Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


keep getting redirected

  • Please log in to reply
4 replies to this topic

#1 weelizzie


  • Members
  • 3 posts
  • Local time:03:48 AM

Posted 28 September 2010 - 12:49 PM

When I am on the internet and carry out a search on google when I click on a link I sometimes get redirected to another site, usually selling something but also been sent to porn site. I use internet explorer. Now I can't access my email either as get message saying error loading message try again later.

BC AdBot (Login to Remove)


#2 Eraser23


  • Members
  • 28 posts
  • Local time:03:48 AM

Posted 28 September 2010 - 03:54 PM

Can you test something for me.

(1) Click START > RUN > and type in "C:\windows\system32\drivers\etc\hosts"
(2) When prompted, open the HOSTS file in either Notepad or Wordpad

Check the IP addresses at the bottom. Do you have any others, other than " localhost"?

Viruses sometimes will alter your "hosts" file, which is basically a file that controls the redirecting for your browsers. It's just a quick check to see if that's the case, only a little check.

#3 weelizzie

  • Topic Starter

  • Members
  • 3 posts
  • Local time:03:48 AM

Posted 28 September 2010 - 05:02 PM

Hi Eraser. Tried what you suggested. Not very computer literate am afraid. Whole lot of numbers came up but not localhost. Looked at rest of this site and ran malwarebytes. Report below. This has sorted my email problem but am still being redirected to other sites. Its driving me round the bend. Can someone please help!

Malwarebytes' Anti-Malware 1.46

Database version: 4713

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

29/09/2010 01:07:49
mbam-log-2010-09-29 (01-07-49).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 362284
Time elapsed: 1 hour(s), 43 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 17
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{87e3ddb0-99a0-5dd0-b8bc-f8129d5a1884} (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{D3B61FEB-137B-403F-856C-6F57CCCA998E}\RP588\A0212428.exe (Adware.TryMedia) -> Quarantined and deleted successfully.
C:\Documents and Settings\amanda.gill\Application Data\Uliwg\odfo.exe (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.

Edited by weelizzie, 29 September 2010 - 02:15 AM.

#4 weelizzie

  • Topic Starter

  • Members
  • 3 posts
  • Local time:03:48 AM

Posted 30 September 2010 - 03:07 PM

:thumbsup: Thanks for all the help guys (not!) Laptop has totally crashed and can not reboot. Does anyone actually bother to reply to these posts?

#5 lolodestuddal


  • Members
  • 2 posts
  • Local time:09:48 PM

Posted 08 January 2011 - 01:34 PM


I have the same problem and did as Eraser23 suggested. I have this as a result:

# localhost name resolution is handled within DNS itself.
# localhost
# ::1 localhost

Can you hlp?


Edited by lolodestuddal, 08 January 2011 - 01:35 PM.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users