Google will not load in any browser

I have a machine that will not load google.com at all and has issues with running searches on Bing.com and Yahoo.com. I run Microsoft Forefront Security on the machine, but there are no virus' found.

I have a scary feeling this is something along the lines of the google redirect malware.

If you can offer any help in the matter it will be greatly appreciated.

Download Minitoolbox from this link and post the results in a reply to this topic here, do not create a new topic as the guide says.

http://www.bleepingcomputer.com/forums/topic398507.html

Thank you. I'll get right on that!

The Computer is a Dell Optiplex GX520 wired into the network.

Router is Netear FVG318

The internet connection is cable.

Here is my result.txt


MiniToolBox by Farbar Version: 18-01-2012
Ran by kpupeza (administrator) on 30-04-2012 at 07:24:24
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.
========================= Hosts content: =================================

127.0.0.1 localhost

========================= IP Configuration: ================================

Broadcom NetXtreme Gigabit Ethernet = Local Area Connection (Connected)


# ----------------------------------
# Interface IP Configuration
# ----------------------------------
pushd interface ip


# Interface IP Configuration for "Local Area Connection"

set address name="Local Area Connection" source=dhcp
set dns name="Local Area Connection" source=dhcp register=PRIMARY
set wins name="Local Area Connection" source=dhcp


popd
# End of interface IP configuration




Windows IP Configuration



Host Name . . . . . . . . . . . . : PDWorkstation07

Primary Dns Suffix . . . . . . . : paperdepotinc.loc

Node Type . . . . . . . . . . . . : Hybrid

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : paperdepotinc.loc



Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet

Physical Address. . . . . . . . . : 00-14-22-24-F6-35

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 192.168.0.108

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.1

DHCP Server . . . . . . . . . . . : 192.168.0.10

DNS Servers . . . . . . . . . . . : 192.168.0.10

Lease Obtained. . . . . . . . . . : Monday, April 30, 2012 7:20:37 AM

Lease Expires . . . . . . . . . . : Tuesday, May 08, 2012 7:20:37 AM

Server: pdserver01.paperdepotinc.loc
Address: 192.168.0.10

Name: google.com
Address: 87.125.87.103



Pinging google.com [87.125.87.103] with 32 bytes of data:



Reply from 87.125.87.103: bytes=32 time=128ms TTL=41

Reply from 87.125.87.103: bytes=32 time=125ms TTL=41



Ping statistics for 87.125.87.103:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 125ms, Maximum = 128ms, Average = 126ms

Server: pdserver01.paperdepotinc.loc
Address: 192.168.0.10

Name: yahoo.com
Addresses: 98.139.183.24, 209.191.122.70, 72.30.38.140



Pinging yahoo.com [98.139.183.24] with 32 bytes of data:



Reply from 98.139.183.24: bytes=32 time=140ms TTL=46

Reply from 98.139.183.24: bytes=32 time=81ms TTL=46



Ping statistics for 98.139.183.24:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 81ms, Maximum = 140ms, Average = 110ms

Server: pdserver01.paperdepotinc.loc
Address: 192.168.0.10

Name: bleepingcomputer.com
Address: 208.43.87.2



Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:



Reply from 208.43.87.2: Destination host unreachable.

Reply from 208.43.87.2: Destination host unreachable.



Ping statistics for 208.43.87.2:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms



Pinging 127.0.0.1 with 32 bytes of data:



Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 14 22 24 f6 35 ...... Broadcom NetXtreme Gigabit Ethernet - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.108 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.108 192.168.0.108 20
192.168.0.108 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.0.255 255.255.255.255 192.168.0.108 192.168.0.108 20
224.0.0.0 240.0.0.0 192.168.0.108 192.168.0.108 20
255.255.255.255 255.255.255.255 192.168.0.108 192.168.0.108 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None

========================= Event log errors: ===============================

Application errors:
==================
Error: (04/27/2012 04:52:18 PM) (Source: JavaQuickStarterService) (User: )
Description: Could not register service with the service manager: StartServiceCtrlDispatcher failed (error 1063)

Error: (04/27/2012 01:38:09 PM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks: Premier Retail Edition 2009":
Trying to process a record 58 : Cash Wells Fargo Checking for List Review edlist without actually being in a write transaction

Error: (04/27/2012 01:29:13 PM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks: Premier Retail Edition 2009":
Trying to process a record 58 : Cash Wells Fargo Checking for List Review edlist without actually being in a write transaction

Error: (04/27/2012 11:51:39 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks: Premier Retail Edition 2009":
QBDBPF Log GetServerPort failed ip 192.168.0.10 error 7 extendedError 0

Error: (04/27/2012 11:51:14 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (04/27/2012 11:51:14 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (04/27/2012 11:51:14 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (04/27/2012 11:51:14 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Error: (04/25/2012 03:58:23 PM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks: Premier Retail Edition 2009":
QBDBPF Log GetServerPort failed ip 192.168.0.10 error 7 extendedError 0

Error: (04/25/2012 03:58:06 PM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks: Premier Retail Edition 2009":
QBDBPF Log GetServerPort failed ip 192.168.0.10 error 7 extendedError 0


System errors:
=============
Error: (04/27/2012 10:54:10 AM) (Source: FcsSas) (User: )
Description: Forefront Client Security State Assessment Service policy applied with errors.

Reverted to the following settings:

Schedule Type: Interval
Time: 12
Parameter:

Error: (04/27/2012 09:38:55 AM) (Source: BROWSER) (User: )
Description: The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{89EDF0FC-2637-4B6D-A1F7-31BCF4D03567}.
The backup browser is stopping.

Error: (04/27/2012 09:32:55 AM) (Source: FcsSas) (User: )
Description: Forefront Client Security State Assessment Service policy applied with errors.

Reverted to the following settings:

Schedule Type: Interval
Time: 12
Parameter:

Error: (04/27/2012 07:23:33 AM) (Source: FcsSas) (User: )
Description: Forefront Client Security State Assessment Service policy applied with errors.

Reverted to the following settings:

Schedule Type: Interval
Time: 12
Parameter:

Error: (04/26/2012 00:28:21 PM) (Source: FcsSas) (User: )
Description: Forefront Client Security State Assessment Service policy applied with errors.

Reverted to the following settings:

Schedule Type: Interval
Time: 12
Parameter:

Error: (04/26/2012 00:23:31 PM) (Source: 0) (User: )
Description: 0xC0000001HarddiskVolume1

Error: (04/26/2012 06:43:00 AM) (Source: FcsSas) (User: )
Description: Forefront Client Security State Assessment Service policy applied with errors.

Reverted to the following settings:

Schedule Type: Interval
Time: 12
Parameter:

Error: (04/25/2012 03:27:49 PM) (Source: FcsSas) (User: )
Description: Forefront Client Security State Assessment Service policy applied with errors.

Reverted to the following settings:

Schedule Type: Interval
Time: 12
Parameter:

Error: (04/25/2012 01:55:23 PM) (Source: FcsSas) (User: )
Description: Forefront Client Security State Assessment Service policy applied with errors.

Reverted to the following settings:

Schedule Type: Interval
Time: 12
Parameter:

Error: (04/24/2012 00:01:49 PM) (Source: FcsSas) (User: )
Description: Forefront Client Security State Assessment Service policy applied with errors.

Reverted to the following settings:

Schedule Type: Interval
Time: 12
Parameter:


Microsoft Office Sessions:
=========================

========================= Memory info: ===================================

Percentage of memory in use: 51%
Total physical RAM: 1014.07 MB
Available physical RAM: 493.73 MB
Total Pagefile: 2444.79 MB
Available Pagefile: 1950.38 MB
Total Virtual: 2047.88 MB
Available Virtual: 1971.58 MB

========================= Partitions: =====================================

1 Drive c: () (Fixed) (Total:232.88 GB) (Free:218.03 GB) NTFS
3 Drive e: () (Removable) (Total:3.73 GB) (Free:2.87 GB) FAT32
4 Drive p: (Data) (Network) (Total:67.72 GB) (Free:61.32 GB) NTFS
5 Drive u: (Data) (Network) (Total:67.72 GB) (Free:61.32 GB) NTFS

========================= Users: ========================================

User accounts for \\PDWORKSTATION07

Administrator ASPNET Guest
HelpAssistant Paper Depot SUPPORT_388945a0


**** End of log ****

Open up command prompt (start -> run -> type "cmd" and press enter) and enter the following commands in this order:

ipconfig /flushdns
ipconfig /release
ipconfig /renew

Once done, clear your history and cache in your browser (firefox/ie) and try to load google.com. If that doesn't work, are you able to access Google by going to http://74.125.227.132/ ?

From researching, it appears that the "87.125.87.103" IP that you're getting returned when ping'ing google may be due to malware that was removed from your PC (since you are not complaining about redirects/popup's your anti-virus probably "fixed" the virus problem, but it still left traces behind).

Your host files does not appear to have been hijacked, which is a good thing. But 87.125.87.103 does not appear to be a valid Google IP.

I followed your steps and tried to load google.com but was given the good old Internet Explorer cannot display the webpage.

I am able to access http://74.125.227.132/ so I'm thinking that there is some nasty malware residue blocking the google.com ip request.

Thoughts/suggestions from here?

Go to command prompt and type the following command without quotes:

"nslookup www.google.com"

It should give you an output similar to the following:

C:\Users\Matt>nslookup www.google.com
Server: Router1
Address: 192.168.2.1

Non-authoritative answer:
Name: www.l.google.com
Addresses: 74.125.227.82
74.125.227.81
74.125.227.83
74.125.227.84
74.125.227.80
Aliases: www.google.com

What IP addresses are listed under "Addresses:" for www.google.com (the bolded area) ?


Also, I noticed that you have a default gateway of 192.168.0.1 but your primary DNS server is 192.168.0.10. Are you running your own DNS server? Is this an apartment complex or something similar? If so, I think it's a problem with the DNS server itself.

Any time I have had issues like this on our client's computers, I have had great success fixing it by running TDSSKiller. It's a free download, simple to use and scans very quickly for any issues.

Any time I have had issues like this on our client's computers, I have had great success fixing it by running TDSSKiller. It's a free download, simple to use and scans very quickly for any issues.

Thank you!

I ran TDSSKiller and it has fixed the issue.

Helo. If TDSS found and fixed things I'd suggest two more scans.

Please download aswMBR ( 511KB ) to your desktop.

• Double click the aswMBR.exe icon to run it
• Click the Scan button to start the scan
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

AND

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the icon on your desktop.
• Check
• Click the button.
• Accept any security warnings from your browser.
• Under scan settings, check and check Remove found threats
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the button.
• Push

NOTE: In some instances if no malware is found there will be no log produced.

Glad to hear that cleared up your issue. Boopme is right, since TDSS found something, I would run additional scans to look for any other items.