Why do all links I click on through google take me to other places

dUnKle · 16-11-2008, 9:58 AM

Just done a google search (was for the official fantasy premier leauge) and upon getting my results I clicked on what seemed to be the most accurate

It took my to a site selling pianos ?

I then did same search again, clicked on first result and this time got to correct site

I then did another search (internet speed nest) and got a site that seemed to be from a coupon site ?

Run avast and nothing found, run windows defender and nothing found

Actually tried to do search for problem (google search innacurate results)
Clicked on first link and it seems to redirect few a few sites before showing me a bbc news web page put with a www.blinkx..... web site

Dj_Sim · 16-11-2008, 10:01 AM

Sounds like spyware/ malware.

dUnKle · 16-11-2008, 10:07 AM

Strange

Been away for the weekend and things fine then - will have to have word with other half

As it stands we never use this laptop to download things so even more confused - we use the old laptop for downloads and the like

Windows Defender got nothing back nor to has avast
Oh and using Vista as well

Dj_Sim · 16-11-2008, 10:09 AM

I would sugest running this program

Malwarebytes' Anti-Malware - Reviews and free Malwarebytes' Anti-Malware downloads at Download.com

Great program, just the free version should do the trick.

stevefish69 · 16-11-2008, 10:11 AM

Yup - Malwear for sure.

We have been suffering all week with attacks of this and it has been driving us mad. Malwarebytes will remove it, but it will re-appear until the source program is found and removed.

The wife has just babbled something about running a program called AFT cleaner too, which will clean up Temp internet files and cookies as it can also lurk in there.

We found that it was a dodgy program that i'd installed from my mate Bertie and once removed and cleaned fingers crossed it's gone for good

Quote:

Originally Posted by Dj_Sim

I would sugest running this program

Malwarebytes' Anti-Malware - Reviews and free Malwarebytes' Anti-Malware downloads at Download.com

Great program, just the free version should do the trick.

Great minds and all that

SWMBO · 16-11-2008, 10:21 AM

Basically your browser has been hijacked

u can read about it here

doing the malware scan and aft cleaner should get rid of it

Dj_Sim · 16-11-2008, 10:21 AM

Yea my ladies PC got some terrible program on it and the only program that could remove it was malwarebytes.

Love that program now.

dUnKle · 16-11-2008, 10:27 AM

Thanks guys
Confused as to how its there
Can spyware transmit from one laptop to another over wireless ?

Dj_Sim · 16-11-2008, 10:31 AM

it can get there for hundreds of reasons.

Might be a hole in your browsers security.

Are you using firefox?

dUnKle · 16-11-2008, 10:32 AM

Quote:

Originally Posted by Dj_Sim

it can get there for hundreds of reasons.

Might be a hole in your browsers security.

Are you using firefox?

yeah - latest firefox

Singh400 · 16-11-2008, 10:32 AM

Not AFAIK. Looks like your router has been affected?

dUnKle · 16-11-2008, 10:50 AM

Quote:

Originally Posted by Singh400

Not AFAIK. Looks like your router has been affected?

router infected ?
how does that work ?
can it be fixed

andykn · 16-11-2008, 11:53 AM

Router affected, not infected.

It sounds like Malwarebytes should work, see:

Possible spyware problem

If it doesn't, you could try using Alta Vista to see if you have the same problem and try using a different web browser.

dUnKle · 16-11-2008, 12:09 PM

Mawarebytes found 16 infections
Removed them but still have the problem

dUnKle · 16-11-2008, 12:12 PM

also problem now appears on both laptops
seems to be spreading - did not think a router could be effected or cause such problem ?

eviljohn2 · 16-11-2008, 12:12 PM

You could try running Spybot too. That checks out Firefox quite thoroughly.

dUnKle · 16-11-2008, 12:25 PM

Well I have reset my router back t factory defaults and now the problem has gone on both laptops

what could have caused it ?
did not think routers got infected

Singh400 · 16-11-2008, 2:33 PM

No idea what it was. But it looked like it was sitting between you and the router, and changing the requests. Next time post a HiJackThis log.

dUnKle · 16-11-2008, 2:37 PM

Quote:

Originally Posted by Singh400

No idea what it was. But it looked like it was sitting between you and the router, and changing the requests. Next time post a HiJackThis log.

whats hijack this ?
the problem was def on both laptops but upon resetting the router to factory defaults it seems sorted

onefivenine · 17-11-2008, 9:32 AM

Quote:

Originally Posted by dUnKle

whats hijack this ?
the problem was def on both laptops but upon resetting the router to factory defaults it seems sorted

Sounds like your DNS was hijacked.

One of the little nasties has modified the dns settings for the network adaptor to be manually set instead of automatically acquired.
That meant whenever you opened a web page, these rogue DNS servers directed you to a different site which installed lots of nasties again before forwarding you to the real site - or not bothering.

You can check your DNS server using the DOS command nslookup
eg.
C:\>nslookup
Default Server: bebox.config
Address: 192.168.1.254

If you connect to the Internet via a modem/router, these should always be set to automatic - see no reason myself for manually overriding them.

An nslookup command from a command window should always show the dns server to be the address of your modem/router.

Similarly, if you connect via a USB modem check your DNS settings relate to the ISP you use.

Mr Incredible · 17-11-2008, 10:04 AM

I stupidly ran Malwarebytes on my infected Homeserver and "repaired" all the faults. Rebooted and the OS (windows Business Srver 2003) would not load properly. I couldn't log in at all. A fresh re-install of the OS was my only recourse that I could find.

mmayson · 17-11-2008, 10:31 AM

Quote:

Originally Posted by Mr Incredible

I stupidly ran Malwarebytes on my infected Homeserver and "repaired" all the faults. Rebooted and the OS (windows Business Srver 2003) would not load properly. I couldn't log in at all. A fresh re-install of the OS was my only recourse that I could find.

Could you not have restored the system to an earlier date? ie a couple of days before you used the programme?

Mr Incredible · 17-11-2008, 10:53 AM

I did a F8 "Retore to previous working version" on bootup, but Malwarebytes had erroneously moved/deleted some critical system files that the Home Server needed to run. So I was stuffed good 'n proper. Perhaps Malarebytes is no good for Business Server 2003.

Praxidike · 17-11-2008, 10:56 AM

Quote:

Originally Posted by dUnKle

Well I have reset my router back t factory defaults and now the problem has gone on both laptops

what could have caused it ?
did not think routers got infected

It's probably no good now, but if I'd seen this earlier I would've said to try that.

My friend just had an identical problem across a few computers all running different operating systems, the only common link being the router. A tracert only showed Google being bypassed when going through the router.

What router do you have, out of interest?

g3ueq · 17-11-2008, 2:46 PM

I had the same problem, Sypbot S&D 1.60 seemed to fix mine, make sure after you have downloaded updates, you disconnect from internet to be safe whilst prog is scanning not to re-infect at end. I also used Anti-Vir that seem to keep it at bay.
One of the hi-jacker viruses is called Completala, this does similar things. The virus is sent by a s/ware company trying to make you buy only their antivir software..highly illegal I would have thought.
Andy

Singh400 · 17-11-2008, 3:43 PM

Quote:

Originally Posted by dUnKle

whats hijack this ?
the problem was def on both laptops but upon resetting the router to factory defaults it seems sorted

HiJackThis is a program that will log anything and everything on your computer that is running, has added itself to key locations (like in the registry). It's great for picking up pesky little problems like that. It's pretty much my first port of call. As is Spybot, Ad-Aware, CWShredder, Spywareblaster and Windows Defender.

Quote:

Originally Posted by Mr Incredible

I stupidly ran Malwarebytes on my infected Homeserver and "repaired" all the faults. Rebooted and the OS (windows Business Srver 2003) would not load properly. I couldn't log in at all. A fresh re-install of the OS was my only recourse that I could find.

Quote:

Originally Posted by Mr Incredible

I did a F8 "Retore to previous working version" on bootup, but Malwarebytes had erroneously moved/deleted some critical system files that the Home Server needed to run. So I was stuffed good 'n proper. Perhaps Malarebytes is no good for Business Server 2003.

Yeah this malwarebytes program has come out of nowhere, and I personally don't trust it. God knows what it is doing - malwarebytes has only recently come onto the the scene. I could be wrong, but better to be safe than sorry I say

McFaber · 17-11-2008, 5:47 PM

Quote:

Originally Posted by Singh400

HiJackThis is a program that will log anything and everything on your computer that is running, has added itself to key locations (like in the registry). It's great for picking up pesky little problems like that. It's pretty much my first port of call. As is Spybot, Ad-Aware, CWShredder, Spywareblaster and Windows Defender.

Second the HiJackThis program....not for a computer novice, though it is quite easy to work out what's not supposed to be there...if you're not sure, don't delete...

andykn · 17-11-2008, 6:57 PM

You can get infected from an infected webpage, Bloodhound.Exploit.196, to remove;

website drops sysaudio.sys into the c:\windows\system32 folder and adds the registry string key aux=sysaudio.sys in HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32

Symptoms:
Affects results from popular websearches, i.e. google, yahoo, etc. If you do a search, it will inject shady websites in the links of the search results page.

To Remove:
1. delete reg key
2. reboot
3. delete sysaudio.sys