Google Search Redirect.

[SThompson86]

Hello, I am trying to fix a computer that has some sort of spyware or root kit in it. When ever I go to Google on this computer and click any of the results from a search I am redirected to some ClickSearch5.com site. This does not happen in Bing, but just in Google. So far I have ran SAS and MBAM with the hard drive installed and with the hard drive pulled. I have also tried to run Combo Fix and some Hitman 3.1 software I read both of these were possible fixes for the re-direct.. but no they were not. I have searched through pages and pages of searches trying to find a fix, but it seems like every link is just people requesting and posting those ridiculous Hijack this logs. I am in the clear to reformat this machine, therefore, you guys do not have to waist a bunch of time helping me out, but if any of you know how to fix this please let me know.

Thanks in advanced.

 

[NYJimbo]

Check the tcp/ip settings for this NIC adapter being used on this computer.
See if its set for dhcp and also check the dns servers. If its DHCP the servers should be automatic, if its manual IP address it might have manual DNS servers but it still might be hijacked.

Let us know what you see for the dns servers under the tcp/ip for it.

 

[SThompson86]

Everything is set to auto. This only happens with google searches, I can browse to any page I want through the address bar ect.

Thanks

 

[Packrat1947]

Try using Kaspersky's TDSSkiller. This is a rootkit killer, and it solved a redirect issue for me.

Packrat1947

 

[NYJimbo]

Ok, we had a few machines come in with similiar issues, we couldnt find anything wrong. It turned out that a virus had simply changed the dns pointers to 2 new servers which had authoratative records to point to a fake google server which would feed select responses. Pretty crafty as non of the virus programs saw anything wrong, its normal to have specific dns servers. Since it wasnt a hosts file issue, dns cache poisoning or some resident program we couldnt find it until we checked the tcp/ip settings and notice auto on IP but specific on the dns servers.

 

[MobileTechie]

Have you checked your hosts file?

Does it do it for all browsers or just IE? Either way check the proxy settings.

 

[SThompson86]

Have you checked your hosts file?

Does it do it for all browsers or just IE? Either way check the proxy settings.

Yes for all browser, and Proxy is fine.

 

[SThompson86]

Have you checked your hosts file?

I went and renamed my Host file to Host.old. I guess it created a new one Because everything is working great now.

Thanks guys, learn something new everyday

 

[NYJimbo]

but it seems like every link is just people requesting and posting those ridiculous Hijack this logs.

If you didnt run hijackthis thats too bad, it would have helped right away.

 

[SThompson86]

If you didnt run hijackthis thats too bad, it would have helped right away.

lol what?? I though HJThis was just an overview the registry. I did not know it fixed stuff lol. I just thought techs would want users to run HJ so they could see if there were in abnormalities wrong with the reg.

 

[NYJimbo]

lol what?? I though HJThis was just an overview the registry. I did not know it fixed stuff lol. I just thought techs would want users to run HJ so they could see if there were in abnormalities wrong with the reg.

Nope, HJT checks the contents of hosts file too. Likewise if you click the "MAIN MENU" button of HJT you will see a button called "Open the misc tools section" where you will find a "open hosts file manager".

ps- HJT is an extremely important tool for virus checking.

 

[SThompson86]

Nope, HJT checks the contents of hosts file too. Likewise if you click the "MAIN MENU" button of HJT you will see a button called "Open the misc tools section" where you will find a "open hosts file manager".

ps- HJT is an extremely important tool for virus checking.

Well then.. I have always thought that thing was for just getting a print out of the reg settings.. Thanks for the info!

 

[Smooth Gecko]

Hosts Expert is awesome for this check, you can just click a button to make it writeable too as many times the permissions are locked. Then you have a button to put a standard Hosts file in there and click the "Make read only" button before you leave.