Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google search results redirecting


  • Please log in to reply
7 replies to this topic

#1 sabregreen

sabregreen

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:12 AM

Posted 04 September 2011 - 01:04 PM

When searching using Google, and clicking on results, I get randomly redirect shortly after going to the intended page to an unintended page usually first showing up as search3.google.com and then finally resolving to various advertisement links. Looking for first steps to be performed for removal.

Thanks,

Jason

BC AdBot (Login to Remove)

 


#2 sabregreen

sabregreen
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:12 AM

Posted 04 September 2011 - 01:11 PM

Along with search3.google.com, theres also ea80.r.google.com. For the final redirection, theres blinx.com and find-fast-answers.com.

Also to note, I've tried removing this virus/spyware myself to no avail. Just wanted to make that known so this might be a little tainted as I could have possibly partially removed some of the virus/spyware.

#3 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,758 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:12 AM

Posted 04 September 2011 - 02:04 PM

Welcome aboard Posted Image

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=============================================================================

Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Users, Partitions and Memory size
Click Go and post the result.

=============================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=============================================================================

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#4 sabregreen

sabregreen
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:12 AM

Posted 04 September 2011 - 09:24 PM

Problem solved. This was driving me nuts because I used to do virus/spyware removal several years ago but graduated from college and went in the direction of my degree(computer engineering and more hardware than software). Something was not making sense to me because I've never gotten a virus or spyware that I had no induced myself from brute force testing.

First, let me explain the background. This google search redirection didn't start happening until this past thursday. I just went on vacation thursday and have been staying in a hotel. Just today, it dawned on me to see if I could log into the hotel's routers. Come to find out, they have the default username and passwords still set. Looked at the DNS address setting and its manually set to 213.109.65.26, 213.109.75.213. I think everyone knows the answer at this point on the forum...

Alerted hotel management and changed over to google public DNS (8.8.8.8). Problem solved. Thanks for all the help and quick responses. Hopefully this can be helpful to others.

#5 sabregreen

sabregreen
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:12 AM

Posted 04 September 2011 - 09:28 PM

Also to mention, this was blocking Malwarebytes updates.

#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,758 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:12 AM

Posted 04 September 2011 - 09:36 PM

Good job :)

213.109.65.26, 213.109.75.213

Known Ukrainian DNS hijacker.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#7 sabregreen

sabregreen
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:12 AM

Posted 04 September 2011 - 09:39 PM

Appreciate it :). Talk about driving someone crazy. Especially for someone that never gets viruses or spyware and therefore, never uses antivirus/antispyware. I'm just hoping that other people will benefit from my frustration.

Edited by sabregreen, 04 September 2011 - 09:39 PM.


#8 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,758 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:12 AM

Posted 04 September 2011 - 09:45 PM

Sh** happens to everyone :)

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users