Strange things happening with Google and other search engines.

[Desslok]

When I do a search and the engine comes up with the results and click on the links I keep getting redirected to 4 different search engines. I did a scan with Norton AV 2003 and GFi's trojan scanner along with AVG AV program and they didn't find anything. I also used adaware and spybot search and destroy. I caught TMKsrvu trying to call out and when I looked it up it is a known trojan. Any suggestions on what else to try and get rid of the redirects?

Thanks

 

[hjo3]

Check your HOSTS file...?

 

[Eli]

format C:

....

setup

.....

Fresh install at your service!

 

[Desslok]

Originally posted by: Eli
format C: .... setup ..... Fresh install at your service!

No thanks.

 

[5ayle]

Me too! It pisses me off so much!
WTF is that???

what's a HOSTS file and how does it relate to bastards raping my results links?





EDIT: lapse of idiocy

 

[Skyclad1uhm1]

There is a trojan which modifies your hosts file so you cannot access antivir sites. Either download one on another PC, reformat this one, or call in the help of someone who is more experienced in finding out which trojan it might be and removing it.

 

[Sid59]

Originally posted by: hjo3
Check your HOSTS file...?

indeed. impprtant that you keep it to READ ONLY so programs can't alter it.

path in windows XP to it ..

windows (winnt) / system32 / drivers / etc


i suggest you make a copy of it to the same folder ("copy of hosts") and then edit your hostfile and set it to read only.

 

[Shockwave]

Originally posted by: Sid59

Originally posted by: hjo3
Check your HOSTS file...?

indeed. impprtant that you keep it to READ ONLY so programs can't alter it.

path in windows XP to it ..

windows (winnt) / system32 / drivers / etc


i suggest you make a copy of it to the same folder ("copy of hosts") and then edit your hostfile and set it to read only.

I never knew this.
*filing into FYI section of brain*

 

[Chuck1234]

Originally posted by: Sid59

Originally posted by: hjo3
Check your HOSTS file...?

indeed. impprtant that you keep it to READ ONLY so programs can't alter it.

path in windows XP to it ..

windows (winnt) / system32 / drivers / etc


i suggest you make a copy of it to the same folder ("copy of hosts") and then edit your hostfile and set it to read only.

interesting.. so what should I look for in host file? should there be any entry that I should delete?
thanks for info

 

[Evadman]

viri can change the read only atribute relitively easily.

 

[amdskip]

Hijacked host file. I fixed a computer where I had to change the path in the registry from the "new" junk host file to the old host file and delete the junk one.

 

[Sid59]

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost


that;s the only thing my host file has. i had problems a looong time with kazaa lite messing somethings up.

 

[TechnoKid]

Also, try a program called CWShredder.

 

[TheBoyBlunder]

Try Hijack This! But be careful what you delete with it, you can erase something important very easily.

 

[hevnsnt]

Yup, I just had to fix my friends computer with this exact situation.

here is how I did it.

1) Downloaded Adaware & updated then scanned & fixed.
2) searched the windows directory for 'hosts' opened it in notepad
2a) removed all the junk entries (everything but the 127.0.0.1)
3) made hosts file read only.
4) told him to stop clicking on yes.

 

[Skyclad1uhm1]

Btw, the trojan I mentioned also changes the place Windows looks for the hosts file, so it can leave the original unchanged (in case you check that).

Not sure if this is the setting, but check what the DataBasePath in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters is, for me it is %SystemRoot%\System32\drivers\etc.