Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google redirect fixed for IE but not Firefox


  • Please log in to reply
6 replies to this topic

#1 Help8675309

Help8675309

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:53 AM

Posted 19 March 2012 - 02:25 PM

I found I had some Google redirect malware on my system. I checked various forums and wound up using Spybot Search and Destroy, followed by Malwarebytes then TDSSKill. I got things to the point where all of these were scanning and coming up clean. Started IE and did some Gogle searches with no redirects. However, when I went into Firefox the Google redirects are still sending me to findsearchengine, askthecrew, etc.

My system details:

OS: Windows 7 Home Premium Service Pack 1 (64 bit)
IE: v8.0.7601.17514
Firefox: v10.0.2
AVG Free Antivirus: v10.0.1424

Found when I would click on search results links in Google (both with Firefox and IE) I wouldn't go to the link target but get pushed to findsearchengineresults, askthecrew, and others. Used another computer to do some searching and figured I had some malware.

First I ran a rootkit scan with AVG, it found problems but did not succeed in resolving them.

I tried some basic stuff next, checked my hosts file, IE Internet Options, Firefox Options, did some registry searches. Couldn't find anything out of the ordinary.

I tried Spybot Search and Destroy next, it eliminated some threats but the rootkits were still showing up in the AVG scan. I also used the Immunize feature in Spybot, still no improvement. IE and Firefox comtinued to redirect.

Based on some more searches I tried Malwarebytes next. It also located some threats which it succeeded in removing but, even after I was getting clean scans with MBAM, AVG still showed rootkits and IE and Firefox were still redirecting.

I moved on to TDSSKill next. Located and removed a rootkit. Ran MBAM again and located and removed more threats. Now all scans show clear, IE does not redirect but Firefox still hasn't been cleaned up.

It seems as if I am close to having a clean system. Any suggestions on what to try next would be greatly appreciated.

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,070 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:53 AM

Posted 19 March 2012 - 02:31 PM

Check your Proxy settings...some infections will alter those settings in your browser which can cause redirects and affect your ability to browse, update or download tools required for disinfection. For FireFox, refer to these instructions to check and configure Proxy Settings under Advanced Options > Network tab > Connection Settings.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Help8675309

Help8675309
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:53 AM

Posted 19 March 2012 - 02:40 PM

Yes, checked those. Firefox has the No Proxy radio button selected and there are no entries in for the other options.

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,070 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:53 AM

Posted 19 March 2012 - 02:53 PM

Try restoring the default settings in Firefox.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 Help8675309

Help8675309
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:53 AM

Posted 19 March 2012 - 03:11 PM

Reset firefox to defaults through safe mode. Still redirecting.

#6 Help8675309

Help8675309
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:53 AM

Posted 19 March 2012 - 04:11 PM

I went ahead and uninstalled Firefox, rebooted and installed the latest version from a new download. Firefox and IE now are both clear of the redirect behavior.

I am still concerned I might have something hidden on my system. Any suggestions for further checks I could make would be greatly appreciated.

#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,070 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:53 AM

Posted 20 March 2012 - 06:00 AM

Please download and scan with the Kaspersky Virus Removal Tool from one of the links provided below and save it to your desktop.
Link 1
Link 2
Link 3Be sure to print out and read the instructions provided in:How to Install Kaspersky Virus Removal Tool
How to use the Kaspersky Virus Removal Tool to automatically remove viruses
  • Double-click the setup file (i.e. setup_9.0.0.722_22.01.2010_10-04.exe), select your language and install the utility.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • If you receive a UAC prompt asking if you would like to continue running the program, you should press the Continue button.
  • At the 'Setup page', click Next, check the box to accept the license agreement and click Next twice more to extract the required files.
  • Setup may recommend to scan the computer in Safe Mode. Click Ok.
  • A window will open with a tab that says Autoscan. Click the green Start scan button on the Autoscan tab in the main window.
  • If malware is detected, you will see the Scan Alert screen.
  • Place a checkmark in the Apply to all box, and click Disinfect if the button is active.
  • After the scan finishes, if any threats are left unneutralized in the Scan window (Red exclamation point), click the Neutralize all button.
  • Place a checkmark in the Apply to all box, and click Disinfect if the button is active.
  • If advised that a special disinfection procedure is required which demands system reboot, click the Ok button to close the window.
  • In the Scan window click the Reports button, choose Critical events and select Save to save the results to a file (name it avptool.txt).
  • Copy and paste the report results of any threats detected. Do not include the longer list marked Events.
  • When finished, follow these instructions on How to uninstall Kaspersky Virus Removal Tool 2011.
-- If you cannot run this tool in normal mode, then try using it in "safe mode".


Perform a scan with Eset Online Anti-virus Scanner.
  • If using Mozilla Firefox, you will be prompted to download and use the ESET Smart Installer. Just double-click on esetsmartinstaller_enu.exe to install.
  • Vista/Windows 7 users need to run Internet Explorer/Firefox as Administrator.
    To do this, right-click on the browser icon in the Start Menu or Quick Launch Bar and select Run As Administrator from the context menu.
  • Click the green Posted Image button.
  • Read the End User License Agreement and check the box:
  • Check Posted Image.
  • Click the Posted Image button.
  • Accept any security warnings from your browser and allow the download/installation of any require files.
  • Under scan settings, check Posted Image and check Remove found threats
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • Click the Start button.
  • ESET will install itself, download virus signature database updates, and begin scanning your computer.
  • The scan can take some time to complete...close all programs and do NOT use the computer while the scan is running.
    If given the option (when threats are found), choose "Quarantine" instead of delete.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop as ESETScan.txt.
  • Push the Posted Image button, then Finish.
  • Copy and paste the contents of ESETScan.txt in your next reply. If no threats are found, there is no option to create a log.

Note: If you recognize any of the detections as legitimate programs, it's possible they are "false positives" and you can ignore them or get a second opinion if you're not sure.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users