Solved Yahoo redirecting search results, logs included from 8 steps

[amalteaser]

I followed the directions and cleared the cache but still no difference to the redirections.

 

[Broni]

Go Start>Run (Start search in Vista), type in:
cmd
Click OK (in Vista, while holding CTRL, and SHIFT, press Enter).

In Command Prompt window, type in following commands, and hit Enter after each one:
ipconfig /flushdns
ipconfig /registerdns
ipconfig /release
ipconfig /renew
net stop "dns client"
net start "dns client"


Restart computer.

Check for redirection.

 

[amalteaser]

Still getiing redirection but about 1 in 5/10 links now which is a improvement but it hasn't stopped altogether.

 

[Broni]

Your routers DNS settings my have been hijacked.
Please, follow this instructions in attempt to fix the issue: https://store.opendns.com/setup/router/
Once you set your new DNS settings reboot your computer.
Then go to http://opendns.com/welcome/ to see if it is working. If you see a checkmark then you switched to OpenDNS.

 

[amalteaser]

Hi

I did what you asked with the setting and so far that seems to have stopped redirections, Im going to contiue testing it though to make sure its not just cut them down rather than stopped them. My internet also seems to have speed up though i have 20mb so its a little hard to tell but it does seem faster.

If this is what the problem was could you just tell me what is this hijacking of my router dns and was it all so they could redirect me or do they get anything else out of it?

Oh and i can now also update my malware bytes the normal way too!( i just wanted to test the update cause its been bugging me for days they way it suddenly wouldn't work). Before it gave me some connection error line.

 

[Broni]

I have to tell you, this was the one of the most stubborn case I had recently, so I'm glad to see it solved (I hope )

I'll try to explain in simple terms what DNS is.
Every website has a domain name, like www.amazon.com (this is what we, people, remember) and an IP (numeric) address, which in case of Amazon is 207.171.166.48 (this is what your computer knows and remembers).
So, when you type in www.amazon.com, DNS translates it to 207.171.166.48 and your computer knows, it has to go to Amazon site.
Now, some malicious file will go "in between" and when you type www.amazon.com, that malicious file will redirect your computer to some other address, than 207.171.166.48

Normally, when your computer gets finally cleaned, resetting router should straight up all that mess, but in some cases, like yours, it may not be enough to correct the issue.

I hope, I explained it clearly enough

Now, last steps...

OTL Clean-Up
Clean up with OTL:

* Double-click OTL.exe to start the program.
* Close all other programs apart from OTL as this step will require a reboot
* On the OTL main screen, press the CLEANUP button
* Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

======================================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista and 7:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

 

[amalteaser]

Hi,

Thanks for explaining the dns bit (i think i understand it) and thanks for helping sort my problem. I was begining to think i was going to have to reinstall windows which i really didn't want to do. Im glad it didn't turn out to be a virus either as i always thought my computer was fairly virus free until the redirections started.

I did all the cleaning and restarting system restore and got the wot website checker thing which seems good.

Just to let you know the redirection seems to be totally fixed after more testing. It has also seemed to stop redirection on other computers that were connected to my router and having the same problem so all looks good.

 

[Broni]

Way to go!!

Good luck and stay safe