BleepingComputer.com: I suspect I have google redirect virus?

Alright so I think I have the google redirect virus as... well, my google redirects to a bunch of sites I didn't click on. For a while Firefox was working, but out of nowhere the internet just kind of cut out on all of my browsers even though the connection was fine so I think maybe the sites were getting blocked. I restarted and am still being redirected but the net works now. Oh and I noticed that the computer is somewhat slower in general.

I've seen a lot of mixed results on this such as "try this antivirus!" or "try this scan!" and I'd really rather not mess up the computer any more than it already has possibly been.

One thing I've already tried is running a full system scan with Norton which returned no results. I know a lot of people will say "switch antiviruses Norton is bad and got you here in the first place" but the damage has been done so, that's kind of irrelevant at this point. Plus, that is not my choice really.

Another thing I heard recommended was checking the "hosts" file in system32 and I did find an extra entry there that was never there before so I removed it. It had no effect, though.

The third and last thing I did so far was trying to run Kapsersky(spelling?) TDSSkiller which has fixed this for a lot of people but it scanned and found no errors.


So... what can I do here? Am I even talking about the right virus...? Btw, my computer's OS is Vista.


UPDATE WITH MORE INFO:

I am redirected every single time I click on something from google, and I think the virus is trying to block this site because often it makes me refresh multiple times before it connects. This is the error Chrome gives me:

No data received
Unable to load the web page because the server sent no data.
Here are some suggestions:
Error 324 (net::ERR_EMPTY_RESPONSE): The server closed the connection without sending any data.


Oh yes, and in the bottom of chrome that shows what webpage it is loading, it says "Waiting for 30ksearches.com". So i guess that's what it's redirecting to/through

This post has been edited by xJenniex: 27 June 2011 - 09:48 PM

Oh yeah and I am redirected every single time I click on something from google, and I think the virus is trying to block this site because often it makes me refresh multiple times before it connects. This is the error Chrome gives me:

No data received
Unable to load the web page because the server sent no data.
Here are some suggestions:
Error 324 (net::ERR_EMPTY_RESPONSE): The server closed the connection without sending any data.


Oh yes, and in the bottom of chrome that shows what webpage it is loading, it says "Waiting for 30ksearches.com". So i guess that's what it's redirecting to/through.

This post has been edited by xJenniex: 27 June 2011 - 09:48 PM

Hello and welcome. Are you on a router?
Are other machines on it,if so so yjey rediect?

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Ensure all Firefox windows are closed.
  
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
  
• When prompted to run the scan, click Yes.
  
• GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

I believe you will need to run SFC to correct the errors.

Please run SFC (System File Checker)
Please run System File Checker sfc /scannow... For more information on this tool see How To Use Sfc.exe To Repair System Files

NOTE for Vista/WIN 7 users..The command needs to be run from an Elevated Command Prompt.Click Start, type cmd into the Start/Search box,
right-click cmd.exe in the list above and select 'Run as Administrator'


You will need your operating system CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the CD when asked.

boopme, on 27 June 2011 - 10:01 PM, said:

Alright, this is what the log from GooredFix found.. don't ask why it took so many tries, I closed them on accident..

GooredFix by jpshortstuff (03.07.10.1)
Log created at 23:29 on 27/06/2011 (Jennifer)
Firefox version 5.0 (en-US)

========== GooredScan ==========


========== GooredLog ==========

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [22:06 27/06/2011]
{B9B81A55-9C8B-4FD5-B140-714613DED7B6} [02:19 23/10/2010]
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [15:16 30/08/2009]
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [12:19 10/11/2009]
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} [22:04 28/01/2010]
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [21:11 16/08/2010]
{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [03:38 22/08/2010]
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [00:24 17/10/2010]
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [13:53 09/03/2011]
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [19:11 11/06/2011]

C:\Users\Jennifer\Application Data\Mozilla\Firefox\Profiles\98ejq6tq.default\extensions\
imageblock@hemantvats.com [16:47 14/11/2010]
{437c4386-9237-441f-a940-009430030ee0} [22:08 27/06/2011]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [22:17 29/07/2009]
"{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\" [21:25 26/04/2010]
"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}"="C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video" [22:28 17/12/2010]
"{6904342A-8307-11DF-A508-4AE2DFD72085}"="C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa" [22:28 17/12/2010]

---------- Old Logs ----------
GooredFix[03.21.54_28-06-2011].txt
GooredFix[03.22.12_28-06-2011].txt
GooredFix[03.27.25_28-06-2011].txt

-=E.O.F=-

This post has been edited by xJenniex: 27 June 2011 - 10:29 PM

This is a basic connection with a router. Modem to router to PC. You do not need a router and appears you do not As you are the on;y PC.

http://www.pc-chop-shop.com/images/connect-wireless-router-01_1_11.gif

That said.

If still redirecting>>>

Change your DNS Servers:

• Go to > Run... and in the open box, type: cmd
  
• Press OK or Hit Enter.
  
• At the command prompt, type or copy/paste: ipconfig /flushdns
  
• Hit Enter.
  
• You will get a confirmation that the flush was successful.
  
• Close the command box.

If the above commands did not resolve the problem, the next thing to try is to reset your network settings and Configure TCP/IP to use DNS.

• Go to > Control Panel, and choose Network Connections.
  
• Right-click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and and choose Properties.
  
• Double-click on Internet Protocol (TCP/IP) or highlight it and select Properties.
  
• Under the General tab, write down any settings in case you should need to change them back.
  
• Select the button that says "Obtain an IP address automatically" or make sure the DNS server IP address is the same as provided by your ISP.
  
• Select the button that says "Obtain DNS servers automatically".
  
• If unknown Preferred or Alternate DNS servers are listed, uncheck the box that says "Use the following DNS server address".
  
• Click OK twice to get out of the properties screen and restart your computer. If not prompted to reboot go ahead and reboot manually.

-- Vista users can refer to How to Change TCP/IP settings

CAUTION: It's possible that your ISP (Internet Service Provider) requires specific DNS settings here. Make sure you know if you need these settings or not BEFORE you make any changes or you may lose your Internet connection. If you're sure you do not need a specific DNS address,
then you may proceed.

I tried going through changing the TCP/IP but I already had all of those settings checked off there... would anything have changed?

edit:
Also, we do not have the disc for our operating system, the computer is refurbished and it came with Vista.

This post has been edited by xJenniex: 27 June 2011 - 10:40 PM

Ok, I understand,, If this is still redirecting then we need our malware team to find the the files to remove and they will have to find and switch things for you. We cannot do that here in this section..

Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.

Alright, I have posted the thread here, thanks!