All URL's are redirected

[Bazsl]

My daughter has an XP Home machine that is behaving strangely to the point
that it is unusable. There are a number of symptoms including slow
performance but one of the most annoying is that when she types a URL into IE
she is always redirected to another Web site. My first assumption was a virus
but she has a current version of McAfee installed.

Any suggestions about how to diagnose and fix this problem? I realize I have
provided very little information. If you need more details let me know what
you need and I will try to get it. Thanks.

 

[Paul]

My daughter has an XP Home machine that is behaving strangely to the point
that it is unusable. There are a number of symptoms including slow
performance but one of the most annoying is that when she types a URL into IE
she is always redirected to another Web site. My first assumption was a virus
but she has a current version of McAfee installed.

Any suggestions about how to diagnose and fix this problem? I realize I have
provided very little information. If you need more details let me know what
you need and I will try to get it. Thanks.

It could still be malware. Alureon (TDSS) is a root kit (hides itself), with
the mission of redirecting people to web sites, such that the authors of the
software make money from advertising revenue.

http://en.wikipedia.org/wiki/Alureon

http://www.symantec.com/security_response/writeup.jsp?docid=2008-091809-0911-99&tabid=2

No AV software is perfect. They all only cover a percentage of all malware,
and new variants can get through (between the window of introduction,
until new virus definitions are sent in an update). So something very well
could get through. This web site, for example, tests AV software, and
rates them according to thoroughness.

http://www.av-comparatives.org/comparativesreviews/main-tests

There are a number of scanning tools available. If the computer has
a high speed Internet connection with DHCP for giving out IP addresses,
you can use a bootable CD like this one. Once started, this one downloads
fresh virus definitions, and you can use it to scan the partitions on
the hard drive. So this would be an example of an "offline scanner",
since WinXP is not running when this is at work.

http://devbuilds.kaspersky-labs.com/devbuilds/RescueDisk10/

The download is 200MB, and you need a tool such as Nero or Imgburn (free)
to convert an ISO9660 file, into a bootable CD. You can't just drag and
drop that file onto a CD, as it won't boot that way.

I have no idea what happens, if all you have is dialup networking.
It does have a virus database, and all it does when getting updates,
is get the latest definitions, rather than fetching the whole
database over again.

Once the infected computer boots with that disk, the software will
automatically connect to Kaspersky and get fresh definitions. Then
see what it detects, and that will tell you how effective McAfee is.
There are plenty of other tools like that around, and checking previous
threads in this group, for previous answers to malware questions, will
uncover other methods.

With the current condition the laptop is in, it may not be possible to
utilize an "on-line" scanner, while the infected WinXP is running.
You may have to bring tools over to the laptop, on media of some sort
(a CD is safest, because being read-only, it can't propagate an infection
to the "clean" computer). And even if you do that, if any tool needs updated
virus definitions, the fact your IP lookup is hijacked, is going to make
getting updates a problem.

You can try running MBAM on it, if you want.

http://www.malwarebytes.org/

You can see here, that the downloaded file may need to be renamed, in order
to be able to use it. And even that might not be enough.

http://forums.malwarebytes.org/index.php?showtopic=23983

http://forums.malwarebytes.org/index.php?showtopic=12709

The advantage of an offline scan, is at least it isn't fighting
with the malware actively. MBAM actually works best, on a
running system, but not when it cannot be made to execute.

Paul

 

[Sohail]

My daughter has an XP Home machine that is behaving strangely to the point
that it is unusable. There are a number of symptoms including slow
performance but one of the most annoying is that when she types a URL into IE
she is always redirected to another Web site. My first assumption was a virus
but she has a current version of McAfee installed.

Any suggestions about how to diagnose and fix this problem? I realize I have
provided very little information. If you need more details let me know what
you need and I will try to get it. Thanks.

I had the same type of problem, although long ago. I remember using
Adaware from lavasoft (http://www.lavasoft.com/products/
ad_aware_free.php). Also, try to disable or remove all pugins,
toolbars that have been installed in IE.

Let's see if it helps.

regards

Sohail

 

[PA Bear [MS MVP]]

Is WinXP SP3 installed?

Is KB979559 installed?

What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other than Defender)?
What third-party firewall (if any)?

Has a(nother) Norton or McAfee application ever been installed on the
computer?

Did a Norton or McAfee free-trial come preinstalled on the computer when you
bought it? (Doesn't matter if you never used or Activated it.)

 

[waresoft]

;3398677']Is WinXP SP3 installed?

Is KB979559 installed?

What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other tha
Defender)?
What third-party firewall (if any)?

Has a(nother) Norton or McAfee application ever been installed on the
computer?

Did a Norton or McAfee free-trial come preinstalled on the computer whe
you
bought it? (Doesn't matter if you never used or Activated it.)

Bazsl wrote:-
My daughter has an XP Home machine that is behaving strangely to th
point
that it is unusable. There are a number of symptoms including slow
performance but one of the most annoying is that when she types a UR
into
IE she is always redirected to another Web site. My first assumptio
was a
virus but she has a current version of McAfee installed.

Any suggestions about how to diagnose and fix this problem? I realize

have
provided very little information. If you need more details let me kno

what
you need and I will try to get it. Thanks. -

Sounds like she has a rootkit. Download 'SuperAntiSpyware
(http://www.superantispyware.com/download.html) with another compute
and copy it to a thumbdrive or CD. Then use it to remove the rootkit

 

[PA Bear [MS MVP]]

WTF are you replying to my post?

;3398677']Is WinXP SP3 installed?

Is KB979559 installed?

What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other than
Defender)?
What third-party firewall (if any)?

Has a(nother) Norton or McAfee application ever been installed on the
computer?

Did a Norton or McAfee free-trial come preinstalled on the computer when
you
bought it? (Doesn't matter if you never used or Activated it.)

Bazsl wrote:-
My daughter has an XP Home machine that is behaving strangely to the
point
that it is unusable. There are a number of symptoms including slow
performance but one of the most annoying is that when she types a URL
into
IE she is always redirected to another Web site. My first assumption
was a
virus but she has a current version of McAfee installed.

Any suggestions about how to diagnose and fix this problem? I realize I

have
provided very little information. If you need more details let me know

what
you need and I will try to get it. Thanks. -

Sounds like she has a rootkit. Download 'SuperAntiSpyware'
(http://www.superantispyware.com/download.html) with another computer
and copy it to a thumbdrive or CD. Then use it to remove the rootkit.

 

[waresoft]

I'm sorry for any confusion. I was reply to the original post b
bazsl.

;3398725']WTF are you replying to my post?

waresoft wrote:-
'PA Bear [MS MVP Wrote:-
;3398677']Is WinXP SP3 installed?

Is KB979559 installed?

What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other than
Defender)?
What third-party firewall (if any)?

Has a(nother) Norton or McAfee application ever been installed on the
computer?

Did a Norton or McAfee free-trial come preinstalled on the compute
when
you
bought it? (Doesn't matter if you never used or Activated it.)

Bazsl wrote:-
My daughter has an XP Home machine that is behaving strangely to the
point
that it is unusable. There are a number of symptoms including slow
performance but one of the most annoying is that when she types a URL
into
IE she is always redirected to another Web site. My first assumption
was a
virus but she has a current version of McAfee installed.

Any suggestions about how to diagnose and fix this problem? I realiz
I

have
provided very little information. If you need more details let me know

what
you need and I will try to get it. Thanks. --

Sounds like she has a rootkit. Download 'SuperAntiSpyware'
(http://www.superantispyware.com/download.html) with another computer
and copy it to a thumbdrive or CD. Then use it to remove the rootkit.

 

[Twayne]

In

My daughter has an XP Home machine that is behaving
strangely to the point that it is unusable. There are a
number of symptoms including slow performance but one of
the most annoying is that when she types a URL into IE she
is always redirected to another Web site. My first
assumption was a virus but she has a current version of
McAfee installed.

Any suggestions about how to diagnose and fix this problem?
I realize I have provided very little information. If you
need more details let me know what you need and I will try
to get it. Thanks.

Yes. Make sure McAfee is updated, then run it again in its most thorough
mode.
McAfee (or any AV) not finding anything does NOT mean the machine isn't
compromised n some other way. You also need to run at least 3 anti spyware
programs. If you don't know what they are, ask here; there at lots of good
ones out there and some really bad ones you want to be sure to avoid.

HTH,

Twayne`

 

[Do Dah Zippity]

No, you were replying to someone else.
:
: I'm sorry for any confusion. I was reply to the original post by
: bazsl.
:
: 'PA Bear [MS MVP Wrote:
: > ;3398725']WTF are you replying to my post?
: >
: > waresoft wrote:-
: > 'PA Bear [MS MVP Wrote:-
: > ;3398677']Is WinXP SP3 installed?
: >
: > Is KB979559 installed?
: >
: > What anti-virus application or security suite is installed and is your
: > subscription current? What anti-spyware applications (other than
: > Defender)?
: > What third-party firewall (if any)?
: >
: > Has a(nother) Norton or McAfee application ever been installed on the
: > computer?
: >
: > Did a Norton or McAfee free-trial come preinstalled on the computer
: > when
: > you
: > bought it? (Doesn't matter if you never used or Activated it.)
: >
: > Bazsl wrote:-
: > My daughter has an XP Home machine that is behaving strangely to the
: > point
: > that it is unusable. There are a number of symptoms including slow
: > performance but one of the most annoying is that when she types a URL
: > into
: > IE she is always redirected to another Web site. My first assumption
: > was a
: > virus but she has a current version of McAfee installed.
: >
: > Any suggestions about how to diagnose and fix this problem? I realize
: > I
: >
: > have
: > provided very little information. If you need more details let me know
: >
: > what
: > you need and I will try to get it. Thanks. --
: >
: > Sounds like she has a rootkit. Download 'SuperAntiSpyware'
: > (http://www.superantispyware.com/download.html) with another computer
: > and copy it to a thumbdrive or CD. Then use it to remove the rootkit.-
:
:
:
:
: --
: waresoft