google search redrect

[pitmonkey]

I have gotten something in my system that is redrecting searches in google. I have used spybot and it has not helped. Also microsoft security essenituals is not working. I have unloaded and reloaded essenituals already. I am running XP.

I just did a bing search and the same thing happened.

[telecom_goddess]

Try ad aware that has caught stuff spybot missed for me before.

[KnowOne]

Another thing to check is if you have a proxy defined. I've seen them added after an infection. Under Internet Properties, Connections, LAN Settings the box for Proxy Server should be unchecked.

[Amadan]

Winsock

Try winsockfix more than likely you've picked up something that's fiddled with your host file. You can tell if you open a command prompt (start, run, cmd) and type

Ipconfig /displaydns

If it gives a load of entries to do with stuff like conduit etc it's the host files.


Best way to clean the machine is boot into safe mode (on startup keep tapping f8 key until you get menu offering safe mode etc) select safe mode with networking. Then use malwarebytes to scan the machine for nasties, keep updating malwarebytes and scanning from safe mode until it's clean and then repeat the process from out with safe mode.

Next remove any toolbars from Internet explorer (add/remove programs) etc and then clean up the registry (ccleaner is good for this).

Check Internet explorer for proxies as discussed above and finally run winsock fix to clear out the hosts etc.

I'm trying to type this with an iPad (damn you autocorrect!) so I'm not able to give you links at the moment but all the tools are linked in the sticky at the top of the forum. Hopefully this should sort you out. If you need anymore info on the above methods just shout.

John


Edit

Forgot to add. Through my day job I end up doing this a lot. Especially to get rid of fake av etc. Personally I would advise you to get a kaspersky or symantec antivirus/Internet security package. They're not expensive and seem to be far more effective than the other common free and paid for packages - especially macafee, shudder!

/edit

[TheSHAD0W]

Under Control Panel, Internet Options, Connections tab:

1. Make sure there are no Dial-up or VPNs configured (unless you specifically know you need one).

2. Click the LAN settings button, make sure "automatic configuration script" and "proxy server" are unchecked. You may also want to uncheck "automatically detect settings"; if that causes you issues you can re-check it.

Directory C:\Windows\System32\drivers\etc:
Examine the file "hosts". It should be mostly empty, with a few comment lines prefixed with a "#". It may say "127.0.0.1 localhost". If it contains entries that point popular websites to a specific IP address, it may have been modified by malware. (If it contains a bunch of entries that have been directed to 127.0.0.1, this is probably security software like Spybot at work.) If it's suspicious, delete it and replace it with an empty text file.

[TheSHAD0W]

Washu-chan: i had a computer.. that was redirecting searches
Washu-chan: on every system
TheSHAD0W: Oh?
Washu-chan: yes
TheSHAD0W: Somebody was having that problem in the customerssuck.com forum...
Washu-chan: the computer was infected
Washu-chan: but
Washu-chan: turns out , the computer had logged into the default router pw's
TheSHAD0W: Ocrap.
Washu-chan: and the router was redirecting DNS

You may have to check that...

[pitmonkey]

I finally got this fixed. I found this site: http://www.bleepingcomputer.com/.