Ok, my homepage is on the usual "www.google.com" and resently i downloaded the new AVG 8.0. After that everytime i click on Firefox it opens up a completly different website... It's called "RoyalOrchidClub.com" The URL is "www.google.com" but the page is not When i refresh it's ok, and returns back 2 Google lol.

I checked my Firefox options and my homepage is on "www.google.com".
I've done virus scans with Adaware, spybot, AVG and malwarebytes (on safe mode) and nothing has shown up lol...

Can anyone help??????

Attached Files

hijackthis.log (6.0 KB, 5 views)

Delete:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =


I would also get rid of:

R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll



Then reboot and run HJT again.

kk done that, heres the new log.

Attached Files

hijackthis.log (5.3 KB, 1 views)

I can't offhand see anything else BUT I wonder why you are running SpywareGuard AND ad-Aware 2007 at the same time.

I am NOT familiar with these:

O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

but if you know what they are and are happy then so be it.

Are you still getting redirected?

Oh ok. Umm yeah I still am.

In Internet Explorer use the 'reset to defaults' option and reboot.

kk. It didn't do anything

I don't use IE7 but in the Tools menu does it show what you use for a homepage and can you change that?

Yeah i can. But the problems with firefox :P

Well, your HJT log shows IE7.

I don't use Firefox so you'll have to either wait for someone that does or do some research.

Sorry.

edit: you did say 'everytime i click on Firefox' but I missed that - there has to be a similar method of looking at the homepage selection in FF and resetting it.

ok man, thanks for your help

it is almost exactly the same Tools -> Options -> main tab

can't find it :\

kk, problem still there.

NOT FOUND

The requested URL/firefox was not found on this server.

Apachel2.2.3(CentOS)Server at en-us.start2.mozilla.com port 80
---------------------------------------------------------------------------------
It works fine when i refresh it...

Download and Run ATF Cleaner
Download ATF Cleaner by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox or Opera:
Click Firefox or Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

------------------------------------------------------

Manually clear cache

• Open an Explorer folder window (for example, double-click My Computer).
• From the Explorer menu select Tools | Folder Options | View. Make sure that you have checked the box next to "Show hidden files and folders" and uncheck "Hide protected operating system files".
• Start Internet Explorer and click Tools | Internet Options | General tab | Settings | View Files.
• IE should have opened up a folder window, typically viewing a folder with the name of C:\Windows\Temporary Internet Files. Put your cursor in the Address area of the folder window and add the name \content.ie5 to the name, so in our example the Address bar would now read c:\Windows\Temporary Internet Files\content.ie5.
• You should see a series of folders with random eight-character names like ADOZMZS1. Delete each of these randomly named folders. You may get an error that some files are in use, this is normal if you are currently at a web site since those files are in the cache. Hold down the Shift key when deleting the files so they do not go to the Recycle Bin.

-------------------------------------------------------------------------

Let us know if this does the trick

Did all that... Problem still there

Have you tried going to another site and then making that your default homepage? Try http://www.google.ca/