Browser adds jibberish ahead of urls

[Treebeard]

Every time I try to visit a website by typing its url into
the address field, my browser will add some jibberish
ahead of the url. It is the same every time no matter
where I go.
For example, when I type: www.google.com It tries to take
me to: http://ehttp.cc/?www.google.com Which, of course,
doesn't exist, and if I try to go to: www.freehosts.tk It
tries to take me to: http://ehttp.cc/?www.freehosts.tk
Which also doesn't exist. Now, if I type:
http://www.google.com Or: http://www.freehosts.tk It has
no problem locating my site.
Does anyone know how to fix this?

 

[*Vanguard*]

"Treebeard" said in news:[email protected]:

Every time I try to visit a website by typing its url into
the address field, my browser will add some jibberish
ahead of the url. It is the same every time no matter
where I go.
For example, when I type: www.google.com It tries to take
me to: http://ehttp.cc/?www.google.com Which, of course,
doesn't exist, and if I try to go to: www.freehosts.tk It
tries to take me to: http://ehttp.cc/?www.freehosts.tk
Which also doesn't exist. Now, if I type:
http://www.google.com Or: http://www.freehosts.tk It has
no problem locating my site.
Does anyone know how to fix this?

It's not gibberish. Take a look at the resultant URL. Your original
URL becomes a parameter to a URL pointing at ehttp.cc (which does exist
and has an IP address of 69.56.220.74). Either you have been hijacked
or you installed something that needs to redirect your URLs through
their server. Google does the same when and only if you enable their
advanced features (Page Rank and Page Info) because you choose to become
part of their database which generates those statistics that you also
want to know about. For them to rank pages, they need to know how many
people actually visit those sites. For them to give you a list of
related sites, you have to tell them what sites you visit so they can
add that to a list of related sites so they can report it to you and
everyone else using that feature. I don't like them monitoring where I
navigate but mostly I don't want to rely on their servers being up so I
can get redirected through them.

ehttp.com is assigned IP address 69.56.220.74. This IP address is
registered to ThePlanet.com (which might be an ISP). Using a safe
browser, like SamSpade's Windows tool, you've been redirected to
69.56.220.74 (ehttp.com) which looks to then redirect you to
http://www.rightfinder.net/. Unless you know that you installed some
browsing software to do this, you have been hijacked. See
http://www.spywareinfo.com/~merijn/cwschronicles.html#addclass, and see
if CWShredder will wipe out this scumware.

 

[Frank Saunders, MS-MVP]

First eliminate any scumware.
See
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated before every use, even when just
downloaded. There's also a lot more to do than just those two programs.
CWShredder is also available here:
http://www.kellys-korner-xp.com/regs_edits/cwshredder.zip
**Post your HijackThis log to
http://forums.spywareinfo.com/ or the Spyware forum at
http://forum.aumha.org/ for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.
If trying everything at that site does not fix the problem please post back
in the same thread.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/