Help; I click Google but get this.....

jarvis

Hi

When I enter Google.ie in Firefox 4, I get the attached page!!!!

Anyone know why or how to fix?

I'm using Win 7 Ultimate 64bit

[/IMG]

ressem

Probably malware messing with your DNS or adding bad entries into your
C:\Windows\System32\drivers\etc\hosts resolution file.

see sticky here for possible fixes
http://www.boards.ie/vbulletin/showthread.php?t=2055274237

and post in the malware forum if you need further advice.
http://www.boards.ie/vbulletin/forumdisplay.php?f=1009

Kinetic^

Click on Tools >> Options >> Advanced >> Network >> Settings.

Make sure no proxy is enabled.

If it's already set to no proxy, run a scan with SuperAntiSpyware.

Irish_Elect_Eng

Kinetic^ wrote: »

Click on Tools >> Options >> Advanced >> Network >> Settings.

Make sure no proxy is enabled.

If it's already set to no proxy, run a scan with SuperAntiSpyware.

+1 for SuperAntiSpyware

jarvis

Kinetic^ wrote: »

Click on Tools >> Options >> Advanced >> Network >> Settings.

Make sure no proxy is enabled.

If it's already set to no proxy, run a scan with SuperAntiSpyware.

Went into those settings and "Use system proxy settings" was selected. Changed it to "No proxy", closed Firefox, opened again and the problem remains. Went back into the options to see "No proxy" stayed enabled and it was fine but still no google!!!

I do sometimes use Expat shield for BBC Iplayer etc but this is not enabled and if I use an ip tracking websire it gives my correct location and ISP.

I ran spybot search and destroy but only found 1 tracking cookie. "Right Media" and spybot got rid of that.

Any other suggestions?

Kinetic^

Yes, run superantispyware. Spybot has been awful for quite some time.

old_aussie

In Google type in "Google Redirect Virus"

Root Kit

jarvis

old_aussie wrote: »

In Google type in "Google Redirect Virus"

Root Kit

Don't think it's a virus......
My computer is as fast as ever, I'm not getting any ads popping up, I'm not being redirected to any other websites, my ping times are fine and download speeds are 100%.

AVG Premium not finding anything and spybot reporting clean now too.

Skerries

yes but run Superantispyware and malwarebytes anyway
then come back and report to us and we'll help you from there

jarvis

Ok. Wil do it after the match. Thanks.

jarvis

Skerries wrote: »

yes but run Superantispyware and malwarebytes anyway
then come back and report to us and we'll help you from there

Ran both of these and both reported no malicious software detected!!!

Kinetic^

Run TDSS Killer from this link. Should only take about 1/2 minutes.

jarvis

Thanks for all the help, but still no joy!!!

Adyx

Does it only happen in FF and did you check the Hosts file?

Snowbat

FWIW, it could be this page. It looks like a default Apache page but with "AXON5" added. Google brings up page hits describing 89.21.229.88 as an open proxy.

There is an AXON4 at http://89.21.229.89/

These IP addresses are in a netblock allocated to a customer of Vostron Ltd, Southampton, UK.

% Information related to '89.21.229.88 - 89.21.229.95'

inetnum:        89.21.229.88 - 89.21.229.95
netname:        VOSTRON-CUSTOMER-39
..
address:        Vostron Ltd
address:        2 Venture Road
address:        Chilworth Science Park, Southampton
address:        SO16 7NP

jarvis

Adyx wrote: »

Does it only happen in FF and did you check the Hosts file?

Yeah only in firefox. Ie works fine. Updated firefox to 4.0 but that was E weeks ago and this wasn't happening then.
Dint understand what you mean about the host file.

Thanks.

jarvis

Snowbat wrote: »

FWIW, it could be this page. It looks like a default Apache page but with "AXON5" added. Google brings up page hits describing 89.21.229.88 as an open proxy.

There is an AXON4 at http://89.21.229.89/

These IP addresses are in a netblock allocated to a customer of Vostron Ltd, Southampton, UK.

% Information related to '89.21.229.88 - 89.21.229.95'

inetnum:        89.21.229.88 - 89.21.229.95
netname:        VOSTRON-CUSTOMER-39
..
address:        Vostron Ltd
address:        2 Venture Road
address:        Chilworth Science Park, Southampton
address:        SO16 7NP

Thanks for info snowbat. But not really making sense to me. When I click your link I get the exact same page. With axon5. I clicked it on my iPhone. Does this mean something?

Adyx

jarvis wrote: »

Yeah only in firefox. Ie works fine. Updated firefox to 4.0 but that was E weeks ago and this wasn't happening then.
Dint understand what you mean about the host file.

Thanks.

See the second post by ressem for details about the hosts file. Open it with Notepad and make sure there is no entry for Google in it.

Edit: Although that would affect IE too.

Kinetic^

No virus/malware and not affecting other browsers, hmm. Try this.

jarvis

Kinetic^ wrote: »

No virus/malware and not affecting other browsers, hmm. Try this.

Tried this but didn't work. It did mess up a lot of settings but easily fixed. Thanks for your continued help.
I also uninstalled firefox and reinstalled but issue persists.

Some thing I've noticed:

I set my home page to http://www.google.ie/ig?hl=en and this goes to my google page with me logged in and when I click home, all is perfect!!!

Setting home page to www.google.ie does the Axon5 thing

If I start a private browsing session I can type google.ie and it works correctly, but without the private browsing, it goes back to Axon5. Weird.

You may say just leave http://www.google.ie/ig?hl=en as home page and access google that way and that would work but this is bugging the life out of me!!!

jarvis

Downgraded to 3.6.1.5 and all back to normal.

thanks Everyone

Kinetic^

Last shot, try combofix.