack

HKU\S-1-5-21-507921405-562591055-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\is-software-download25.com

HKU\S-1-5-21-507921405-562591055-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\is-software-download25.com#http

Can anyone offer any suggestions short of formatting and re-loading OS?

Update: Problem resolved.

I ran "HiJack This" and discovered about 15 Google entries with re-direct web addresses. Selected them all and clicked: "Fix Checked".

It warned it would repair or delete them. Clicked OK and they were all deleted.

Happy ending. IE8 now works perfectly.

Techspot originally put me onto Hihack This, so thanks Techspot.

Cheers PB

 

[Bobbye]

I would be more comfortable seeing a current HijackThis log and getting an online AV scan before I said fixed.

As for TechSpot 'putting you on to HijackThis'> yes we do ask that you run it after running Malwarebytes and Superantispyware. And then we tell you which entries need to be removed in the HJT log and if any special additional things need to be done. An example of this would be a DNS Changer malware infection.

There is a reason we call it Preliminary Removal Instructions

If you're satisfied, okay. But that is not a path I would recommend. We need to see the logs to known what we're working with.

 

[Poppa Bear]

To Bobbye, re:

If you're satisfied, okay. But that is not a path I would recommend. We need to see the logs to known what we're working with.

Sorry about that. Point taken.

Unfortunately the young guy I was helping needed his PC back in a hurry to get high school assignments finished this weekend, so had to do a pre-emptive strike. I had an Acronis back-up image if things went pear shape. When he first brought his PC to me, it wouldn't run at all. Eventually had to run the Windows installation disc, and repair existing OS. This allowed me in, then removed about 53 odd viruses, trojans and adware. However, after doing this post, ran out of time.

Re:

HijackThis'> yes we do ask that you run it after running Malwarebytes and Superantispyware

I actually did run HJT after running MWB & SAS. The log shown in my original post is the one from Super Antispyware, not from HJT.

To cover all bases, next time I see him I'll try to get an HJT log of current status of his PC.

Cheers PB