This started two days ago, and I'm not sure why. It's similar to the winshield2009.com browser hijack except it only kicks on when I get search results via Google, Bing, etc and click on a result.
If I type a domain name in, it doesn't affect anything. Here's an example of what is happening:
I use google to search "z43523673.cn"
Google returns results (this forum being one of the first) so I click on it. I get redirected to a page URL starting with z43523673.cn, and sometimes it stops there as an undeliverable page. Other times it may cycle through several URLs before landing on a final page. I just did this again and here's where I ended up:
It's apparently hijacking the browser to generate clicks to its affiliates. Real scumbags must be running this thing.
Things I've tried:
MalwareBytes - Runs it course, finds issues, cleans them, but the problem remains.
HijackThis - same as MalwareBytes
I realize this is a pretty new thing, and help may not come for a while, but I would like to avoid a complete reformat. Any help would be greatly appreciated.
Edited by Orange Blossom, 08 June 2010 - 08:25 PM.
Deactivate links. ~ OB