Java hijack? Search engines re-directed?

[Trekka]

This is OT but I hope will be allowed. I've got a problem with a relative's computer. It has up to date AV software and the latest WinXP updates. But something has hijacked the search engine functions in all three browsers (Opera, IE, Firefox). When the list of search results come up and a link is clicked, instead of going to the link, there is a redirect to other sites, usually offering software (such as AV s/w) or other things. This redirect happens on Yahoo and Google searches. Whatever has happened got right by her AV monitoring software. I've scrubbed the pc with a variety of AV search & destroy pgms such as Norton's and Microsoft One Care. Even uninstalled Java and d/l and reinstalled new. No change.

Suggestions welcomed. Formatting the drive is not a viable option. her pc was bought from out of business lease and while it has a valid COA it has no installation discs.

[bg9208]

Originally Posted by Trekka

This is OT but I hope will be allowed. I've got a problem with a relative's computer. It has up to date AV software and the latest WinXP updates. But something has hijacked the search engine functions in all three browsers (Opera, IE, Firefox). When the list of search results come up and a link is clicked, instead of going to the link, there is a redirect to other sites, usually offering software (such as AV s/w) or other things. This redirect happens on Yahoo and Google searches. Whatever has happened got right by her AV monitoring software. I've scrubbed the pc with a variety of AV search & destroy pgms such as Norton's and Microsoft One Care. Even uninstalled Java and d/l and reinstalled new. No change.

Suggestions welcomed. Formatting the drive is not a viable option. her pc was bought from out of business lease and while it has a valid COA it has no installation discs.

I would suggest that you contact Windows BBS which is a very effective helpline for any computor related problems, the service is free and I have used it a number of times to solve all kinds of PC problems.

[rtbates]

Not good. Sounds like you've got what's called a 'dropper'. I got the same thing awhile back and the only fix is a disk clean and re-install of the OS. I too had a used IBM PC with no OS disk, but had the COA. There should be companies in your area that can re-install the OS and get it re-cert via the original COA. It's a pain for sure. I ended up having to call MS and go thru a voice prompt system where they send a 54 digit number to your PC and you call and read it back. Then they give you another 54 digit number that you input into a MS web page.

After I finally got my PC up and running I bought an Apple laptop. Problem solved. I don't touch the internet with my PC. Actually since I bought the Apple last year I've used the PC maybe three times.

Apples are head and shoulders above PC running Windows.

You might also consider a change to a UNIX based OS.

Windows sucks...

[Trekka]

Thanks for the leads, guys. Looking at the windows forums it is clear this is a common current problem. Also clear it will take a lot of time to deal with. If it were one of my own pc's I'd take the quick route and format/reinstall, but this is a sibling's pc that is heavily customized with special software for disability access and has been heavily tweeked w/in those programs. Would take a long time to redo all that and maybe not get the proper tweaks. So I shall do the long slog through ID'ing and cleaning this culprit.

[thendel]

Hi - my first post so I hope I can help someone out.
You could also try a free Linux based operating system called Ubuntu (a Swahili word for greeting I think). Go to -

Ubuntu Home Page | Ubuntu

and it's a free download that also comes with a complete programme suite called Open Office which is virtually indistinguishable from the Microsoft verion(has word processor, spreadsheet etc.).

[gonesail]

check your adware with a program that can be downloaded from lavasoft.

[clausont]

Check to see if there have been numerous entries made in your hosts file.
Also, run "Hijack This" and post to their forum. They are extremely helpful in locating the exact source of the problem and how to fix it.

[AnchorageGuy]

Start here HijackThis - Quick Start! | What the Tech
and follow directions and download the program. It will get you cleaned up.

[AnchorageGuy]

Here is a link to their forum on that same subject

[Resolved]*Search Links Hijacked, Slow Computer

[scotte]

spybot and ad-aware should be able to help. spybot has some cool tricks to immunize the system against some of these sorts of attacks in the future. I run both about once a month on the Windows boxes I have to deal with.

[SeaKing]

I had the same thing two days ago. It got so bad the PC would start then crash into the Blue screen of death. I wound up getting into safe mode(press the F8 key during startup) and did the last known good option. I then restarted and my AVG started finding a couple of Trojan's. I forget the names. Then it all cleared up. You may have to try system restore if the last known good option doesn't work. If you remember the last day the PC worked right just restore it to a previous date, you will only lose whatever was worked on since that point. Then run the antivirus again.

[janders]

Run HiJack this first!! Find out what malware you have. It is removable without having to do a full scale nuke and pave of the hard drive. You can post the contents of the HiJack This log file on lots of PC forums and people will identify for you what the problem areas are.

I just went through this on my girlfriends computer not two weeks ago. We followed instructions to remove the problem areas and haven't had a problem since.

[Trekka]

I swept her computer last week after problems started and found many trojans. Used a variety of AV&Adware programs and swept several times, doing cleanings each time until several sweeps all came through clean. Whatever inititated this is clever in that it disabled installed AV pgm and blocked access to MS sites and other sites with useful pgms and info. But I accessed and d/l files from another pc and used a flash drive to bring them in.

The remaining problem is this search redirect.

Oh, and - probably related - none of the system restore dates from before the beginning of the infection will restore. They are indicated as existing, but after clicking on them and then "restore" nothing happens. I tried that early on and in the last day.

As I said, clever.

I have her pc disconnected from the net so it cannot bring in anything new and she is in the hospital this week so not using it. For the reasons stated upstream switching to another OS is not feasible. I need this install on this pc with all the various disability software pgms installed and tweaked to be working again. This relation is severly disabled and has specialized software systems. Starting from scratch is not an option.

i will use the info and links suggested and find a way to get this last bugger out. I will report back. thanks

[AnchorageGuy]

Trekka, You can download HJT to another computer, load it on a disk, run it on the infected computer, save a copy to a disk, then post the results from another computer on the forum site. It will take a little going back and forth but easier than a re-install.

[hellosailor]

Getting bugs out is not impossible, and I'd beware any local commercial help because the good ones are expensive, and the chain store ones tend to wipe out drives.

Try Compuserve's VIRUSCENTRAL forum, or their forum for whatever OS (XP?) you have, there's plenty of experience with these problems.

http://community.compuserve.com/n/pf...s-viruscentral