Over 1 million tech questions and answers.

Please Help. :( Intranet Sites Redirected to Other Sites

Q: Please Help. :( Intranet Sites Redirected to Other Sites

Hi Guys,

Im new here. Please help me on this. Everytime I tried to browse to our intranet sites, it redirects me to some 'malicious' internet sites. I can't access all of our intranet sites now, since last week. And a lot of pop ups are showing whenever I tried to browse the web, very irritating..

Your help will be greatly appreciated..

Here's my log from HijackThis. I don;t have any idea how to interpret this..
-------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:13 AM, on 4/20/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sygate\SSA\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\Program Files\Microsoft Forefront\Client Security\Client\Microsoft Operations Manager 2005\MOMService.exe
C:\PROGRA~1\MI6841~1\MSSQL\binn\sqlagent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Microsoft Office Communicator\communicator.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AVG\AVG8\aAvgApi.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\WINDOWS\system32\MsiExec.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896" target="_blank" class="wLink">http://go.microsoft.com/fwlink/?LinkId=54896" target="_blank" class="wLink">http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signals.corpnt.analog.com/default.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157" target="_blank" class="wLink">http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Analog Devices, Inc.
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {91bf2057-84e7-4d2e-954a-7d2a66018904} - C:\WINDOWS\system32\jopafuyi.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Desktop Calendar] C:\Program Files\Desktop Calendar\CanDesk.exe 9
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Microsoft Forefront Client Security Antimalware Service] "c:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [depivatuvu] Rundll32.exe "C:\WINDOWS\system32\feyumaze.dll",s
O4 - HKLM\..\Run: [f4ace796] rundll32.exe "C:\WINDOWS\system32\tawagifi.dll",b
O4 - HKLM\..\Run: [CPMf79fd40a] Rundll32.exe "c:\windows\system32\pomijowu.dll",a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [depivatuvu] Rundll32.exe "C:\WINDOWS\system32\feyumaze.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02E09B2E-2A03-4572-9291-69900C068564} (LCSim Control) - http://www.learnitcorp.com/cabs/lcsim.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1211959445300
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ad.analog.com
O17 - HKLM\Software\..\Telephony: DomainName = ad.analog.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ad.analog.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\vizaleso.dll c:\windows\system32\kulofuvo.dll c:\windows\system32\pomijowu.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pomijowu.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\pomijowu.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DataSvr2 - Unknown owner - C:\Program Files\Wave Systems Corp\Common\DataServer.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Lan Discover Agent (magaService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\maga\maga.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Security Agent (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\smc.exe

--
End of file - 11954 bytes

RELEVANCY SCORE 200
Preferred Solution: Please Help. :( Intranet Sites Redirected to Other Sites

I recommend downloading and running DAP. It can help sort out any driver and firmware related issues on your system

It's worked out well for many of us in the past.

You can download it direct from this link http://downloaddap.org. (This link will open the download page of DAP so you can save a copy to your computer.)

A: Please Help. :( Intranet Sites Redirected to Other Sites

Hello and welcome to TSF.

HijackThis is no longer the preferred initial analysis tool in this forum

We want all our members to perform the steps outlined in the link given below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Read other 1 answers
RELEVANCY SCORE 118.8

Hi Guys,

Original post:

http://www.techsupportforum.com/f100...es-368470.html

Im new here. Please help me on this. Everytime I tried to browse to our intranet sites, it redirects me to some 'malicious' internet sites. I can't access all of our intranet sites now, since last week. And a lot of pop ups are showing whenever I tried to browse the web, very irritating..

Your help will be greatly appreciated..

=============== DDS.txt ===========================

DDS (Ver_09-03-16.01) - NTFSx86
Run by ADMIN at 11:31:27.28 on Mon 04/20/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.328 [GMT 8:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
AV: Microsoft Forefront Client Security *On-access scanning enabled* (Updated)
FW: Sygate Security Agent *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Sygate\SSA\smc.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\M... Read more

A:Intranet Sites Redirected to Other Internet Sites

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

It appears that you have two antivirus programs installed and running, AVG and Microsoft Forefront Client Security. While this may seem like better protection, they can actually conflict with one another and cause system instability or even system hangs. Please choose one to keep and uninstall the other via Add or Remove Programs in your Control Panel.

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all antivirus and antimalware programs so they do not inter... Read more

Read other 9 answers
RELEVANCY SCORE 100.8

Hello
We are testing Windows 10 1703 prior to rolling it out to our estate and have come across an issue with Internet Explorer Site Zoning and just wondering if anyone else has seen the issue.
So on Windows 7, 8.1 and Windows 10, 1511 and 1607 using IE11. We have a SharePoint intranet site setup on intranet.example.co.uk. We use a proxy so we have a list of sites that by pass the proxy so for example we have *.example.co.uk in the bypass
proxy exceptions. On the above clients OS we browse to the site in IE and it loads, checking the zone it has picked it up as 'Local Intranet' so seems to use the 'Automatic logon on in Intranet Zone' setting. - all good.
Just for clarity these settings are same in IE on all versions. as are the default security options.

When we do the same thing on Windows 10 1703 it results in the user being prompted for credentials. the same proxy exceptions settings are applied as above. Entering the username/password allows access to the site. Checking the zone and the site is
being seen as an 'internet site'. This issue also appears in Chrome and Edge and only on Windows 10 1703
Adding intranet.example.co.uk to the bypass list makes no difference either, the only thing that does work is by adding intranet.example.co.uk into the Local Intranet Zone sites list - again all other settings are the same as above and work on
previous versions of Windows.
So the question is has Microsoft changed something in IE o... Read more

Read other answers
RELEVANCY SCORE 100.8

IE11 tel: Link does not work in trusted sites or intranet sites
If the site is in internet zone the link does work.

Any hints for a fix?

Read other answers
RELEVANCY SCORE 89.6

Quite often when I click a link in a returned search result from a website like www.whitepages.com it takes me to an unwanted and unrelated site. I have read somethings online about a Google redirect virus but I am not seeing this happen while doing a Google search. It seems to happen when doing a search or sort on a website and then the results are returned and when I go to click on one of the results I get sent to a page I do not want. I read on a forum that DDS, Gmer, and Attach.txt files can be helpful to someone who reads this. Another site this happens regularly on is www.adam4adam.com
Thank you for your help.

A:Redirected to unwanted/random sites from good sites

Hello and Welcome to the forums! My name is Gringo and I'll be glad to help you with your computer problems. Somethings to remember while we are working together.Do not run any other tool untill instructed to do so!please Do not Attach logs or put in code boxes.Tell me about any problems that have occurred during the fix.Tell me of any other symptoms you may be having as these can help also.Do not run anything while running a fix.Do not run any other tool untill instructed to do so!Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.Run Combofix:You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<Combofix may need to reboot your computer more than once to do its job this is normal.You can download Combofix from one of these links.Link 1Link 2Link 3 1. Close any open browsers or any other programs that are open.2. Close/disable all anti virus and anti malware programs so they do not interfere with the r... Read more

Read other 3 answers
RELEVANCY SCORE 87.6

I have a virus on my computer that is blocking access to all antivirus web sites and is also redirecting other sites to other sites such as Shopica or Find Stuff. I ran MalwareBytes, which removed a number of bad registry keys and files, but the problem persists. I also have Norton Internet Security installed. Here is my HiJackThis log. Your help is much appreciated.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:16:30 PM, on 1/4/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exeC:\Program Files\Cisco Systems\VPN Client\cvpnd.exeC:\Program Files\Maxtor\Sync\SyncServices.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\BCMSMMSG.exeC:\WINDOWS\system32\dla�... Read more

A:Can't access anitvirus sites and other sites are redirected

Hi, veganrich Welcome. Please download Malwarebytes' Anti-Malware from Here or HereDouble Click mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.If an update is found, it will download and install the latest version.Once the program has loaded, select "Perform Quick Scan", then click Scan.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.Please download ComboFix from Here or Here to your Desktop.**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**Please, never rename Combofix unless instructed.Close any open browsers.Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
... Read more

Read other 2 answers
RELEVANCY SCORE 84.8

I can not consistently load pages using IE8 on my local intranet. I never receive a "page not found" error. You just get a "wait for..." message in the progress bar and nothing ever happens.

This only affects my PC. All other PCs in the network load the pages without issue.

I do develop web applications on this PC, so not sure it software or settings on my PC are preventing a consistent load.

Any help is appreciated.
 

A:IE and Intranet sites

Read other 7 answers
RELEVANCY SCORE 82.8

Hi

I'm not sure that anyone can help me with this problem but I'd like to ask.

DETAILS:

IBM Thinkpad T22 Laptop
Windows 2000 Professional

A user at our company connects to an internal intranet website. The web server is located in the US (we are in the UK) and so its a bit slow but ok.

When he gets to a certain site he clicks a link that should open an Excel document. He clicks the link and his pc appears to freeze up. I checked task manager and IE is still running, cpu usage is around 3%. If you wait for 8 minutes (timed it a few times) the document opens up fine.

I logged the user off and logged on as myself. I accessed the link and the document opend up with 10 seconds!

Things I have tried:

1. Ran an IE browser repair.
2. Rebuilt the users Windows 2000 Profile.
3. Deleted Temp Internet Files including Index.dat
4. Detect and Reapir in Excel (just in case!)

Its not a major problem but the document should open up in about 10-15 seconds instead of 8 minutes.

Does anyone have any suggestions for me?

Regards

Pileyrei
 

A:Problems accessing intranet sites

Anyone?
 

Read other 1 answers
RELEVANCY SCORE 82.8

I am using the browser Internet Explorer7 . I am trying to open the 'Local Intranet' sites but i am unable to open the local sites. Please any one help me to open the local intranet sites using IE7 browser.

Thank You,
Jug

A:Can't Open Local Intranet sites Using IE7

what happens when you try and open them

Read other 2 answers
RELEVANCY SCORE 82

I have, what seems to me, a strange problem. The company I work for uses sharepoint for our intranet sites (no, this is not a sharepoint question) and we have recently upgraded to a new version. When we upgraded, the site now needs to be added to the local
intranet site list in order for it to automatically receive windows log in credentials and log users in to SharePoint. This is a simple fix, I have done it on dozens of machines, but on a select few the fix doesn't seem to work. Whenever I add a website to
the intranet sites list, it acts as if it was added... then as soon as I close the dialog box that is used to enter and display this info, it's gone, and by gone I mean I open back up the box and it has disappeared from the list. There is no trace of me ever
having changed a setting. There are currently no GPOs active that would cause these to be taken out of the list, I have tried adding the sites directly into the registry and they disappear there too, I'm not sure if this is the right place for my question
but I figure it's a start. So again:
Problem: Sites do not stay in proper security zone, all traces of them existing are erased on closing of dialog box.

Troubleshooting Done so Far: Tried directly placing in registry, no fix. No GPO's are active to remove said sites from zones.

A:IE 11 - Intranet sites added to list do not stay

Hi,
"but on a select few the fix doesn't seem to work"
Confused with this sentence, does this issue only occur in a specific PC\user account?
Have you tried the suggestion mentioned in the your original thread to reset IE, test the result?
What about other security zones, like Internet or trusted zone? Are there any other websites under the Intranet zone? Though you mentioned that these's no GPO applied to control this, I still recommend you run cmd rsop to check the settings applied
on this machine and user account.
Yolanda Zhu
TechNet Community Support

Read other 4 answers
RELEVANCY SCORE 81.2

Hello,

My computer is automatically redirecting me searchalligator.com for either single word address bar searches or when looking up intranet sites (but not connected to my intranet via vpn).
This line item pops up every few seconds in my TCP view and the IP address resolves to searchalligator.com. Please help.

I am on a wireless network, if that makes any difference.

Here's my tcpview:
AppleMobileDeviceService.exe 268 TCP 127.0.0.1 27015 0.0.0.0 0 LISTENING
CcmExec.exe 3800 UDP 127.0.0.1 2553 * *
cvpnd.exe 680 TCP 127.0.0.1 62514 127.0.0.1 2487 ESTABLISHED 488 24,400 488 7,808
cvpnd.exe 680 UDP 127.0.0.1 62514 * *
iexplore.exe 1016 UDP 127.0.0.1 1522 * * 1,334 1,334 1,335 1,335
iexplore.exe 3020 UDP 127.0.0.1 1873 * * 20 20 21 21
iexplore.exe 3020 TCP 192.168.0.100 3220 204.2.187.17 80 ESTABLISHED
iexplore.exe 3020 TCP 192.168.0.100 3221 204.2.187.17 80 ESTABLISHED
iexplore.exe 3020 TCP 192.168.0.100 3222 204.2.187.17 80 ESTABLISHED
iexplore.exe 3020 TCP 192.168.0.100 3223 204.2.187.17 80 ESTABLISHED
iexplore.exe 3020 TCP 192.168.0.100 3225 204.2.187.17 80 ESTABLISHED
iexplore.exe 928 TCP 127.0.0.1 3231 127.0.0.1 5152 FIN_WAIT2
jqs.exe 1692 TCP 127.0.0.1 5152 127.0.0.1 2938 CLOSE_WAIT
jqs.exe 1692 TCP 127.0.0.1 5152 0.0.0.0 0 LISTENING
lsass.exe 1728 UDP 0.0.0.0 500 * *
lsass.exe 1728 UDP 127.0.0.1 2500 * *
lsass.e... Read more

Read other answers
RELEVANCY SCORE 81.2

how can I enable this option ( display intranet sites in compatibility view ) in IE 11

Read other answers
RELEVANCY SCORE 79.2

Hi,

When i am opening my intranet websites which have security prompts
from IE11 in windows server 2016 as shown below and passing the credential,its not responding after clicking OK button.


Request advise on the same.



Thank you.

Regards,
Prashant

Read other answers
RELEVANCY SCORE 78.4

Hi, i am looking for a policy that will allow me to uncheck 'display intranet sites in compatibility view' without graying out the option to recheck it if a user needs the option in the future. So far the only option i found under Computer
Configuration/Administrative Templates/Windows Components/Internet Explorer/Compatibility View/Turn on Internet Explorer Standards Mode for Local Intranet would gray out the option to recheck the box.

Read other answers
RELEVANCY SCORE 78.4

Hi,

We have an odd issue. IE11 is running all sites in compatibility mode. This appears to be because it is treating all sites as being in the Intranet Zone. This is:
a) breaks many websites that require modern browsers 
b) is a huge security issue as many protections are disabled by default on the intranet zone.

Has anyone else seen this or have ideas on what we can do to solve it.

I will add that we have autodetect proxy settings enabled, and wpad hosts a proxy.pac that instructs browsers to go direct to all websites. 

Thanks

Nick

Read other answers
RELEVANCY SCORE 78.4

Hello,
Is there Registry key to uncheck Display intranet sites in Compatibility View from Internet Explorer ?

-Subramani

Read other answers
RELEVANCY SCORE 77.2

My google start page keeps coming up in German. I set the home page to google.com/ncr, but I know there's still a problem. Also, I get redirected sometimes to sites that are NOT what I know the end result page is supposed to be - but rather to a site displaying shopping sites as a search return. This is being posted by a friend using my comp via logmein...

A:google redirected to german version, searches redirected to shopping sites

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.Please describe the issues you are experiencing with your computer.

Read other 5 answers
RELEVANCY SCORE 72.4

hey,
sometimes, when i click on a website on google, i get redirected to some random ad website. It is extremely annoying. Help!?

HJT log
Logfile of HijackThis v1.99.1
Scan saved at 9:14:12 PM, on 4/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\urooj\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0... Read more

A:redirected to add sites

You have been offered help here: http://forums.techguy.org/security/551944-weird-happenings.html and you still have no active AntiVirus!
I'm closing this thread. Continue in your other thread until the problem(s) are resolved.
 

Read other 1 answers
RELEVANCY SCORE 72.4

Hello to all. I also am experiencing my IE8 being redirected to many sites over and over. My main form of defence has been McAfee and Windows Defender. Somehow a little bugger has gotten into my computer and I've been unable to find it. I have run numerous scans with many programs and the only thing that has come up is ALUREON.H trogan. Programs say that it has been fixed and McAfee can't find it with a full scan, but I still keep getting redirected constantly. I have a program showing up in my task manager called BSVFQ1ND.EXE which I've traced and deleted over and over, but still comes back. Your help will be much appreciated. Here is my HIJACKthis log for your review. Thanks in advance.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:14:32 AM, on 6/10/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\system32\CTsvcCDA.EXEC:\WINDOWS&#... Read more

A:IE being redirected to many different sites

Hello , And to the Bleeping Computer Malware Removal Forum. My name is Elise and I'll be glad to help you with your computer problems.I will be working on your malware issues, this may or may not solve other issues you may have with your machine.Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen. Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications. The topics you are tracking are shown here.-----------------------------------------------------------If you have since resolved the original problem you were having, we would appreciate you let... Read more

Read other 2 answers
RELEVANCY SCORE 72.4

I am facing this problem: When I visit sites with advertisments, my internet browser is not able to redirect me to the next page. Instead, it always refresh to the advertisment page again and again. It happens to all the sites I tried visiting. Please help. Thanks alot.
 

A:Sites Cannot Be Redirected.

What browser are you using?
 

Read other 3 answers
RELEVANCY SCORE 72.4

Hello,When i hit some links, i get redirected and a pop-up window appears when it shouldn't, but when i run avast and norton antivirus they detect nothing, so I made a log and I'm posting it here to see if anyone can tell me what to fix. I'm running windows 7 64 bit. And it happens in google chrome, internet explorer, and firefox.Logfile of Trend Micro HijackThis v2.0.3 (BETA)Scan saved at 2:17:05 AM, on 3/31/2010Platform: Unknown Windows (WinNT 6.01.3504)MSIE: Internet Explorer v8.00 (8.00.7600.16385)Boot mode: NormalRunning processes:C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exeC:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exeC:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exeC:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exeC:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\FastUserSwitching.exeC:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exeC:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\Keystatus.exeC:\Program Files\Alwil Software\Avast5\avastUI.exeC:\Users\n.5\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exeC:\Program Files (x86)\Hewlett-Packard\HP D... Read more

A:Being redirected to other sites

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

Read other 2 answers
RELEVANCY SCORE 72.4

Hello, my browser constantly redirects me to other sites and I'm not sure how to fix this. I've done scans using Spybot Search and Destroy, Malwarebytes Ant-Malware, and Spyware Doctor. Even after completing all these scans, the problem still persist...can anyone tell me what I should do next? Thanks for your help!

A:Keeps getting redirected to other sites...

Hello and welcome to TSF.

We want all our members to perform the steps outlined in the link given below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Read other 1 answers
RELEVANCY SCORE 72.4

OK I'm new here and it's probably the place to be when dealing with a virus of some sort. I was on a job hunting site and recieved a
"NT shutdwon" notice and the computer restarted. Then all my bookmarks/favorites were gone. I've spent 2 days running anti virus programs such as superantispyware and a few others. I'm currently running an Ad-ware scan also. I have Advanced System Care which has worked real well for the past 3 years and also have Windows Firewall. The issue no is that I get redirected to different sites. In fact, when I was reading info on this site, I was redirected to a Century 21 site. Also, yesterday while running a virus scan, a covergirl commercial (voice only) came on.
Need help
Curtis

Read other answers
RELEVANCY SCORE 72.4

Hi this help request is started as a result of the problem discussed at this forum thread http://www.bleepingcomputer.com/forums/t/489575/ie8-address-redirectfail-virus/page-2
 
XP Pro 32 SP3 and all updates, IE8 and Mozilla Firefox ("MzF"), Windows Firewall and MS Security Essentials running. MzF was uninstalled after sensing the problem and works properly.  I orginally thought this was a search engine redirect problem, but the problem is present at the IE8 address bar. 
 
IE8 works okay on some websites such as www.cbc.ca/news and all resulting page links, but others like www.dailymotion.com open up and then give a "You are about to leave a secure internet connection.  It will be possible for others to view information you send.  Do you wish to continue?" error popup.  When I answer no, the proper webpage remains and works (is viewable), except the same security warning error reoccurs whenever any page navigation link is selected.
 
The above link shows how the problem started and was worked.  Some progress and improvement was made, however the problem still exists.  But at least it is now being contained (controlled).  I Hope.
 
Thanking you for any help that can be offered.  Here's the DDS log.  The Attach.txt file here
 attach.zip   3.31KB
  0 downloads
 
 
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702
Run by Administrator at 13:27:33 on 2013-0... Read more

A:IE8 being redirected only on some sites

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.===Please download ComboFix from one of these locations:Link 1Link 2IMPORTANT !!! Save ComboFix.exe to your DesktopDisable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.Double click on ComboFix.exe & follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.Some Rookit infection may damage your boot sector. The Windows Recovery Console may be needed to restore it. Do not bypass this installation. You may regret it.**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recov... Read more

Read other 17 answers
RELEVANCY SCORE 72.4

I keep getting redirected to other sites while I'm online and pop-ups are are coming up on my screen when I'm not even on the computer. I keep running spybot and adaware and "Roings" keeps showing up, even though I keep deleting it. Could someone please help? Here's my Hijack This log. Thanks.

Logfile of HijackThis v1.97.7
Scan saved at 3:21:14 PM, on 6/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\PROMon.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\npqmbcfx.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Logitech\ImageStudio\LowLight.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINDOWS\System32\svchost.exe
C:\Documents and S... Read more

A:I'm being redirected to other sites--Please help!

First you need to unzip (extract) Hijack This and move it to a permanent folder. It will not function properly when run from the zip folder or the Temp folder.

You need to create a new folder in My Documents and name it Hijack This. Right click on the HijackThis.zip file and choose "Extract all" and extract it to the Hijack This folder you created. That way it can create and restore backups if needed. HJT will store the backups in the same location that it is run from.

Go to Add/Remove programs and uninstall Broadjump.

Aslo uninstall SpyKiller if you have not paid for it. It isn't worth having. Adaware and Spybot are better for free.

Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: (no name) - {08227B4B-54FE-4C4D-809F-BCA46292FC5B} - C:\WINDOWS\System32\Zedd4.dll

O2 - BHO: (no name) - {09B45AF3-F08B-474B-9CF3-598FFACA2C7F} - C:\WINDOWS\xlkoizt.dll

O2 - BHO: (no name) - {D7D3B75B-1BB1-4315-91BA-127820EEABB4} - C:\WINDOWS\glicvz.dll

O2 - BHO: (no name) - {EFF80427-F837-4B74-8834-BAF18E0553FD} - c:\PROGRA~1\System\Misc\mbh19.dll

O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [tgcmd] "C:\Progr... Read more

Read other 2 answers
RELEVANCY SCORE 72.4

Hey whenever I goto google or something and click on a result that comes up when I search for something, it redirects me to all these random sites. One that I can remember is like btcar.com.. Anyone know why it's doing this? I dont have much installed on my comp.. tried removing spyware with adaware and it did nothing.

thanks in advance
 

A:Help please, being redirected to other sites

here's my hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 4:57:09 PM, on 27/05/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\WinRoll\winroll.exe
C:\Program Files\trayit!\trayit!.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
C:\Program Files\Full Tilt Poker\FullTiltPoker.exe
C:\Program Files\PokerRoom.com\PokerRoom.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.1... Read more

Read other 2 answers
RELEVANCY SCORE 72.4

When I use IE or Chrome I keep getting redirected to advertisement sites. I am new to this so I hope this is the right place to show log..Thank you for any help you can give me!
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:35:36 PM, on 6/6/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Emsisoft Anti-Malware\a2service.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Novatel Wireless\Novacore\Server\NvtlSrvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\Program Files\Novatel Wireless\Virgin Mobile\MobiLink3.exe
C:\Documents and Settings\RUSS\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\RUSS\Local Settings\Application Data\Google\Chrome\Application\ch... Read more

Read other answers
RELEVANCY SCORE 72.4

ie7 is being redirected to additional sites from google search.

attached is the hijackthis log any help appreciated.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:23:59, on 30/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrs... Read more

A:ie7 being redirected to other sites

Don't worry I've managed to fix it by running fixwareout and checking other posts on your forum.
Thanks anyway I'm sure I'll be back with a few more issues.
Great
 

Read other 1 answers
RELEVANCY SCORE 72.4

I'm having some problems with my internet... I use Firefox and have found certain sites which simply will not load. At first I thought it was a problem with my ISP, because i just got a new one and its only happened since then, so I spent a long time on the phone with them trying to resolve it (pinging the sites and getting static IP's etc) with no luck... It was only when I tested the problem in IE and I found that the addresses were actually being redirected to random search engine sites etc, but in firefox it simply comes up with the page "The connection was reset: The connection to the server was reset while the page was loading."

I have done many many many adaware, spybot, mcafee, avast antivirus, AVG, a squared etc scans both in and out of safe mode but still cant resolve the problem. I read this post and followed the first step of running FixWareout and below are the logfiles that and also from HighjackThis. Just wondering what to do next...


Username "User" - 14/09/2007 9:36:03 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Successfully flushed the DNS Resolver Cache.
System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\\WINDOWS\\system... Read more

Read other answers
RELEVANCY SCORE 72.4

Help me enlightened tech guys:

Logfile of HijackThis v1.99.1
Scan saved at 7:20:55 PM, on 6/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\BacsTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\Common Files\AOL\1143407860\ee\AOLSoftware.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CMPDPSRV.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WIN... Read more

A:redirected to sites/pop ups

Read other 7 answers
RELEVANCY SCORE 72.4

I'm new to this forum and site and have little pc knowledge. Whenever if try to go to a website, i get re-directed all over the place. I'm not certain what other information to provide to you or what i need to run for help. I appreciate anything that you can do for me. I'm completely stuck and unable to get to any site; even to search for help. thanks
 

A:redirected sites

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:38:32 PM, on 3/29/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\StacSV.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\System32\svchost.ex... Read more

Read other 1 answers
RELEVANCY SCORE 72.4

Everytime I click a link when i search for something, i get redirected to other sites. Please advise!!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:11:08 PM, on 3/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Allume\StuffIt\MXTask.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Allume\StuffIt\mxtask.exe
C:\P... Read more

A:Keep Getting Redirected to other sites

Read other 6 answers
RELEVANCY SCORE 72.4

This is my girlfriends laptop and she asked if i could sort it out, i said no but i know people who CAN....... she keeps being redirected to other sites and has to click the back button on the browser to gain access to the site she was searching for, i tried running spybot s&d and it found something resembling the problem but wouldnt all me to delete it, saying something along the lines of system 32 or access denied cant remember what exactly....... HJT log below...... please please please help me out and turn me (you) back into her hero

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:58:54, on 29/06/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Fi... Read more

A:Keep being redirected to other sites

Read other 16 answers
RELEVANCY SCORE 72.4

I keep getting redirected from google searches to other sites. Also my computer no longer recognizes my Disc Drive as Burner. And I get the blue screen that says physical memory dump when I play games.
Thanks in Advance.

Heres My Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:31:58 AM, on 7/20/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\Driver\i386\ms-java.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\AIM6\aim6.exe
C:\pro... Read more

A:Redirected to other sites and more

bump
 

Read other 2 answers
RELEVANCY SCORE 72.4

Hi,
Firefox browser has been redirecting me to other sites while browsing lately. The ad-sites that I get redirected to open up a new tab and are completely unrelated to the sites which i am surfing on. Some of the sites that have been popping up randomly are

craveonline.com
savecompare.com

I've ran Combofix, AVG, Ad-Aware, and I'm running Spybot Search and Destroy right now. Nothing has fixed it so far. I've tried doing a clean re-install of firefox and I even system restored it to a week ago. Please help me! Thanks!

A:Being redirected to ad sites

Here is my HiJackThis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:26:23 PM, on 4/18/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\TurboV\TurboV.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Micro... Read more

Read other 2 answers
RELEVANCY SCORE 72.4

Hello I was recently being helped clean off virus on pc, but im still getting redirected to bad sites whenever I want to go to sites, I keep getting redirected. Im not sure if the virus is still on my pc. Can some please help me again?

I have a windows 7 32 bit operating system, home premium
 

A:Keep getting redirected to bad sites

Read other 7 answers
RELEVANCY SCORE 72.4

Hi, and thanks for your interest. I have been researching as much as I can about this, because I know how frustrating it can be having to deal with some people on here. I bought this computer from my fiancee's friend. Come to find out, he'd had like 4 viruses and many other problems. I have eliminated almost all of the threats I've found on my computer, but I am still having trouble. Every now and then, I have websites being redirected (especially when clicking on ads on Google, and ALSO anytime I try and download ANYTHING from Microsoft.com's download center- you can imagine the problems there).Just wondering what these lines are in the 017 section of my log and if this is what is causing these problems. Here is the last (and hopefully final) HijackThis log from my computer, posted on networktechs.com : http://hjt.networktechs.com/parse.php?log=554347 . Any further assistance would be GREATLY appreciated! Thanks!PS: The R3 line has been removed already, sorry for that still being on there.

A:017 help- sites being redirected.

xThe use of auto-HJT analyzers is not recommended by BC.Please follow the instructions here and post anew.This thread is closed.

Read other 1 answers
RELEVANCY SCORE 72.4

Hi,
Using IE explorer or Firefox with JavaScript disabled or no browser at all I get sent to other web sites at random times. I have used all the usual scanning software (spybot, Symantec, Windows defender, smitfraudfix) with no change in behavior. On running HJT and listing the startup information I see wobupobu.dll and higawaka.dll listed. I believe these are known bad guys. I searched for them and found nothing on my computer. I've attached a small portion of this startup log following the DDS.txt listing. Any suggestions on how to stop this hijacking? thanks,


DDS (Ver_09-02-01.01) - NTFSx86
Run by NoMoreViruses at 8:53:07.33 on Wed 02/25/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1323 [GMT -5:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\Syst... Read more

A:Redirected to other web sites

Welcome to the BleepingComputer Forums. Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again. Double click on RSIT.exe to run RSIT. Click Continue at the disclaimer screen. Please post the contents of log.txt. Thank you for your patience.Please see Preparation Guide for use before posting about your potential Malware problem. If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped. Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so. While we are working on your HijackThis log, please: Reply to this thread; do not start another! Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so. Do not run any other tool until instruc... Read more

Read other 2 answers
RELEVANCY SCORE 72.4

I'm getting redirected to other sites. My homepage is normally google.com, but sometimes when I open internet explorer google from other countries open up... I'll apologize in advance if I didn't post these logs correctly; I am not computer savvy

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:02:49 AM, on 2/8/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\AVG\AVG2012\avgnsx.exe
C:\Program Files\AVG\AVG2012\avgemcx.exe
C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files\Common Files\Micro... Read more

A:I'm getting redirected to other sites

Read other 16 answers
RELEVANCY SCORE 72.4

Good afternoon:
When using the search function on IE or any other internet browser, I am being redirected to sites which are different from my selection. The problem started a few days ago, and is becoming very annoying. Can someone help me with this?
 

A:Help! Being redirected to other sites

Read other 7 answers
RELEVANCY SCORE 72.4

McAfee expired in Feb. I updated it today & ran a scan. It showed 1 infected item & I deleted it. Rebooted got on net & still I am being redirected to gateway search engine? I can get on any site I want for a few minutes, then it redirects me.

Not sure how to tell you about my system. But I know that I run Windows Vista.

Any help is GREATLY appreciated.
 

Read other answers
RELEVANCY SCORE 72.4

Also, it seems to only happen when I use Google Chrome, searched a couple of times with Firefox and gave me no trouble. Did the same with IE and still nothing was out of the ordinary.

Haven't done anything yet other that use Defogger and disabled CD Emulation Drivers.

A:Being redirected to sites other than what I was going for

DownloadTDSSkillerLaunch it.Click on change parameters-Select TDLFS file systemClick on "Scan".Please post the LOG report(log file should be in your C drive) Do not change the default options on scan resultsDownloadaswMBRLaunch it, allow it to download latest Avast! virus definitionsClick the "Scan" button to start scan.After scan finishes,click on Save logPost the log results here.If you get crashes in normal mode,run it in safemode with networkingDownloadESET online scannerInstall itClick on START,it should download the virus definitionsWhen scan gets completed,click on LIST of found threatsExport the list to desktop,copy the contents of the text file in your reply

Read other 10 answers
RELEVANCY SCORE 72.4

Hi
Just wondered if you could give me some guidance???
I am using Windows Vista and every time I go to a website via a search engine, I click on the website and get redirected to sites such as bing and ad sites.
I ran a sytsen scan and nothing has been picked up so am at a bit of a standstill....not sure what to do and have limited knowledge regarding pc's.
Many thanks

A:Keep getting redirected to other sites

Hello and welcome. Let's start here. Reboot into Safe Mode with Networking How to enter safe modeUsing the F8 MethodRestart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. Select the option for Safe Mode with Networking using the arrow keys. Then press enter on your keyboard to boot into Safe Mode. >>>> Download this file and doubleclick on it to run it. Allow the information to be merged with the registry.RKill....Download and Run RKillPlease download RKill by Grinler from one of the 4 links

below and save it to your desktop.

Link 1
Link 2
Link 3
Link 4

Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as

malicious. Please refer to this page if you are not sure how.
Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As

Administrator)
A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
If nothing happens or if the tool does not run, please let me know in your next replyDo not reboot your computer after running rkill as the... Read more

Read other 11 answers
RELEVANCY SCORE 71.6

Hi,I have a similar problem to GreyFuss. I have no trouble with .com sites, but all .co.uk sites are redirected to different addresses with the same layout. In the last two days, both Norton Antivirus and AVG have detected 'downloader' viruses which appear to have been successfully deleted.Here's the HijackThis log.Thanks for any help you can give here.Logfile of HijackThis v1.99.1Scan saved at 12:29:47 PM, on 12/2/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.5730.0011)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeC:\Program Files\... Read more

A:All .co.uk Sites Redirected, .com Fine

Hello there and welcome to Bleeping Computer's security forum.My name is David, I will be helping you with your log today.It is a good idea to print off these instructions. There is a possibility some of the instructions will need to be carried out where internet access is not available.A print out of the instructions would be a good reference to make sure you don't yet lost.Also, it is important that you complete the instructions in the right order, and that you don't miss out any steps.If you have any queries about the process or just general questions, just ask.Step #1WeatherBug is a system tray icon that offers weather information and includes built-in ads. WeatherBug is controlled by AWS Convergence Technologies.There is some controversy over whether WeatherBug should be targeted by anti-parasite software. AWS strongly deny their software is ?spyware?, and by the definition used here, it is not, as it does not leak information back to its controlling servers. However, WeatherBug has in the past been silently installed by the FavoriteMan parasite and Freeze.com screensavers, and more recently has been bundled by software such as AIM and Blubster. This makes it ?unsolicited?, and since it is installed to raise money for its creators through the built-in ads it is certainly ?commercial?. So it does meet the definition for ?parasite?: unsolicited commercial software. It is nonetheless listed as a borderline case because it is not overtly harmful and many people do install it... Read more

Read other 9 answers
RELEVANCY SCORE 71.6

I had Anti Solutions Pro try to hijack my system. I though I got rid of it, but now any web browser I use opens new windows with links to local shopping sites or web searches are redirected to different unrelated sites. The only way I got to access this site was by using the cache link and then saving it as favorites. I have run AVG, Malwarebytes, Spybot, SuperAntiSpyware, Ad-Aware, hijackthis, and OTS still nothing works. This is my work computer and I really could use some help. Here is a copy of the hijackthis report.

Thanks,
Labfvr

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:32:34 AM, on 7/30/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\A... Read more

A:Any web Browser I use gets redirected to other sites

I want to post an update. Everytime I login to the techguy forum or my email, I get multiple new windows opening for survey, shopping, adware, and "congratulations you are a winner." Please help. This seems to be getting worse.

Labfvr
 

Read other 1 answers
RELEVANCY SCORE 71.6

First time poster here. I found your forum because my dad infected our brand new PC with PRCViewer, or something like that and I found out how to get rid of it on here. Thanks so much for that.

Here's my current problem.

When I go to www.hotmail.com to check my email and click on the login button it automatically redirects me to a search page and at the top it says "http://rad.msn.com/ADSAsClient31.dll%3fGetAd%3FPG could not be found, here are some posible matches"

When I try to go to my internet service provider (PeoplePC) home.peoplepc.com to check my webmail there it redirects me to a search page and says, "http://ad.doubleclick.bet/adi/home.peoplepc.dart/home_sky%3Bsz could not be found, here are some possible matches."

This is really irratating and confusing for me. I just want to check my email!! Also, my SpySweeper and MCAfee scans come up clean.
 

A:Being Redirected to Search Sites

Read other 12 answers