Web Search Results Being Redirected

[Bazza]

Having a few problems with my Internet Explorer Browser (version 7) on my home pc today.

When I run a search in Google, Yahoo or any of the other search engines the results list appears as normal, but when I click on one of the results I get directed to a completely different and unrelated webpage (e.g. ebay, british information) which opens in a new tab, then a number of pop-up adverts appear. Other times it will not even let me access the webpage, giving me an error message instead “webpage cannot be found”. I even had great difficulty in writing and posting this message to this forum as it kept trying to redirect me to other websites.

I have run both Norton Internet Security 2008 and Ad-Ware (which are installed on my PC) but neither of them found anything suspicious.

Please can you help me to fix this problem because I do not know where to start. It is driving me mad. Thanks

[BeeCeeBee]

Hello bazza and welcome!!

 

There is no doubt but that your machine is infested with malware that needs to be removed.

 

Please follow the instruction below exactly and report back to us.

 

Once your computer is clean we will give you our recommendations for proper protection int the future.

 

Your computer is infected with Malware.

 

• Malware is software designed to infiltrate or damage a computer system without the owner's informed consent.
  It is a combination of the words malicious and software.
  The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.
  

 

• Required Cleanup Steps
  
  1. Disable the Spybot Search & Destroy TEA TIMER if you use it and if it is enabled
     
  2. Run a Temporary file and cache cleaner (ATF)
     
  3. Run 2 Anti-Malware scanners (Listed Below)
     
  4. Run an Online Anti-Virus / Anti-Malware Scanner (Listed Below)
     
  5. Clear out old System Restore points
     
  6. If continued Malware type activity is present you may be asked to post a TrendMicro™ HijackThis™ Log file, do not do so unless requested.
     

The reason to run multiple scanners is to ensure that no single scanner is missing something.

The time it takes will vary depending on your system and your internet connection speed.

Typically the SUPERAntiSpyware and Malwarebytes scanners will take between 10 to 90 minutes.

The ESET online scan should take between 1 to 3 hours.

In most cases, these scans will suffice to clean and disinfect your computer.

Heavily infected systems or slower PCs can take much longer to scan and clean.

 

For best results print the following instructions and bookmark this Web page

To keep this guide printer-friendly, use your cursor to highlight the contents below.

From your browser select File - Print and in the printer dialog box under "Print range"

click the

Selection

choice to print out these instructions for removal of malware.

 

 

http://i306.photobucket.com/albums/nn266/FPCH/Malware%20Guide/printer-selection.gif

 

____________________________________________

STEP 1

• Disable Spybot Search & Destroys' TEA TIMER: (if installed, if not go to Step 2)
  
  
  1. Run Spybot-S&D in Advanced Mode.
     
     
  2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
     
     
  3. On the left hand side, Click on Tools
     
     
  4. Then click on the Resident Icon in the List
     
     
  5. Uncheck "Resident TeaTimer" and OK any prompts.
     
     
  6. Restart your computer.
     
     

__________________________________________________

STEP 2

• Follow these instructions carefully.
  
  
• Download ATF-Cleaner from
  SCANWITH.com
  to remove un-needed temporary files from your computer that may contain malware.
  
  
• When you run ATF-Cleaner, check the items as shown below for Main.
  
  
• For FireFox, be sure to click on the FireFox tab on top and check the items as shown below for FireFox
  
  
• NOTE:
  If you don't have FireFox or Opera installed then they will be grayed out and can be ignored
  
  
• Then click on "Empty Selected".
  
  

http://i306.photobucket.com/albums/nn266/FPCH/Malware%20Guide/atf-cleaner01.gif

.

http://i306.photobucket.com/albums/nn266/FPCH/Malware%20Guide/atf-cleaner02.gif

__________________________________________________

STEP 3

• Install and run the free version (not the Professional version) of SUPERAntiSpyware from
  SUPERAntiSpyware.com
  
  
  • Accept any prompts to allow SUPERAntiSpyware to install the latest rules and infection definition files.
    
    
  • You do not have to send them your e-mail address, just click next.
    
    
  • You can leave the automated check for updates on.
    
    
  • You can uncheck "Send a diagnostic report to research center" if you don't want to send the information.
    
    
  • DO NOT
    allow SUPERAntiSpyware to protect your Home Page settings.
    
    
  • On the
    Top Left
    select the
    Scan your computer
    button.
    
    
  • Make sure there is a CHECK MARK on all
    Fixed Drives
    .
    
    
  • Click "Perform a Complete Scan". Click "Next" to Repair issues found and reboot the computer when prompted to do so.
    
    

__________________________________________________

STEP 4

• Install and run
  Malwarebytes' Anti-Malware
  from
  Malwarebytes - (direct download)
  
  
  • Accept all defaults for the installer
    
    
  • Allow the program to update the definitions
    
    
  • Click on the
    Quick Scan
    and click Next.
    
    
  • If any items are found allow it to clean them and then Reboot your computer.
    
    

__________________________________________________

STEP 5

• Run an online scan with ESET from
  Free Virus Scan: Use ESET's Online Antivirus Scanner
  
  
  • You
    must
    use Internet Explorer for this online scan. FireFox, Opera, etc will not work for this scan.
    
    
  • If your computer is running Window's Vista, then you
    must first
    start Internet Explorer as an Administrator. To do so, right-click on the
    Internet Explorer
    icon in the Start Menu and select "
    Run as administrator
    " from the popup context menu.
    
    
   
  • Accept the terms and click "Start".
    
    
  • Once the scanner is ready, check "Remove found threats" AND "Scan unwanted applications".
    
    
  • Click "Start" to begin the scan.
    
    
  • When completed restart your computer
    
    

__________________________________________________

Make sure your internet firewall security is enabled, and then please return to Extreme Tech Support - Free PC Help and tell us how the computer seems to be operating.

At that time, you will receive instructions to assist you in removing malicious programs from your Add/Remove program list if warranted.

 

If required this is the download link for TrendMicro™ HijackThis™

Unless instructed to by the Technician helping you then do not download this tool.

 

Once you and the Technician agree that your system appears to be clean then you should delete all your System Restore points and recreate a new one.

Please follow the instructions here

How to turn off and turn on System Restore in Windows XP

How to turn off and turn on System Restore in Windows Vista

[Bazza]

Web Search Results Being Redirected

 

Thanks for the help so far. Have successfully performed steps 1-3.

 

However, the link to the Malwarebtyes automatic download does not appear to be working when I click on it. Get the message that Internet explorer cannot access the site. Is the malware blocking me from accesssing this site. If so Hoe can I download this software?

[BeeCeeBee]

It would appear that the problem that you are having is the very same thing that may be blocking your access. The link is working fine for me.

 

See if it works from here.

 

Malwarebytes.org

 

and then download the latest version. If not come right back.

[Bazza]

Web Search Results Being Redirected

 

Thanks for the link. Have now successfully completed step 4. Having some problems in getting past Esets Agree screen - accepted the terms by ticking the box and then clicked on start. answered yes to active x controls afterwhich it seems to hang after this. Anything I can do.

 

Also have 2 further problems -

1) my PC seems to be exceptionally slow after running step4 and;

2) When I log in it automatically dials up my ISP

 

How Can I resolve these additional issues?

 

Thanks

[BeeCeeBee]

Hi Bazza,

 

Now that you have downloaded the the 3 programs I would suggest your simply start over from the beginning but do not download again just run the programs.

 

Since you have them installed you need not be on line to do this until you get to the eset on line scanner. Bookmark or add the eset page to to your favorites list and go directly to it when you get to that stage.

 

This process really should be run all at once not a bit at a time with internet traffic in between steps.

 

Let us know how you make out.

[Bazza]

Web Search Results Being Redirected

 

Have performed all the steps again consecutively as you recommended in your last post. Seems to have worked.

What are the next steps in the process and is there anything else I should do? What can I do to improe my security?

[BeeCeeBee]

If it worked Bazza there are no next steps. :)

 

Have a look at these and remember that you must never use more then one active real time antivirus program at a time. Use 2 of the antimalware programs.

 

http://extremetechsupport.com/forum/malware-removal-av-firewalls-etc/3597-free-pc-help-recommended-security-products.html

 

Personally I would get rid of Norton and get either Aivira, Avast or the the Eset subscription service. Norton may be hard to get rid of but there is a tool available to get any remnants. But you should uninstall it first from your control panel (add or remove programs)

 

Download and run the Norton Removal Tool

Edited January 16, 2009 by BeeCeeBee

[Bazza]

Web Search Results Being Redirected

 

Thanks for all your help in resolving this issue. Will incorporate your security recommendations onto my PC today.

[BeeCeeBee]

Do that Baz it should keep all this from re occurring. Edited January 19, 2009 by BeeCeeBee