Yahoo Search Results being redirected

November 14, 2010 at 12:40:06
Specs: Windows XP, 1.7ghz / 1gig
Cleaning my daughter's laptop, a Dell D520 Latitude running Windows xp.

Her yahoo search results are being redirected, I have run Malwarebytes, Spybot S&D, AVG Free edition, MS Security Essentials and the MS Malicious Software removal tool.

All of these softwares find and remove things, but I can not get the search results to go back to normal. If you use Lycos or Google, they work fine.

edited by moderator: remove un-requested log


See More: Yahoo Search Results being redirected

Report •

#1
November 14, 2010 at 12:43:50
where are they being redirected to? Is it random sites or always the same?

Report •

#2
November 14, 2010 at 13:44:27
The sites are random advertising sites, getstuff.com, ads, etc.

If I switch the default search provider to Lycos, they work fine, but yahoo and google are being redirected to the random ads.


Report •

#3
November 14, 2010 at 13:52:28
in Internet Explorer go to Tools > internet options > connections tab > lan settings > is there a proxy set up? If so, uncheck it.

Report •

Related Solutions

#4
November 14, 2010 at 15:30:44
No proxy set, there is some kind of browser hijack or infection, but I am unable to clean it from the system.

Thanks for the tip, but no luck this time. Must be something deeper.


Report •

#5
November 14, 2010 at 15:32:51
check your hosts file

c:\windows\system32\drivers\etc\hosts

right click it and open it with notepad. copy and paste the contents into a reply


Report •

#6
November 14, 2010 at 19:17:20
Test, having trouble posting log.

Report •

#7
November 14, 2010 at 19:48:57
Does it have anything strange in there? You should really only have a local host entry pointing to 127.0.0.1. If there is anything else, you could try commenting out those lines (putting a # sign in front of it like the lines above it), and seeing if you still get redirected.

Report •

#8
November 14, 2010 at 21:48:23
Host file is full of stuff, all looks like crap. The message board crashes out when I post the whole thing, here is the first lines:

Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 www.123moviedownload.com
127.0.0.1 123moviedownload.com
127.0.0.1 123simsen.com
127.0.0.1 www.123simsen.com
127.0.0.1 123topsearch.com
127.0.0.1 www.123topsearch.com
127.0.0.1 125sms.co.uk
127.0.0.1 www.125sms.co.uk
127.0.0.1 125sms.com
127.0.0.1 www.125sms.com
127.0.0.1 132.com
127.0.0.1 www.132.com
127.0.0.1 www.1337crew.info
127.0.0.1 1337crew.info
127.0.0.1 www.1337-crew.to
127.0.0.1 1337-crew.to
127.0.0.1 136136.net
127.0.0.1 www.136136.net
127.0.0.1 150freesms.de
127.0.0.1 www.150freesms.de
127.0.0.1 163ns.com
127.0.0.1 www.163ns.com
127.0.0.1 171203.com
127.0.0.1 17concepts.info
127.0.0.1 www.17concepts.info
127.0.0.1 17-plus.com
127.0.0.1 1800searchonline.com
127.0.0.1 www.1800searchonline.com
127.0.0.1 www.180searchassistant.com
127.0.0.1 180searchassistant.com
127.0.0.1 180solutions.com
127.0.0.1 www.180solutions.com
127.0.0.1 www.181.365soft.info
127.0.0.1 181.365soft.info
127.0.0.1 1987324.com
127.0.0.1 www.1987324.com
127.0.0.1 www.1-domains-registrations.com
127.0.0.1 1-domains-registrations.com
127.0.0.1 www.1ghporn.info
127.0.0.1 1ghporn.info
127.0.0.1 www.1importantiamreal.com
127.0.0.1 1importantiamreal.com
127.0.0.1 www.1mybigdreamnowreal.com


Report •

#9
November 14, 2010 at 22:03:10
well those were added by spybot to prevent your machine from going there. The 127.0.0.1 is your localhost address. So if you put this in the hosts file and save it:

127.0.0.1 www.google.com

and then you try to go to google, you won't be able to get there because the address www.google.com will immediately resolve back to your machine instead of resolving via dns to their ip address which is actually 74.125.227.18

So long story short, those are actually good.


Report •

#10
November 15, 2010 at 15:14:16
All of my good scanners are coming up clean now, including Malwarebytes, Spybot S and D, AVG and MS Security Essentials. The one scanner I can not get to run is Ad Aware. The malware was blocking the service from even existing, so after scouring the web, this website showed an easy fix to create the service and then start it. I am now updating Ad Aware and preparing to scan. I figure if the malware is that scared of Ad-Aware, that must be the best thing to kill it.

http://www.lavasoftsupport.com/inde...


Report •

Ask Question