Browers(3), being redirected on some urls

dohouch

Have 3 browsers on pc,opera(most used),ff, ie7(because u have to) At present some sites I try to visit (all browsers) are redirecting me. The address bar shows the typed, linked or bookmarked url, but the page is not the correct page. Not all sites are affected, PCAdvisor.co.uk is. Can visit Ebay.ie, but when I click on the link for phones, I'm taken elsewhere. Have unafected laptop connected to same router, hence this post. Have run updated scans with,Avasti,SpyBot, AdAware,ASquared,WinDef, MS Malicious Software REmoval.Nothing found. Have checked "HOSTS" ,no additional entries. What next.???

parliament

Have you checked for any entries in your HOSTS file?

dohouch

dohouch wrote:

Have checked "HOSTS" ,no additional entries. What next.???

Thanks for the interest parliament

parliament

Sorry should have spotted than (working and reading boards at same time)
What page do you land on when you say it not the correct page. is the 'phones' link on the ebay page?

Capt'n Midnight

where is your DNS settings pointing
try nslookup to see where DNS resolved

also check your proxy settings

dohouch

Been out. My proble is complicated. On the problem machine, I can visit some site, i.e. boards.ie. If on the same machine I try www.pcadvisor.co.uk I get attachment 1. Going to ebay.ie is possible, but it if I then use the links on the left of the home page "home phone and mobiles" I do not get to an ebay page but to attachment 2.

is_that_so

Have you run Hijack This? You could also look at SmitRem , run in safe mode.

dohouch

Have run HikackThis and posted to /forums.tomcoyote.org,

have also run "Blacklight from F-Secunia". . Looking at link SmitRem now. Amazing that have run so many scans and nothing shows, and this if fully patched XPsp2. this is a line from Hikackthis log and show 2 name servers

O17 - HKLM\System\CCS\Services\Tcpip\..\{6B83E17F-4BA5-4F73-B4D8-55B74C5B118E}: NameServer = 85.255.115.82,85.255.112.191
O17 - HKLM\System\CS1\Services\Tcpip\..\{6B83E17F-4BA5-4F73-B4D8-55B74C5B118E}: NameServer = 85.255.115.82,85.255.112.191

that I've already deleted from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters they ae still absent from reg key but show up in log

ressem

Sounds like same issue as
http://www.boards.ie/vbulletin/showthread.php?t=2055023344

Same dodgy ip range linked to spam and malware.

Trojans redirected DNS. Had to be changed back in your Network settings. Then look at symantec links

http://www.symantec.com/security_res...446-99&tabid=2
http://www.symantec.com/security_res...135-99&tabid=2

for details on what to remove.

dohouch

Heah the boy, just before I read your post I was scratching my tired head. I thought I had the problem solved by removing a shiity name server from registry but was still getting redirects. Rembered there that Resolved DNS were cached locally but couldn't remember where, and when I visited that link you gave me , the thing that jumped out at me was "FLUSHDNS". Have done that and now I'm clean again.

Thanks for all encouragement and help. bye

P.S.I had it fixed but because I hadn't done a /FLUSHDNS I was still geting the redirects.

Something that maybe somebody might be able to explain for me is. I had deleted the hijacking name server from registry manually ( figured out by comparing good laptop reg key with bad PC reg key) but the deleted key still showed up in HIjackthis log. How come???

Capt'n Midnight

did you reboot after the fixes - it's windows after all

dohouch

Capt'n Midnight wrote:

did you reboot after the fixes - it's windows after all

My approach to PC problems would,by many, considered less than systematic. ( A bit like what happens when the fox enters the henhouse)

So the order, (or lack thereof) in which I approached this latest problems is only to be found in the annals of Hell.

Fully patched XPsp2, running Windows Def,Avasti,CCleaner, SBotSD, AdAware and browsing with Opera 9.01 (95% time). How does the average Joe or Mary, manage to keep their PC up and running.

Ginger

That one comes from a dodgy spyware cleaner that adds DNS entries to one of your NICS and that causes the redirects...

I had to clean my dads one after he proudly said he had downloaded a spyware cleaner from the web

dohouch

I use the following products, Windows defender, Avsti AntiVir,CCleamer, AdAware SE Personal,SpybotSD, Asquared free, all fully updated, also XP fully patched. They are all recomended products. None of them either stopped, or detected the malware. Disapointing.

Ginger

Yeah i saw that,, but i do remember adaware not picking up on either, nor his av products.. dunno why not tho