Please help - Browser hijacked...

[mbdchampagne]

yes, i'm through a router -

here is the log:

SystemLook 30.07.11 by jpshortstuff

Log created at 15:16 on 23/07/2012 by dchampagne

Administrator - Elevation successful

WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== regfind ==========

Searching for "answers"

No data found.

-= EOF =-

[mbdchampagne]

i saw the error message about running the x64 for better results so i downloaded that one and got the same results.

[mbdchampagne]

so what is next?

[mbdchampagne]

looking through the history, here are some other places it redirects to:

gamezprimet.in

8.26.70.252

myfindhere.in

63.209.69.107

Scour search

[screen317]

Hi,

Let's see if your router is the problem here.

How many computers are connected to it?

1. Very important: First disconnect your computers from the Internet.

2. Router Reset: Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into the small hole labeled Reset located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 30 seconds).

3. Reset the IP/DNS settings of your Internet connection on each computer connected:

• Go to Start -> Control Panel -> Double click on Network Connections.
  
• Right click on your default connection (usually Local Area Connection or Wireless Network Connection) and select Properties.
  
• Select the General tab.
  
• Double click on Internet Protocol (TCP/IP).
  
  • Under General tab:
    
    • Select "Obtain an IP address automatically".
      
    • Select "Obtain DNS server address automatically".
      

  [*]Click OK twice to save the settings.

  [*]Reboot if you had to change any setting.

4. Flush the DNS cache:

• Click the Start logo in the bottom left corner of the screen
  
• Click on Run
  
• In the command window copy/paste the following:
  

  ipconfig /flushdns

  
  

• Then hit enter.
  
• Exit the command window.
  

5. Reconnect: Once you have followed all the above steps you can reconnect your computer to the internet.

[screen317]

If no joy, uninstall this:

YouTube Downloader Toolbar

Reboot. See if the redirects persist.

In addition, please zip up this folder and attach it to your reply:

C:\Users\dchampagne\AppData\Local\Akamai\Adobe

[mbdchampagne]

ok, so i tried those steps with no result. Youtube Downloader toolbar is actually only on IE and even after I deleted it, I still had the issue. Sorry it took so long, I tried it a couple times. Any other ideas? Thanks for the help.

[mbdchampagne]

the steps were slightly different than above for my windows 7 64bit system, but i still found the items described in the steps and followed the directions...

[mbdchampagne]

by the way, that Akamai folder doesn't exist - i assume it might have been deleted in a previous scan?

[screen317]

Hi,

Sorry for the delay. Guess the folder is gone.

Confirm for me that the issue only occurs in Firefox and Chrome, and not in Internet Explorer.

[mbdchampagne]

hi thanks for the reply - yes, it only happens in chrome and firefox.

[screen317]

Okay. It seems as though the Firefox and Chrome profiles are infected.

Uninstall both Chrome and Firefox.

Delete these folders (if present):

C:\Users\dchampagne\AppData\Roaming\Google

C:\Users\dchampagne\AppData\Local\Google

C:\Users\dchampagne\AppData\Roaming\Mozilla

C:\Users\dchampagne\AppData\Local\Mozilla

Empty your Recycle Bin.

Reboot.

Download Chrome and Firefox again.

See if the issue persists.

[mbdchampagne]

Hey! That seems to have done it! I will keep trying different searches for a day or so and see if it stays fixed. Thank you so much.

[screen317]

Great news!

Run TFC by OldTimer to clear temporary files:

• Please download TFC from here and save it to your desktop.
  
• Close any open programs and Internet browsers.
  
• Double click TFC.exe to run it and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
  
• Please be patient as clearing out temp files may take a while.
  
• Once it completes you may be prompted to restart your computer, please do so.
  
• Once it's finished you may delete TFC.exe from your Desktop or save it for later use for the cleaning of temporary files.
  

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program (if present):

Java™ 6 Update 32

Adobe Reader 9

Restart your computer.

Get the latest version of Java, Adobe Reader, and Adobe Flash Player.

Click Start, type in Windows Update, and press Enter. Install all available updates, including Internet Explorer 9 and Service Pack 1.

After they finish, reboot. Check again for further updates. If any, install and reboot.

Let me know what issues remain.

[screen317]

Are you still with us? This topic will be closed in a few days if we do not hear back from you.

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!