Solved Google Redirect - Logs?

Status
Not open for further replies.
h t t p://seek.org.in/?ws=dogs ( Dogs was used as an example in the search, and it took me there for some reason.)

Along with h t t p://search.6topsearches.com/feed?query=cats&at=sb&pop=1&rs_tmp=resultsFourth01&count=10&rs_l=http%3A%2F%2Fwww.6topsearches.com%2F&rs_tmp=&par=16066&subid=11561&search=search

iexplore went to those two websites, and one called h t t p://itcg.18685.asklots.com/jump2/?affiliate=itcg&subid=18685&terms=dogs

It seems to happen in each browser, Mozilla/Firefox usually blocks the redirection but I still have to x out of the tab/screen.
 
Download HostsXpert ( http://www.majorgeeks.com/Hoster_d4626.html ) and then follow the steps below:

* Unzip HostsXpert.zip
* It will create a folder named HostsXpert in whatever folder you extract it to.
* Run HostsXpert.exe by double clicking on it.
* click Restore MS Hosts File and then click OK.
* Click the X to exit the program

Restart computer.
 
I followed all of that and after the reboot, I opened Netscape and typed in "cats" into google. Usually the first two-three links are wikipedia sites, but they brought me to a combination of these instead.. ( Happens in every browser, except Mozilla/Firefox usually blocks the redirect and asks if you want to allow it or not.)


h ttp://seek.ind.in/dr.php?id=221dc901d74af05a76a6fe38e6b04732


h ttp://seek.ind.in/?ws=cats


h ttp://www.mydealmatch.com/us/deus2/search44.php?keyword=flea_control_cat&clickid=AC449FA0-112D-4A60-B448-DD4AAE6F7F02


h ttp://clickseekonline.com/search.php?q=cats


h ttp://freefinderonline.info/search.php?q=cats
 
Please, delete your GMER file and....

Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
Do NOT use the computer while GMER is running!
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.
 
Nothing there.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  1. Please, never rename Combofix unless instructed.
  2. Close any open browsers.
  3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  4. Double click on combofix.exe & follow the prompts.
  5. When finished, it will produce a report for you.
  6. Please post the "C:\ComboFix.txt" .
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
 
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code: 
File::
c:\windows\system32\dbaf.sys


Folder::
c:\program files\SystemGuards.com


Driver::
dbaf
sgSchedulerService

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebSavingsfromEbates]

RegLockDel::


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif



5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
 
Tried about 5 links in each browser and none of them redirected. Should I try rebooting the computer and trying it then? Cause it's done this before, looked as though it was working, then all of a sudden it was back all over again in full-swing.
 
After reboot, I tried all three browsers and clicked multiple links and there was no redirect.

Seems like you cleansed this computer of its demons, for now =P It's been a long week, my friend, thanks for all the help. Hopefully we won't have to meet again ( no offense! )
 
I'm glad to hear good news (finally) :)

One last step, you need to perform....


Your computer is clean

1. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.
 
Downloaded WOT, haven't used the internet enough to see how useful it is, but it looks like a decent add-on.

So far so good, I believe, but if something stirs up, could I let you know? I've seen how busy this forum can be so it'll be at your most convieniant time! Thanks for all the help!
 
Status
Not open for further replies.

Similar threads

D
Google, Apple, Microsoft and Mozilla release Speedometer 3.0 to benchmark browser performance
Replies
10
Views
278
Madbiker1960
M
A
A single company asked Google to delist almost one billion "pirate" web pages in less...
Replies
1
Views
394
Aus spot
A
AlphaX
Google reveals the next step in its war on ad blockers: slower extension updates
2
Replies
47
Views
996
ThatTechDude
T

Latest posts

Back