redirected to search sites

Question

When I search for things in google, the results come up. I can then click a link, but then I get redirected to a search website. It has a different name every time but the website is actually the same most of the time. This sometimes happens when i type in a link on the address bar as well, the page i want starts to load, but then i get redirected. This happens every so often when i click a link, if i click back, then click the link again, its fine.   Been looking around this site, i have just been directed to:   http://www.web-blinds.com/   Which just looks like a blind company to me!!! STRANGE     MY LOG:   Logfile of HijackThis v1.99.1 Scan saved at 16:32:51, on 18/04/06 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\SSDPSRV.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\PTSNOOP.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\WINDOWS\STARTER.EXE C:\PROGRAM FILES\DIRECTCD\DIRECTCD.EXE C:\WINDOWS\SYSTEM\PRISMSVR.EXE C:\WINDOWS\LOADQM.EXE C:\WINDOWS\RUNDLL32.EXE C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE C:\WINDOWS\RunDLL.exe C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE C:\PROGRAM FILES\BT VOYAGER WIRELESS ADAPTER\PRISMCFG.EXE C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE C:\WINDOWS\SYSTEM\MSWHEEL.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\DESKTOP\HJT\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/ F1 - win.ini: load=ptsnoop.exe O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {196B9CB5-4C83-46F7-9B06-9672ECD9D99B} - C:\WINDOWS\SYSTEM\winbrume.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDSG.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] c:\windows	askmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Netline User] c:\windows
etchk.exe O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\Run: [POINTER] C:\PROGRA~1\MICROS~1\point32.exe O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Program Files\DirectCD\DIRECTCD.EXE O4 - HKLM\..\Run: [Internet Registration] c:\program files\internet explorer\connection wizard
etcheck.exe O4 - HKLM\..\Run: [PRISMSVR.EXE] 'C:\WINDOWS\SYSTEM\PRISMSVR.EXE' /APPLY O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [ICSDCLT] c:\windowsundll32.exe c:\windows\SYSTEM\icsdclt.dll,ICSClient O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [SSDPSRV] c:\windows\SYSTEM\ssdpsrv.exe O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] 'C:\WINDOWS\is-CCNIO.exe' /REG O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - HKCU\..\Run: [MsnMsgr] 'c:\Program Files\MSN Messenger\MsnMsgr.Exe' /background O4 - HKCU\..\Run: [Felix II] C:\Program Files\ScreenMates\Felix II\FELIX2.EXE O4 - HKCU\..\Run: [Spyware Doctor] 'C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE' /Q O4 - HKCU\..\RunServices: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - HKCU\..\RunServices: [MsnMsgr] 'c:\Program Files\MSN Messenger\MsnMsgr.Exe' /background O4 - HKCU\..\RunServices: [Felix II] C:\Program Files\ScreenMates\Felix II\FELIX2.EXE O4 - HKCU\..\RunServices: [Spyware Doctor] 'C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE' /Q O4 - Startup: BT Voyager Wireless Utility.lnk = C:\Program Files\BT Voyager Wireless Adapter\PRISMCFG.EXE O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/11f9351418b0e3a6a105/netzip/RdxIE601.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {33288993-5664-11D4-8B5B-00D0B73B3518} (ell Class) - http://www.easports.com/downloads/games/common/ieell.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O20 - Winlogon Notify: ldr64 - C:\WINDOWS\SYSTEM\ldr64.dll Message Edited by timsmith10000 on 04-18-200610:41 AM

timsmith10000 · Answer

Right, thanks. My log is now as follows:   Logfile of HijackThis v1.99.1 Scan saved at 18:18:01, on 18/04/06 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\SSDPSRV.EXE c:\windows\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\PTSNOOP.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\WINDOWS\STARTER.EXE C:\PROGRAM FILES\DIRECTCD\DIRECTCD.EXE C:\WINDOWS\SYSTEM\PRISMSVR.EXE C:\WINDOWS\LOADQM.EXE C:\WINDOWS\RUNDLL32.EXE C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE C:\WINDOWS\RunDLL.exe C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE C:\PROGRAM FILES\BT VOYAGER WIRELESS ADAPTER\PRISMCFG.EXE C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE C:\WINDOWS\SYSTEM\MSWHEEL.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\DESKTOP\HJT\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/ F1 - win.ini: load=ptsnoop.exe O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDSG.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] c:\windows	askmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Netline User] c:\windows
etchk.exe O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\Run: [POINTER] C:\PROGRA~1\MICROS~1\point32.exe O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Program Files\DirectCD\DIRECTCD.EXE O4 - HKLM\..\Run: [Internet Registration] c:\program files\internet explorer\connection wizard
etcheck.exe O4 - HKLM\..\Run: [PRISMSVR.EXE] 'C:\WINDOWS\SYSTEM\PRISMSVR.EXE' /APPLY O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [ICSDCLT] c:\windowsundll32.exe c:\windows\SYSTEM\icsdclt.dll,ICSClient O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [SSDPSRV] c:\windows\SYSTEM\ssdpsrv.exe O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - HKCU\..\Run: [MsnMsgr] 'c:\Program Files\MSN Messenger\MsnMsgr.Exe' /background O4 - HKCU\..\Run: [Felix II] C:\Program Files\ScreenMates\Felix II\FELIX2.EXE O4 - HKCU\..\Run: [Spyware Doctor] 'C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE' /Q O4 - Startup: BT Voyager Wireless Utility.lnk = C:\Program Files\BT Voyager Wireless Adapter\PRISMCFG.EXE O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/11f9351418b0e3a6a105/netzip/RdxIE601.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {33288993-5664-11D4-8B5B-00D0B73B3518} (ell Class) - http://www.easports.com/downloads/games/common/ieell.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O20 - Winlogon Notify: ldr64 - C:\WINDOWS\SYSTEM\ldr64.dll           I will let you know, what difference is made. THANKS

ky331 · Answer

close your internet browser. Run HiJackThis. click on DO A SYSTEM SCAN ONLY. Place a check-mark in the box in front of the line: O2 - BHO: (no name) - {196B9CB5-4C83-46F7-9B06-9672ECD9D99B} - C:\WINDOWS\SYSTEM\winbrume.dll Click on FIX CHECKED. Close HiJackThis. Reboot. And then generate/post another log, REPLYING to this thread.   Be sure to let us know if this made any difference in your re-direction problem. At that point, I'm gonna try to ask someone else to step-in, to determine additional problems (if any) that you might have. Please be advised that we're very 'understaffed' at the moment, so I can't make any guarantee as to when  the next helper will arrive.   Good luck.

timsmith10000 · Answer

Been on the internet for a good while now since I did what you said.   NOT BEEN RE-DIRECTED ONCE!!!   Either very lucky, or you have fixed it. I'll go with that latter.   THANKS FOR YOUR HELP

timsmith10000 · Answer

Well, ok :smileytongue:   But, for now, I can't really see what else is wrong. Then again your the expert!

ky331 · Answer

i do believe we've taken care of the REDIRECTION problem.   however, there are still other issues remaining, and i'll be calling-in someone else to help you with them...

RKinner · Answer

This line:

O20 - Winlogon Notify: ldr64 - C:\WINDOWS\SYSTEM\ldr64.dll

appears to be the bagle/beagle trojan.

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FBAGLE%2EDM&VSect=P

If it won't go away when you check it and Fix Checked then

Trend's free scan will probably get it:

http://housecall.trendmicro.com/

if not

I think you can delete it from Safe Mode on your system.

To get into Windows 98 / ME safe mode, as the computer is booting press and hold your "F8 key" on the top of your keyboard or press and hold the left or right Ctrl key as the computer is booting. If done properly you should get into the "Windows 98 / ME Startup Menu" similar to the below screen example. In this menu choose option 3 by pressing the 3 key and press enter.

Note: With some computers if you press and hold a key as the computer is booting you will get a stuck key message. If this occurs, instead of pressing and holding the "F8 key", tap the "F8 key" continuously until you get the startup menu.

Select Command Prompt which should give you a black DOS like screen.

Type:

cd \windows\system

attrib -r -h -s

del ldr64.dll

Then run HijackThis and check the line and Fix Checked.

Ron

Virus & Spyware

redirected to search sites

Was this post helpful?