Help! My system has been hijacked.

[Super6]

These past few weeks, gradually at first, most links from searches (google, etc.) and seemingly most web sites now, take me to other sites, usually commerce related. Most of the time I'll get a momentary screen saying I'm being redirected in a few seconds and I'll end up on a site with lists of links usually unrelated to the original search. Other times I end up at eBay, Amazon, etc. This is happening with IE, Mozilla, and Opera.

I have lots of security software and have hammered my system with scans along with many manual searches but nothing has come up. My main system is out of action and this is my "gaming" system which is operating in a backup mode so a clean install is out of the question for the moment plus I run the risk of backing up needed stuff and reinstalling my "problem" assuming it resides in my system. I can't find any questionable programs or processes and it's driving me nuts. I have DSL, usually on 24/7, with an ethernet connection. XP Pro is totally up-to-date. The system runs fine. So it is an internet issue. If I click on a link in this forum there is an 80% chance I'll end up at Sam's Club. All redirects are commerce related....I haven't ended up at a single porn site!

Other than this goblin there is no junk in my systems from the registries to the drives to the browsers. My last programming experience was in 1977 at FSU writng Basic. So I rely on the best software tools I can find to keep things running well. I build and o/c the hardware with lots of operating system tweeks for performance and security. My wife's notebook on the wireless network is not affected.

Any advice would be appreciated.

Super6

 

[mechBgon]

1) What antivirus and antispyware software have you used so far?

2) Did they find any bad stuff at all? If so, what (look in the logs/reports or from memory)?

3) click Start > Run, put cmd in the Run box and click OK. In the command-line window, type IPCONFIG /ALL and look to see what your DNS servers are. If they start with an 85 then you probably have been DNSChanger'd among other things, but that can be just one tip of the iceberg.


As a general starting point, you could try this routine. Note the exact names of whatever malware is discovered along the way. When you're done, maybe post another HijackThis log to see what might be left.


1. REMOVE ROOTKITS

Scan for rootkits using Panda AntiRootkit and McAfee Rootkit Detective:

http://www.majorgeeks.com/Panda_Anti-Rootkit_d5457.html
http://vil.nai.com/vil/stinger/rkstinger.aspx


2. REMOVE VIRUSES, WORMS, AND TROJANS

Make sure your antivirus is current-generation software, not old stuff from several years ago. Update your antivirus software's virus definitions/DATs, then run a full antivirus scan. Besides your own antivirus software, also get a "second opinion" from some additional online antivirus scanners, such as these, for increased coverage (no single company detects all malware):

http://support.f-secure.com/enu/home/ols.shtml
http://www.pandasoftware.com/products/activescan.htm
http://housecall.trendmicro.com


3. REMOVE SPYWARE AND ADWARE

Scan for spyware using SUPERAntiSpyware's free version:
http://www.superantispyware.com

Scan for spyware using Spybot Search & Destroy, which is also free:
http://www.safer-networking.org


4. ADVANCED TECHNIQUES

After the preceeding steps, run HijackThis. Start Windows in Safe Mode to use HijackThis (HJT) most effectively. If you get an error when you run HJT, rename it to something random and run it again (some malware will block it by name):

http://www.spywareinfo.com/~merijn/programs.php
http://hijackthis.de/en (online HJT logfile analyzer)

To start Windows in Safe Mode so you can run HijackThis properly, begin tapping the F8 key (preceded by the F-Lock key, if your keyboard has one) when you know the first Windows startup screen is about to show, the one with the scrolling bar. If you want access to the online log analyzer, you can start in Safe Mode With Networking instead.

Next, run SmitFraudFix, following these directions: http://siri.urz.free.fr/Fix/SmitfraudFix_En.php It?s not unusual for this download to be detected by antivirus software because some of the files it contains could be used for malicious purposes. In this case, however, it?s OK.