Searches being redirected

EfrainMan · May 31, 2012, 07:32 PM

I can't for the life of me find the cause. Searches in Google and Bing are being redirected to some random pages. Only clicking the search results does this, manually entering links is fine. This is an employee's laptop that got infected, and I'm cleaning out. I've run Malwarebytes Antimalware and SuperAntiSpyware, and after the initial cleanings they only come out clean now. I've tried it with IE, Chrome and Firefox, they all do it, and Firefox was installed after the spyware scans came out clean. I've only done a cursory look inside the registry for anything obvious, but I really don't know what else to look for. My hosts file is normal, nothing extra or different there. I am definitely at my wit's end here, where else should I be looking? Windows XP Pro 32-bit, all updated.

**temeteus82** · Jun 1, 2012, 12:49 AM

Look your DNS settings. Sounds like some one is using DNS server to redirect you.

Takaharu · Jun 1, 2012, 08:19 AM

I'm with tem on this one.
Use ipconfig /all from the command prompt and see what the DNS servers say. That's quite a common issue when dealing with spyware and it won't be rectified automatically by spyware removers.

**temeteus82** · Jun 1, 2012, 10:04 AM

Or just look what the ipv4 settings are in control panel. If they aren't set by DHCP server then that's the issue. Unless they are OpenDNS's servers that are ok.

EfrainMan · Jun 1, 2012, 04:31 PM

I checked the DNS servers, and they are the same as any others connected to our router. And the network connection is set to automatically get the DNS servers and DHCP. No other machine on this network is being redirected.

Also, I tried doing something someone else suggested, which was set the DNS servers to Google's public ones, the 8.8.8.8 and 8.8.4.4, but the searches were still being redirected.

Takaharu · Jun 1, 2012, 05:02 PM

There'll still be something lingering in the background. Look for something either obviously out of place in the running processes or something with a slight spelling mistake (eg: Esplorer). They're my only ideas.

EfrainMan · Jun 1, 2012, 05:37 PM

Naw, I didn't notice any strange programs in task manager. Also, I checked the LAN settings and there are no proxies or anything.

I may have to just reinstall the OS, but it's a pain for this laptop.

EDIT: Got some advice from another forum, I was "dun been rootkit'd" and they recommended the Kaspersky live cd and combofix. They seemed to have resolved the issue. Thank you for your help

Mr cairo · Jun 1, 2012, 11:04 PM

Quote:

Originally Posted by EfrainMan

the Kaspersky live cd and combofix. They seemed to have resolved the issue. Thank you for your help

you got a link for that ??

Tipstaff · Jun 2, 2012, 04:48 AM

Quote:

Originally Posted by Mr cairo

you got a link for that ??

Kaskpersky Rescue Disk 10

I use this thing all the time. Just be aware that updating the definitions can take forever, and is only saved to the local machine. That's when I found a little utility called "Kaspersky Rescue Disk Update" that, when run, will decompress the ISO, download the new definitions, and rebuild the ISO file for you. Then it's just a matter of burning it to CD, or uploading it to a USB pen.

Takaharu · Jun 2, 2012, 08:27 PM

Good news!
Nah, not really, but I think I might have found the cause of the problem: DNs Changer Trojan.

caps_buster · Oct 21, 2012, 01:23 AM

Kill it then with fire!

Damn annoying hacks...

May 31, 2012, 07:32 PM	#1
EfrainMan HardwareHeaven Lover Join Date: Sep 2004 Location: Los Angeles Posts: 201 Rep Power: 56 System Specs	Searches being redirected I can't for the life of me find the cause. Searches in Google and Bing are being redirected to some random pages. Only clicking the search results does this, manually entering links is fine. This is an employee's laptop that got infected, and I'm cleaning out. I've run Malwarebytes Antimalware and SuperAntiSpyware, and after the initial cleanings they only come out clean now. I've tried it with IE, Chrome and Firefox, they all do it, and Firefox was installed after the spyware scans came out clean. I've only done a cursory look inside the registry for anything obvious, but I really don't know what else to look for. My hosts file is normal, nothing extra or different there. I am definitely at my wit's end here, where else should I be looking? Windows XP Pro 32-bit, all updated. __________________ My modest video card history: S3 Virge, 3DLabs Permedia 2, 3dfx Voodoo3 2000, 3dfx Voodoo5 5500, GeForce 3 Ti500, GeForce 4 Ti4600, Radeon 9700 Pro, Radeon X800XT, Radeon X1900XT+Crossfire, GeForce 8800GTX, Radeon HD4870x2, Radeon HD5870, 2x Radeon HD6970, GeForce GTX 680

Jun 1, 2012, 08:19 AM	#3
Takaharu Unus offa, unus iuguolo Join Date: Aug 2009 Location: England, UK Posts: 2,419 Rep Power: 168 System Specs	Re: Searches being redirected I'm with tem on this one. Use ipconfig /all from the command prompt and see what the DNS servers say. That's quite a common issue when dealing with spyware and it won't be rectified automatically by spyware removers. __________________ I don't get paid to know the answer, therefore I'm far more likely to give you a straight and honest answer.

Jun 1, 2012, 04:31 PM	Thread Starter #5
EfrainMan HardwareHeaven Lover Join Date: Sep 2004 Location: Los Angeles Posts: 201 Rep Power: 56 System Specs	Re: Searches being redirected I checked the DNS servers, and they are the same as any others connected to our router. And the network connection is set to automatically get the DNS servers and DHCP. No other machine on this network is being redirected. Also, I tried doing something someone else suggested, which was set the DNS servers to Google's public ones, the 8.8.8.8 and 8.8.4.4, but the searches were still being redirected. __________________ My modest video card history: S3 Virge, 3DLabs Permedia 2, 3dfx Voodoo3 2000, 3dfx Voodoo5 5500, GeForce 3 Ti500, GeForce 4 Ti4600, Radeon 9700 Pro, Radeon X800XT, Radeon X1900XT+Crossfire, GeForce 8800GTX, Radeon HD4870x2, Radeon HD5870, 2x Radeon HD6970, GeForce GTX 680

Jun 1, 2012, 05:02 PM	#6
Takaharu Unus offa, unus iuguolo Join Date: Aug 2009 Location: England, UK Posts: 2,419 Rep Power: 168 System Specs	Re: Searches being redirected There'll still be something lingering in the background. Look for something either obviously out of place in the running processes or something with a slight spelling mistake (eg: Esplorer). They're my only ideas. __________________ I don't get paid to know the answer, therefore I'm far more likely to give you a straight and honest answer.

Jun 1, 2012, 05:37 PM	Thread Starter #7
EfrainMan HardwareHeaven Lover Join Date: Sep 2004 Location: Los Angeles Posts: 201 Rep Power: 56 System Specs	Re: Searches being redirected Naw, I didn't notice any strange programs in task manager. Also, I checked the LAN settings and there are no proxies or anything. I may have to just reinstall the OS, but it's a pain for this laptop. EDIT: Got some advice from another forum, I was "dun been rootkit'd" and they recommended the Kaspersky live cd and combofix. They seemed to have resolved the issue. Thank you for your help __________________ My modest video card history: S3 Virge, 3DLabs Permedia 2, 3dfx Voodoo3 2000, 3dfx Voodoo5 5500, GeForce 3 Ti500, GeForce 4 Ti4600, Radeon 9700 Pro, Radeon X800XT, Radeon X1900XT+Crossfire, GeForce 8800GTX, Radeon HD4870x2, Radeon HD5870, 2x Radeon HD6970, GeForce GTX 680 Last edited by EfrainMan; Jun 1, 2012 at 07:54 PM.

Jun 2, 2012, 08:27 PM	#10
Takaharu Unus offa, unus iuguolo Join Date: Aug 2009 Location: England, UK Posts: 2,419 Rep Power: 168 System Specs	Re: Searches being redirected Good news! Nah, not really, but I think I might have found the cause of the problem: DNs Changer Trojan. __________________ I don't get paid to know the answer, therefore I'm far more likely to give you a straight and honest answer.

Oct 21, 2012, 01:23 AM	#11
caps_buster Just one crazy geek :) Join Date: Oct 2012 Location: Czech republic Posts: 26 Rep Power: 8	Re: Searches being redirected Kill it then with fire! Damn annoying hacks...