[RESOLVED] Browser not working

[dolot]

I have a WinXP system. A couple of weeks ago I started having problems with my web browser. I can go to a search site like Bing or Google and do a search and get the results back. But when I click on any of the links on the page, it doesn't go to the requested site, but instead goes to some sort of ad site. The site is different for different links. This happens with either IE7 or Firefox.

At the same time my TrendMicro virus protection/firewall started having problems - repeatedly running the same updates over and over. I'm not sure if these two are related or not, but I dont trust TrendMicro to detect a virus/trojan at this point.

So does anybody have any ideas what may be occurring? I've removed the machine from the network as a precaution - and my wife is hounding me to get it fixed.

If you need any more info just ask.

[Nightwalker83]

Did you scan the computer for viruses/malware? Did it find anything? What happens when you clean out th internet cache?

[dolot]

Well, I installed two pieces of malware removal software. The first was spybot search and destroy. It found a whole bunch of stuff and removed it, but not the thing causing my problem. Then I installed malwarebytes. It hung very early in the scan process. So that's two tools down and the browser hijacker virus is still there.

[Nightwalker83]

Just out of interest have you tried a different brower such as Opera what happens if you do?

[dolot]

Just tried to install pc tools' spyware doctor. The installation failed. So I downloaded their threat removal tool. It also failed to run.

This thing is nasty.

I have not tried Opera. It fails on both IE and Firefox. From what I've read online these things are browser independent, but I may be wrong about that.

[dolot]

The latest...

I just tried running HijackThis.exe and CWShredder.exe. In both cases the exe process was terminated upon launching a scan.

This thing's really nasty.

[dolot]

I restarted in safe mode and tried to run the above mentioned software there. HijackThis wasn't allowed to run, and CWShredder died as soon as I started the scan.

I looked at task manager and saw a strange looking process running there:

1210636783:270981047.exe

I'm thinking this is the thing, but of course I cannot kill the process. I tried deleting the registry entries for it and restarting the computer, but the thing re-inserts itself.

I'm gonna go to bed and start again in the morning. But if anyone has any advice, please post.

[namrekka]

1210636783:270981047.exe

That could be "the thing" indeed. However removing will not help I guess. Often an installer is used to install that "thing" again. But use this name to find entries in the register. Also in the autostart of MSconfig you can find something. Don't panic and don't remove without noting names/references etc.
I have had "such a thing" too. After cleaning, the PC wasn't healed completly.
I had to format and install OS again.

[TheBigB]

Have you tried Hitman Pro?

[dolot]

I tried that, but it made me nervous - it was uploading some of my files to site on the internet. I guess I'm getting a little paranoid (can't imagine why). Anyway, before it would clean anything it wanted me to buy, and I didn't want to pay for something when I think it unlikely that it will do the job.

[dolot]

OK. So I got over my nervousness and read more about the tool. Got convinced that it was legit, and saw the 'free one time use' thing and went ahead and tried it. Praise God, it got rid of the thing! So now I'm gonna buy it and put it on both my pc's.

Now my thought is... Do I bother re-installing my anti-virus, or do I just go with a firewall like Zone Alarm and keep Hitman on standby?

Also, my pc is now slower than ever. Gotta figure out what's happening there as well.

But thanks so much for that tip - your rep points.

EDIT: BTW, the thing was called Redbook.sys

[The_Professional_05]

My thoughts on nasty infections like this:

Whenever i've had one of these, it usually blocks programs running with common executable names, like hijackthis.exe
The trick is to rename your exe to iexplore.exe, and it should be allowed to run.

The other thing is there is a program on the net called RKill.exe
You download this, and it can be downloaded already named iexplore.exe, run it, and it is allowed to run, and actually kills processes that are doing the nasty, so you can get other programs running to clean it up.

[dolot]

Thanks for the additional tip - I'll keep that in mind.