Google Redirection?

I

insaniity

New Member
Its not a virus i know that much. I ran Spybot S&D, got rid of any viruses it got and Mallware Bytes, again, removed everything. Even ran McAfee and got rid of whatever. But each time i run the scan on Spybot S&D it finds site that redirect me. I press fix selected items but it responds by saying "cannot access hosts file. Access is denied" I tried to untick the "protect hosts file form hijackers" in IE tweaks but keeps getting checked. On top of that the Hosts file is missing. Any help? :confused:
 

My Computer

System One

  • Manufacturer/Model
    hp
    CPU
    AMD Athlon 64 X2 Dual Core Processor 3800+
thanks for the reply but all it showed was this log:

Code: 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:40:12 PM, on 27/11/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal
 
Running processes:
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Users\Luka\Downloads\Programs\Sunblet Personal Firewall\SbPFCl.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Codebox\BitMeter\BitMeter2.exe
C:\Users\Luka\Downloads\Programs\Rainmeter\Rainmeter.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Luka\Downloads\Programs\Firefox\Firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\explorer.exe
C:\Users\Luka\Downloads\HijackThis.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [URL="http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=71&bd=Pavilion&pf=desktop"]AOL.ca - Canada's Breaking News, Entertainment, Music, Life & Style and Email[/URL]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [URL="http://go.microsoft.com/fwlink/?LinkId=54896"]Bing[/URL]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [URL="http://google.ca/"]Google[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [URL="http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=71&bd=Pavilion&pf=desktop"]AOL.ca - Canada's Breaking News, Entertainment, Music, Life & Style and Email[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [URL="http://go.microsoft.com/fwlink/?LinkId=54896"]Bing[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [URL="http://go.microsoft.com/fwlink/?LinkId=54896"]Bing[/URL]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [URL="http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=71&bd=Pavilion&pf=desktop"]AOL.ca - Canada's Breaking News, Entertainment, Music, Life & Style and Email[/URL]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Rainmeter - Shortcut.lnk = Luka\Downloads\Programs\Rainmeter\Rainmeter.exe
O4 - Global Startup: Bitmeter2.lnk = C:\Program Files\Codebox\BitMeter\BitMeter2.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {D1278801-B2C0-4332-BD3E-2F64D2204EDF} (Windows Live Mesh Upload Tool) - [URL]https://www.mesh.com/0.9.4014.13/TSWeb.cab[/URL]
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - [URL]http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab[/URL]
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISP Monitor (ISPMonitorSrv) - How2 Studios - C:\Program Files\ISP Monitor\ISPMonitorSrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Users\Luka\Downloads\Programs\Sunblet Personal Firewall\SbPFLnch.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Serv - Unknown owner - C:\kRBgix.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Users\Luka\Downloads\Programs\Sunblet Personal Firewall\SbPFSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Users\Luka\Downloads\Programs\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: Windows Remote Management (WS-Management) WinRM Licensing Service (WinRM Licensing Service) - Unknown owner - C:\Windows\system32\aaclientr.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
 
--
End of file - 10317 bytes
 

My Computer

System One

  • Manufacturer/Model
    hp
    CPU
    AMD Athlon 64 X2 Dual Core Processor 3800+
insaniity said:
Its not a virus i know that much. I ran Spybot S&D, got rid of any viruses it got and Mallware Bytes, again, removed everything. Even ran McAfee and got rid of whatever. But each time i run the scan on Spybot S&D it finds site that redirect me. I press fix selected items but it responds by saying "cannot access hosts file. Access is denied" I tried to untick the "protect hosts file form hijackers" in IE tweaks but keeps getting checked. On top of that the Hosts file is missing. Any help? :confused:
Click to expand...

Hi Insanity, With Spybot search and destroy when you start it you need to right click on it & select "Run as Administrator" to apply any changes
 

My Computer

System One

  • Manufacturer/Model
    Hewlett Packard, compaq presario CQ60-305AU
    CPU
    AMD Athlon QI-46 2.1 Ghz
    Motherboard
    Wistron 303C
    Memory
    2048 Mb DDR2 SD Ram
    Graphics Card(s)
    NVidea GE Go Force 8200M G / 256Mb dedicated grapics memory
    Sound Card
    MCP78S NVidea High definition
    Monitor(s) Displays
    15.6" High Definition Brightview Widescreen
    Screen Resolution
    1336x768
    Hard Drives
    Toshiba MK2555GSX ATA
    Mouse
    Synaptics PS2/Touchpad
Try booting into safe mode to access the hosts file. Once you access it, make sure there are no redirections in it pointing a host to another IP.

If you may, Could you be a little bit more specific about your Google Redirection?
 

My Computer

System One

Hello insaniity,
Run HJThis again, check the boxes by these entries and get HJThis to fix them.
Backup when prompted.

O13 - Gopher Prefix:
O23 - Service: Serv - Unknown owner - C:\kRBgix.exe

Try this and post your results, good luck.
 

My Computer

System One

  • Manufacturer/Model
    Self Build
    CPU
    QX9650 (black box) [email protected]
    Motherboard
    Asus P5Q Premium
    Memory
    8GB-4x2GB Corsair Dominator DDR 2-1066
    Graphics Card(s)
    2 x ASUS EAH 4870 X 2 (Quad)
    Sound Card
    Supreme FX 2
    Monitor(s) Displays
    Fujitsu Siemens 22inch flat screen
    Screen Resolution
    1680x1050
    Hard Drives
    150 Gig WD Raptor
    300 Gig Maxtor
    300 Gig Maxtor, (External)
    PSU
    CoolerMaster 1000
    Case
    CoolerMaster N-Vidia stacker 830
    Cooling
    Noctua NH-U12P x 1x120mm fan, 6x120mm case fans
    Keyboard
    Logitech G15
    Mouse
    Logitech G5
    Internet Speed
    20Mbps
    Other Info
    Audio FX Pro 5+1 gaming head set
put this where your host file is


Blocking Unwanted Parasites with a Hosts File


Windows 7=C:\WINDOWS\SYSTEM32\DRIVERS\ETC
windows Vista=C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows XP=C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K=C:\WINNT\SYSTEM32\DRIVERS\ETC



~Carmine
 

My Computer

System One

  • Manufacturer/Model
    gateway/m6881
    CPU
    centrino core 2 duo 2.2ghz T7500
    Memory
    3GB
    Hard Drives
    500GB WD
    Mouse
    logitech
    Internet Speed
    fios 35MB not!!!!
You must log in or register to reply here.
Back
Top