Google Hijacking problem

[eagleeye]

i love hak.5...

2 days before i was searching on google and everytime i clck on link it redirects to other page ...first i thought its a virus but i scanned my pc 7 times with all famous internet security softwares but nothing found....is there anyway to get rid of this problem........first it was happening only in Internet Explorer and then firefox and thn chrome...evry single browser..i research little bit online and i found on one link that its some EXPLOIT 302 problem ..i have noo idea wa tht means ..i m posting the link which says something about Exploit 302 ...pls help me ...i get so pissed off when this redirects to another link.i... always have to go back 4 times to google search and thn it opens.....i dont know wat is the problem.

HELP ME!!!

[digip]

i love hak.5...

2 days before i was searching on google and everytime i clck on link it redirects to other page ...first i thought its a virus but i scanned my pc 7 times with all famous internet security softwares but nothing found....is there anyway to get rid of this problem........first it was happening only in Internet Explorer and then firefox and thn chrome...evry single browser..i research little bit online and i found on one link that its some EXPLOIT 302 problem ..i have noo idea wa tht means ..i m posting the link which says something about Exploit 302 ...pls help me ...i get so pissed off when this redirects to another link.i... always have to go back 4 times to google search and thn it opens.....i dont know wat is the problem.

HELP ME!!!

Not really enough info to go on here. Could you give us some more detials, like if you use wireless to surf, etc.

Are you on a wireless connection to you internet? Do you use a wireless(or other) router to connect to the internet by any chance? If so, change the password on it, update the firmware, and check your DNS settings. You can also try manually setting them in the OS to something like OpenDNS under tcp/ip setitngs to be sure you aren't getting hijacked by way of DNS or uPnp router hacks.

Also, check your hosts file to see if spyware or other malware may have changed something to block you from being able to get updates, patches, etc. They could rediect you to a site that looks just like an anti-virus vendor or even microsoft.com, without actually being on the real site itself.

[loftrat]

Probably better answered here:

http://hak5.org/forums/index.php?showtopic=11061&hl=

In the other post you made, which is probably the one that's in the right section - no need to double post stuff really.

[eagleeye]

thank s for the reply friends......ok i am using Verizon DSL internet ...i am directly connected to the router provided by the company nd yes it is wireless router.......i checked as you dais the Dns settings and stuff ...still doesnt work ..'

thank you

[deleted]

I have had the exact same problem quite recently. It turned out that my routers dns server was vurnrable to the DNS hijacking attack. Id try switching your DNS servers on your computer and flushing its cache. Try OpenDNS.

[eagleeye]

All right i found solution for my own problem ...well in my case it was some DNS problem and when i checked my computer with Anti- malware named ......there were 3 trojans found and they were Trojan.Dns changer ...well for now it had fixed problem i cannot gurantee its permanent fix but i would recommend that those who has same problem with google search use Malwarebytes software and it wil solve the problem in most causes....anyways below is the information where these trojans had affected in my computer ..

Malwarebytes' Anti-Malware 1.31

Database version: 1466

Windows 6.0.6001 Service Pack 1

12/6/2008 9:16:32 AM

mbam-log-2008-12-06 (09-16-32).txt

Scan type: Quick Scan

Objects scanned: 52963

Time elapsed: 3 minute(s), 16 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 1

Registry Data Items Infected: 3

Folders Infected: 1

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows Tribute Service (Trojan.Agent) -> Delete on reboot.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c53.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{cd384f7e-f098-400c-aa96-6fb2fff73209}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.132;85.255.112.12 -> Delete on reboot.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{cd384f7e-f098-400c-aa96-6fb2fff73209}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.132;85.255.112.12 -> Delete on reboot.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{cd384f7e-f098-400c-aa96-6fb2fff73209}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.132;85.255.112.12 -> Quarantined and deleted successfully.

Folders Infected:

C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:

C:\resycled\boot.com (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Windows\Temp\C53.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

WARNING : this trojans are not detected by any antivirus releases until sept -2008...so use anti-malware and remove it if possible or manually serach for these locations and delete it .

[sablefoxx]

Google hijacker also hides in your system32 dir, in a few .dll file not sure what the names are off the top of my head (had to remove it from a computer at work). Not sure if this is the same virus i found but it seemed to have a root-kit like aspect to it, had to boot into a PE to delete the files.