Google sending me to Russia!

Hintza

90% of my Google searches take me to this site:-

http://93.186.170.31/refer.php

Which comes up with this page ( last part changes slightly daily):-

http//www.lenta.ru/?first&key=trinity

To get into most pages I needto click on cached and then take it from there.


I have run malawarebytes and superantispyware but it has been going on for a week now.

Any ideas?

davb

Sounds like some sort of redirect. Did you update Malwarebytes, and did it find anything. It would be useful to post the log.
You also need to download and run hijackthis. Just post the log, don't fix anything

Hintza

Malaware found a couple of small bits and bobs but has been clear the last couple of runs. I am busy ownloading the free adaware and will try that first.

Next step will be hijackhis. This is not a program I am familiar with so might need some help.

Browntoa

post the log file from malwarebytes that found stuff, open the program and clcik on the Logs tab, all the log files are there

I suspect we need to run a specialised program to remove but I need to see that log first to be sure (and no point in running another program before)

Ximian

Sounds like you have a DNS redirect. If you're running Windows, have a look at the hosts file found here: Windows\system32\drivers\etc\hosts
You might have an entry such as:
93.186.170.31 https://www.google.com

Hintza

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org
Database version: 3963
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
26/04/2011 20:38:19
mbam-log-2011-04-26 (20-38-19).txt
Scan type: Full scan (C:\|)
Objects scanned: 164844
Time elapsed: 53 minute(s), 24 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)

davb

Hintza wrote: »

Malwarebytes' Anti-Malware 1.45

This is an old version, you need to download latest, update it, and scan again - then post the log here.

Browntoa

run this

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

you will need to turn off any antivirus (or uninstall it and put it back afterwards )

Hintza

Ximian wrote: »

Sounds like you have a DNS redirect. If you're running Windows, have a look at the hosts file found here: Windows\system32\drivers\etc\hosts
You might have an entry such as:
93.186.170.31 www.google.com

Windows\system32\drivers\etc\

That is as deepas that goes and then it has:-

lmhosts
networks
protocol
services

no sign of an entr that you describe there.

penrhyn

Hi, sorry to but in but your Malwarebyte programme is way out of date, you should have:-

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6511



Whoops, too slow :-)

Hintza

OK updating malawarebytes. Will I rerun it (deep scan?) or do what browntoa suggests first?