Searching from the address bar

[Faldo]

Hi, I've been doing searches from the address bar for the longest time with
no problems. I have it configured for Google searches. About two days ago
I've noticed when doing various searches it would redirect me to
buydomains.com instead of the google search results page.
For example: doing a search for chocolate, the result would open to
http://chocolate/home.jsp?domain=chocolate&track=true&referrer=&cm_mmc=
I've checked for various nasties and viruses with no negative results.
What could be causing this when doing searches with IE6 on windows me?

 

[siljaline]

Hi, I've been doing searches from the address bar for the longest time with
no problems. I have it configured for Google searches. About two days ago
I've noticed when doing various searches it would redirect me to
buydomains.com instead of the google search results page.
For example: doing a search for chocolate, the result would open to
http://chocolate/home.jsp?domain=chocolate&track=true&referrer=&cm_mmc=
I've checked for various nasties and viruses with no negative results.
What could be causing this when doing searches with IE6 on windows me?

Hi Faldo,
That's a hijack if I've ever heard of one.
What heave you run in checking for nasties, so that I don't prescribe something
that you've already done.

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[Faldo]

Thanks Silj,
I ran CWshredder2.18, Adaware6.20.0.236, Spybot1.4.0.3 and
Clamwin0.87(don't ask). All are up to date and all results are clean.
This redirection thing seems to happen only on keywords. http or www sites
work fine.

 

[siljaline]

Thanks Silj,
I ran CWshredder2.18, Adaware6.20.0.236, Spybot1.4.0.3 and
Clamwin0.87(don't ask). All are up to date and all results are clean.
This redirection thing seems to happen only on keywords. http or www sites
work fine.

Wondering out load why you didn't run MS anti-Spyware, Faldo?
Regardless - try this, should get you to the bottom of your problem.
Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)
Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)
Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.
*Note, registration is required prior to posting a log.
- Not listed in any particular order -
(http://aumha.net/viewforum.php?f=30)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/security)
(http://castlecops.com/forum67.html)
(http://www.cybertechhelp.com/forums/forumdisplay.php?f=25)
(http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html)
(http://gladiator-antivirus.com/forum/index.php?showforum=170)
(http://forum.iamnotageek.com/f-130.html)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)

If you elect to go the above route, please post back the URL *here*
/where/ you've posted your HijackThis log.

Good luck & post back if you should have any questions.

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[Faldo]

The results from HJT didn't detect any problem.


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links -
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file
missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM
FILES\AIM\AIM.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no
file)


I tried the repair option in add/remove with no change.

 

[siljaline]

The results from HJT didn't detect any problem.

<snip>
Please post your log to any of the Forums in my previous reply!

Post back the URL not the log here for me to follow-up.
Do (not) attempt to fix anything using HijackThis yourself!

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[Faldo]

Here it is>>>
http://aumha.net/viewtopic.php?p=96401#96401

 

[siljaline]

Here it is>>>
http://aumha.net/viewtopic.php?p=96401#96401

Thanks for posting back the URL, your log will be analyzed
in due process, please be patient, as all Forum advisors are
volunteers.

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.