Google Hijack virus?

[tmedina]

I think I might have a google hijack virus and I am not sure what I should do.

For example, if I enter the search term “shade cloth” using google in firefox I get this result:

Custom size outdoor knitted shade fabric (shadecloth) with hem and grommet provides sun protection as shade canopy, pergola patio cover, playground shading, ...


www.thenaturalhome.com/shadecloth.htm - 85k - Cached - Similar pages

However, when I click on this hyperlink, I am taken to this url:

http://www.everydayhealth.com/womens-health/incontinence/index.aspx?xid=msek_kidneyIncontinence&utm_source=msek&ref=8842EA56-6CDF-411D-B38F-CB1D8D3A8C96&utm_medium=CPC&utm_term=

If I hit the back button and click on the link again, I am taken to the correct site.

This doesn’t seem to happen when I use a different search engine such as Live Search or when I use IE.

Thanks in advance for your advice

[tmedina]

The same problem did just happen using google in IE.

[tashi]

Hello tmedina,

Please read the forum FAQ and start a new topic.

"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

Cheers.

[tmedina]

Hello Tashi

I did read "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) and (obviously) didn't understand it since I thought I was following the directions . Did you want me to run Hijack this and post my log? I'm sorry, I'm new to these sorts of things.

Thanks

[tashi]

Hi there,

Yes as it shows in post #2: http://forums.spybot.info/showpost.p...50&postcount=2

Copy paste the log into a new topic after following those instructions, then this thread will be closed as helpers look for topics with no responses.

Best regards.

[tmedina]

Hi Tashi,

I am following your directions in post #2: http://forums.spybot.info/showpost.p...50&postcount=2

and I have a couple of questions:

After running Spybot-S&D in advanced mode with "Resident Teatimer" unchecked, do I then "Remove the Threats Found" as described in the tutorial before proceeding with the next steps?

Then, after running Spybot-S&D I restart my computer and then back up my registry using ERUNT, is that correct?

Thanks

[tashi]

Hi tmedina,

After running Spybot-S&D in advanced mode with "Resident Teatimer" unchecked, do I then "Remove the Threats Found" as described in the tutorial before proceeding with the next steps?

Then, after running Spybot-S&D I restart my computer and then back up my registry using ERUNT, is that correct?

You can remove threats found, this is the important part:

TeaTimer needs to be disabled so that its protection does not interfere with fixes.
How Spybot-S&D protects against the installation of Spyware/Malware.

TeaTimer can be re-enabled once the computer is clean.

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this go to the "Mode" menu and select "Advanced Mode".
3. On the left hand side, click on "Tools".
4. Then click on the Resident Icon in the List.
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.

Please back up your registry!

• Download ERUNT
• Save it to your desktop. Run and install this program.
• In the box that opens ONLY choose "System registry"
• Click OK.
• Click save and then go to File > Exit.

Then produce the HJT log for analysis.

Cheers.