Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[G-Flex]

If you're getting to the proper sites by typing in the addresses, then certainly DNS isn't the issue, nor is anything outside your network, or even outside the computers themselves. In that regard, there's almost no way the computers aren't infected with something.

Try using another browser entirely and see what happens, even if you have to install Firefox to do it.

Also, double-check your proxy settings in IE (and your TCP/IP settings in Windows just to make sure nothing is out of whack), and also check your IE add-ons page to make sure there isn't anything suspicious.

[Tellemurius]

I checked with Safari, Kbrowser and Firefox and still does redirect. Like i said, there was a proxy setup for my dad's computer but that was removed and i didn't find any on mine.  No addons are suspicious other than flash and java (worst programs ever >.>).

[G-Flex]

Not sure what you have against Java, but okay.

Out of curiosity, what sort of domains are you being redirected to? Also, have you run an antimalware scan yet?

[Tellemurius]

my Dad's IT friend did all of the scanning and i trust him for finding anything. i don't have a list right now buts stupid ad and fake search engine results pages but my dad gets the worst from fraud security messages.

[G-Flex]

Well, obviously there's something he didn't find, eh? ¯\(°_o)/¯

[Tellemurius]

guy got more training and exp. than me so yea if he failed then i royally screwed.

[G-Flex]

Not necessarily. Even professionals miss things sometimes.

Whatever scanning software you're running, update and run it. Then download and run a standalone (i.e. not installed) program like the portable version of SuperAntiSpyware (yes, I know the name is atrocious, but it's pretty legit). Try doing these in safe mode, if possible.

[Tellemurius]

used that XD, even malwarebytes and deleted the .tmp folder contents cause he found parts of a virus in there.

[G-Flex]

I'm at a loss, then. I know Avira has a bootable "Rescue System" ISO type deal that you could use, if you want to give that a shot.

[Tellemurius]

Urgh, Avira. Last time i used that it screwed up my Windows OS files, have they fixed it where it doesn't Rename the infected files?

[white_darkness]

You've already referenced add-ons, so that's a positive.  And yeah, flash is buggy...sh*te. 

Have you examined the currently running processes?  Some convenient places to look up info on processes would include:

Neuber Software:  fairly comprehensive list.

LiUtilities.com: Another nice comprehensive list of running processes.

Then go through the running services for the system:

Easy reference for Windows 7 (since I'm guessing both machines are running 7)

Black Viper's Windows 7 Service Pack 1 Service Configurations Covers all the standard stuff with Windows 7.  7 is nice in that it frequently includes descriptions of what something does in the services panel.

You may also want to check in the registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{random CLSID (ie. 48B64B72-C34D-2435-3FDD-4598C557FF7B) and then look for the NameServer key and see where it points.

That's for each individual adapter, those may be fine, there's also a NameServer key under parameters, which overrides the others, and typically should be blank.

Obviously backup first if you're really uncomfortable with cruising around the registry.


Scanned with Avira, it's alright, at least it wasn't AVG.  You could try AVAST free edition or Microsoft Security Essentials.  Depending on the situation, it might not be something that those things would pick up, a simple registry key change is one thing, a running process is another.

[Tellemurius]

Avast is a joke in the IT industry as so i heard, i know MSE is good as i used it. My father got Webroot but as you can tell it failed so his friend stuck AVG back in.

[white_darkness]

Only reason I referenced AVAST was the fact that it has a preboot scan option.  One of the best features I've encountered for it.

AVG though, oy...the masters of the false positive.

Really though, they're all a joke, if you want to come down to it.  The equivalent of locking the barn door after the horse got out.

[G-Flex]

You've already referenced add-ons, so that's a positive.  And yeah, flash is buggy...sh*te.

I can guarantee you beyond a shadow of a doubt that Flash Player is not causing browser redirects.

Black Viper's Windows 7 Service Pack 1 Service Configurations Covers all the standard stuff with Windows 7.  7 is nice in that it frequently includes descriptions of what something does in the services panel.

This guy isn't nearly as credible as tweakers seem to think he is. Way too much of a pretentious tweaker, and I've seen some sketchy information on his site. That being said, right now we're not tweaking, just using references for different services and so forth, so that's fine.

You may also want to check in the registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{random CLSID (ie. 48B64B72-C34D-2435-3FDD-4598C557FF7B) and then look for the NameServer key and see where it points.

That's for each individual adapter, those may be fine, there's also a NameServer key under parameters, which overrides the others, and typically should be blank.

He already said that he can access sites just fine by typing in their addresses. Name resolution is not the problem.


Tellemurius: Out of curiosity, what security software, if any, do you use on your computer?

[Tellemurius]

i use MSE as i have said, last detection was a trojan from Java (thats why i hate it) but its been my only one, my computer is in better shape than my father's i can tell you that.