This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Can't stop browser redirects

66 min read

This thread's last reply is from October 9, 2010, 12:11 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

To answer your questions (IN CAPS)-

>Is there a pattern as to which websites you are being redirected?

I AM REDIRECTED TO VARIOUS WEBSITE SEARCH ENGINES BUT I HAVN'T RECORDED THEM ALL; TWO RECENT ONES THAT I REMEMBER ARE "SCOUR" AND "OHTGNOENRIGA" (I MAY HAVE THAT SPELLING INCORRECT). SOMETIMES I AM DIRECTED TO A SITE SIMILAR TO WHAT I'M SEARCHING FOR RATHER THAN TO ANOTHER SEARCH ENGINE.

>Are there any other PCs on the same wireless router as your machine? If so, are they experiencing any redirects?

NO OTHER PCs

>Was the Router administrator password changed when the Router was installed?

I DON"T THINK IT WAS CHANGED. I GOT A NEW ROUTER IN JUNE AS THE OLD ONE WAS GIVING PROBLEMS.

>They actually publish the list of the original, default passwords for each router on the Internet. You >can look it up for your make and model.
>Router Passwords Default List : http://www.phenoelit-us.org/dpl/dpl.html

MY ROUTER IS NOT ON THAT LIST. IT'S A WESTELL, MODEL A90-750020-07, REV. B

>If it is not changed when the router is installed, a ZLOB or other infection can use the default >password and change your router settings, so as to intercept every communication by passing it >through a spyware server. It will definitely produce redirects.
>In that situation, the router has to be re-installed so the malware server address can be removed. >(Then the password can be changed)

HAPPY TO REINSTALL IT IF YOU CAN TELL ME HOW, OR I CAN CONTACT THE ISP AND THEY CAN WALK ME THROUGH IT.

>You do have quite a few extra startups running on the machine, but nothing clearly malicious.

WHAT SHOULD I REMOVE? ...AND HOW?


NOTE: THIS MORNING I TRIED VARIOUS KEYWORD SEARCHES TO SEE WHERE I WAS BEING RE-DIRECTED AND I WAS *NOT REDIRECTED* AT ALL! COULD WHATEVER WE HAVE DONE SO FAR HAVE FIXED THE THE PROBLEM? I WILL TRY MORE KEYWORD SEARCHES TONITE AND SEE IF I HAVE ANY PROBLEMS.

ANOTHER NOTE: A COUPLE WEEKS AGO I LOOKED AT A HELP SCREEN ON FIREFOX ON REDIRECTS AND IT SAID TO TYPE "ABOUT:CONFIG" IN THE ADDRESS BAR, THEN "KEYWORD." WHEN I DID SO, IT SHOWED FOR "KEYWORD.URL" -- UNDER 'STATUS': USERSET; UNDER 'TYPE': STRING; AND UNDER 'VALUE': hxxp://mystart.incredimail.com/?loc=ff_ ... ar&search= .

IS THIS WHAT IT IS SUPPOSED TO BE, OR IS IT A PROBLEM?

Thanks
bmw3034
Take a look here: http://support.mozilla.com/en-US/kb/Sea ... r#Keywords

It tells you how to edit keywords. You need to look at yours and delete the one containing "mystart.incredimail"
It appears that I am no longer getting redirected in my search bar searches!

I'm not sure which of your many helpful suggestions did the trick but THANK YOU for all of them! My computer is also starting/running much faster.

A couple of final questions: Is there anything I should be sure either to DO or NOT DO to keep this from happening again?

Right now, I have Malwarebytes' Anti-malware, Spybot S&D and Glary Utilities on my computer. I believe I also have Windows Defender. Are these fine to keep and continue using?

Dies the paid version of Malwarebytes Anti-Malware offer additional protections and do you recommend it?

Again, THANK YOU for your help!!! I am very appreciative!
bmw3034,
Glad to help.
I would Uninstall Spybot S&D.
The paid version of Malwarebytes is a good value. If you use the paid version, you should disable Windows Defender, like so:
-----------------------------------------------------------
Disable Windows Defender
Go to Start > All Programs > Windows Defender.
Click on the Tools menu, click General Settings, Scroll down to Real-Time Protection Options section and Deactivate the Real-Time Protection system.

Then, in the toolbar across the top there is a little downpointing arrow next to the question mark icon.
Click on that, get a drop down list. One of the options is to exit Windows Defender.
Click on that, and there will be a pop up asking if you are sure you want to exit. Click Yes/OK.
------------------------------------------------
Reset System Restore Points
  • Click Start, All Programs, Accessories, System Tools, System Restore
  • Click Create A Restore Point then click Next. Give it a name and then click Create, then Close.
  • Click Start, Run and type Cleanmgr
  • Select the Windows drive (usually C:), then click OK.
  • After it scans, Click the More Options tab.
  • Click Clean Up in the System Restore Section.

This will remove all previous restore points except the newly created one.

Reboot your machine to record the changes you have made.
This System Restore sequence is not to be done regularly, but only as a Special Case after the removal of malware or changes in the Restore settings.

A few suggestions to keep from getting infected:
  • Maintain exactly one Antivirus program and One running antispyware program on your machine... not more.
  • Make sure your Windows is set to receive automatic updates.
  • Don't use or install any toolbars you don't absolutely need.
  • Keep Adobe Reader and Java Runtime Environment (JRE) up to date, and remove the old ones.
  • While you are on a website, NEVER agree to any request to update a "codec", "flash", or "media player" to see a video.
  • Don't click on a (blue) link in an e-mail, even from someone you know. Especially if it has a zinger title like "Ya gotta see this", etc.
  • In general, be careful what you click on !


Keep TFC to clean out leftover temp files once a month or so.

You should be good to go.
askey127