redirect problem with google

Everytime I try to go to www.excite.com, I am redirected back to my google home page.  I have tried typing into the url area with the same results. I can get onto excite with my wifes laptop using my wireless sytem.
I am running XP sp2 and ie7. I have tried reverting back to ie6 and get the same results.
Joe.

[Moderator]

Are you running OpenDNS by any chance ? ?
They are having issues with this ...i'll dig up the article.
If not run all your protection programs in safemode and let them fix what they find
Post back with a list of what you ran and the results. We may request a HijackThis log...

I don't know how to check the open dns.  I have run Spy Bot and Cleaner while in the safe mode. I did find some problems and fixed them.

I should add that I run Road Runner and have a wireless network at the house, but I am running my desktop. The problem doesn't appear on my laptop.

[Moderator]

What else do you have for protection ? ?
You'll need more than Spybot...
We have an excellent list of Free alternatives...

What else do you have for protection ? ?
You'll need more than Spybot...
We have an excellent list of Free alternatives...

I run CA Security includes antivirus, anti spyware, and personal firewall. I also have Registry Mechanic and CCleaner. I have run MS malware removal tool and their free system scan..


[getting space - attachment deleted by admin]

Please, post your HJT log at "Computer Viruses and Spyware". Attach a link to this thread.

Please, post your HJT log at "Computer Viruses and Spyware". Attach a link to this thread.

I checked out openDNS. No, I am not running it. Should I be?

Did you post HJT log?

I think so. There was a little link at the top that took me to it when I clicked it.
Joe

There was a little link at the top

What link? Where?

five notes above this one at the top.

Oh, OK....sorry. I'll take a look...

1. Print this post out, since you won't have an access to it, at some point.

2. Download, and install Spybot (if you don't have it) from here: http://www.safer-networking.org/en/download/index.html

3. Close all windows, except for HJT.

4. Put a checkmark next to following HJT entries:

- O2 - BHO: MSVPS System - {3ADCBC16-19FA-4C59-9C22-E17C71B5FD7A} - C:\WINDOWS\bndsronw.dll

- O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)

- O3 - Toolbar: The netadv - {ABF529BE-6245-465A-BBD4-238C4EAB0F0A} - (no file)

- O21 - SSODL: msvb - {2C11C8BA-FCE4-4FC1-BBF4-D845159A4D64} - (no file)

- O21 - SSODL: sysdx - {6AE680E5-71F6-4ED1-BF0E-1D0E3AFA4C2C} - (no file)

- O21 - SSODL: msmhost - {9AE28521-B49A-4E6E-8806-66343BB9B0C2} - (no file)

- O21 - SSODL: msmdev - {309E43B8-E642-4BC3-8C4D-FC2FCC0FB29B} - (no file)


5. Click on "Fix It" button.

6. Restart your computer in Safe Mode (F8)

7. Run Spybot (click on updates, first), and fix whatever it asks you to fix.

8. Open Windows Explorer. Go Tools>Folder Options, put a checkmark next to "Show hidden files, and folders".

9. Delete following files (if they still exist):

- bndsronw.dll from C:\WINDOWS\

10. Turn off System Restore.

11. Restart in Normal Mode.

12. Turn System Restore on.

13. Run HJT again, and post back its log back here.

Thanks, I printed it and  I already have SpyBot. I will have to do this tomorrow when I am awake. It is 9:45  pm here in Ohio and I want to do this with a clear head. I will post the new log then.
Thanks again.

Getting old ain't for wimps.
Joe

I did everything and I am going to try to post the HFT file again.



[getting space - attachment deleted by admin]

[Moderator]

What part of Ohio ? ?
That's a nice part of the country.

Let me take a look...

Your HJT log is clean, except for 1 entry, I missed (not crucial, though).
Run HJT one more time, put a checkmark next to:
- C:\WINDOWS\ALCMTR.EXE
Click on "Fix it".
Restart in Safe Mode, and delete:
- ALCMTR.EXE from C:\WINDOWS\ directory (if exist)

Did Spybot report any problems?

When you're done, how is that redirection problem?

Westerville, Ohio, just outside the I 270 outerbelt, NE of Columbus.

After all the clearing I ran SpyBot update and got a couple updates. Ran Spybot again and got a couple hits:
Smitfraud-C[271001ie]Root class (Registry key, nothing done)
Smitfraud-C:[SBI$]Root root class)Registry key, nothing done),
Smitfraud-C[SBI$2710018E] Class ID )Registry key, nothing done)
Smitfraud-CMSVPS:[SBI $46F0A3D9] User setting (Registry key, nothing done)
HKEY_USERS_S-5-21-95389271-2071988878-309454382-1008\Software\Microsoft\Windows\CurrentVersion\Stats\{3ADCBC16-19FA-4C59-9C22-E1BSFD7A}

I can't find a check box for C:\WINDOWS\ALCMTR.EXE, I did find it in Windows, It is a RealTek file. Should I delete it for windows?

It fixed them I guess. Updated HJT log File attached.

The redirect problem still exist, but the address stays in the URL area longer before it jumps back Google.

[getting space - attachment deleted by admin]

It fixed them I guess

I guess, not:

nothing done

Did you:

Restart in Safe Mode, and delete:
- ALCMTR.EXE from C:\WINDOWS\ directory (if exist)

It's still in your HJT log. If you did delete it, we'll worry about later.

Now, to take care of "Smitfraud", please follow instructions from here:
http://www.bleepingcomputer.com/forums/topic17258.html

I can't see any Smitfraud-like entries in your HJT log, but we better make sure.

Spy hunter did'nt find anything about smitfraud.  It found a Wild Tangent file, but I think that is some kind of games that came with my HP computer.. It's past my bedtime.

[Moderator]

I was in Dublin this year for Jack Nicklaus's tournament....beautiful area.
I spent wayyyy too much money !

 

It found a Wild Tangent file, but I think that is some kind of games that came with my HP computer

Unfortunately, it's true.

I'd like to see your "hosts" file, if you can post a copy here.

BTW...I'd like you to install Firefox, and see if same thing will happen there.

I deleted Wild Tanget games. I am not much of a gamer. Maybe Solitare is all.

I don't know where my "HOST" file is.  I know just enough to be dangerous. That is probably why I am in trouble now.

I was in Dublin this year for Jack Nicklaus's tournament....beautiful area.
I spent wayyyy too much money !

Jack is a real folk hero around here. He was raised in Upper Arlington, which is an upscale area just a few minutes from Muirfield. (not my neighborhood.) You are right about the Golf Course, I is beautiful. Jack has a house right on the course, but I don't know which one it is.
 

I deleted Wild Tanget games

You mean, "uninstalled", right?

As for hosts file, you'll find it in:
C:\Windows\system32\drivers\etc\ folder
Open it with Notepad, and post a copy here.

I deleted Wild Tanget games

You mean, "uninstalled", right?

As for hosts file, you'll find it in:
C:\Windows\system32\drivers\etc\ folder
Open it with Notepad, and post a copy here.

I tried posting the Host File, but it tells me that is it too large. 150 pages long

I tried posting the Host File, but it tells me that is it too large. 150 pages long

What? Are you sure? I've never seen anything like that!!!
I'll PM you with my email address. Send it to me, because I want to take a look at that monster.

I tried posting the Host File, but it tells me that is it too large. 150 pages long

What? Are you sure? I've never seen anything like that!!!
I'll PM you with my email address. Send it to me, because I want to take a look at that monster.

I downloaded Firefox and am able to get on www.excite.com.

Cool
Forget about IE, then..

OK, thanks for your help on this. My PC is running faster now also.
Looking at the number of people reading this item, it would seem that I am not the only one with this problem.
Joe

You're welcome.
Believe me...lot of people have IE problems, but still many people use it. Why? Don't ask me...

Do you have any idea how ignorant we are? LOL

Have you run across something call kdwyv.exe?
I get an error message at bootup that it can't load it.
I think it might be a remnant of a spyware.  When I search for it
I get a lot of Chinese files.

Have you run across something call kdwyv.exe?
I get an error message at bootup that it can't load it.

I have not, but download "Autoruns" (http://www.microsoft.com/technet/sysinternals/Utilities/AutoRuns.mspx), and...

0. Create Autoruns folder in your root C:\ directory.

   1. Download and extract the Autoruns (http://www.microsoft.com/technet/sysinternals/utilities/Autoruns.mspx) program to C:\Autoruns

   2. Reboot into Safe Mode.

   3. Navigate to the C:\Autoruns folder you created in Step 0 and double-click on autoruns.exe.

   4. When the program starts, click on the Options menu and enable the following options by clicking on them. This will place a checkmark next to each of these options.

         1. Include empty locations

         2. Verify Code Signatures

         3. Hide Signed Microsoft Entries

   5. Then press the F5 key on your keyboard to refresh the startups list using these new settings.

   6. The program shows information about your startup entries in 16 different tabs.
For the most part, the filename you are looking for will be found under the Logon or the Services tabs, but you should check all the other tabs to make sure they are not loading elsewhere as well.
Click on each tab and look through the list for the filename that you want to remove (you can use File>Find, or CTRL+F). The filename will be found under the Image Path column.
There may be more than one entry associated with the same file as it is common for malware to create multiple startup entries.
It is important to note that many malware programs disguise themselves by using the same filenames as valid Microsoft files.
It is therefore important to know exactly which file, and the folder they are in, that you want to remove.

You are looking for following file(s): kdwyv.exe. PLEASE, DOUBLE CHECK YOUR SPELLING OF THIS FILE!!!

   7. Once you find the entry that is associated with the malware, you want to delete that entry so it will not start again on the next reboot. To do that right click on the entry and select delete. This startup entry will now be removed from the Registry.

   8. Now that we made it so it will not start on boot up, you should delete the file using My Computer or Windows Explorer (just use "Search). Make sure, that hidden files are shown (Windows Explorer >Tools>Folder Options>View tab, check "Show hidden files, and folders).

   9. When you are finished removing the malware entries from the Registry and deleting the files, reboot into normal mode.

[Mod & Malware Specialist]

Have you run across something call kdwyv.exe?

Looks like a Vundo filename to me...

1. Download VundoFix and save it to your desktop.
2. Run VundoFix and click on Scan For Vundo.
3. Once it's done scanning, click on Remove Vundo.
4. When it prompts you to remove the files, click on Yes.
5. Your desktop will go blank as it's removing files.  Don't worry, this is normal.
6. It will prompt you to restart your computer, so click OK.
7. When your computer is turned back on, your problem should be gone.
8. The program normally produces a Vundofix.txt file.  Please locate this file and paste the contents in your next post.

And then, just to be thorough...
1. Download VirtumundoBeGone and save it to your desktop.
2. Reboot into Safe Mode.
3. Once you are in Safe Mode, run VirtumundoBeGone and follow the instructions.
4. Exit when it has finished and reboot back into normal mode.
5. The program normally produces a VBG.txt file.  Please locate this file and paste the contents in your next post.




Also, locate that hosts file again and like Broni said, open it with Notepad.  Once you do that, go to File > Save As and save it to your desktop as a .txt (Notepad) file.  Then attach it to your next post.  If you can't, then go ahead and e-mail it to Broni if he has given you his e-mail address.  If you hosts file has been altered by an infection, it can cause many redirects.

virtumundobegone was negative

[getting space - attachment deleted by admin]

There are two files. I think I sent the same file twice.

[Mod & Malware Specialist]

virtumundobegone was negative

And what about VundoFix?  Was that negative as well?  There's a chance a chance that the file has been deleted and there's still a trace of it in the registry.  However, we don't know for sure exactly what the file is, so we shouldn't jump to any conclusions yet.

Have you tried the steps in Broni's last post?  And what about the HOSTS file?

Sorry about getting back to you so late.  I had to take wife up to Amish Country in Northern Ohio.

Vundo fix was negative also. I had to e-mail the host file to Broni because it was so big the the att. opt. wouldn't accept it.

The notice I get says that windows could not find the file at memory ....... and ask me if I want to try to fix .etc. the name of the file name at the top left of the notice is the kdwyv.exe.

Student of the Bilbe? check this out:
Jeremiah 33:3
New International Version
Call to me and I will answer you and tell you great and unsearchable things you do not know.

You guys have taken me to places I didn't know existed.

I'm just going through my mail, so I don't know, if I got it, but meanwhile I'd like to ask, if you went through "Autoruns" instructions...

I just finished to check my mail, but there is nothing there from cyborg3

I just sent Broni an e-mail with the host file from 10/30.
I though I sent it but I probably had a senior moment.

Have you run across something call kdwyv.exe?

Looks like a Vundo filename to me...

1. Download VundoFix and save it to your desktop.
2. Run VundoFix and click on Scan For Vundo.
3. Once it's done scanning, click on Remove Vundo.
4. When it prompts you to remove the files, click on Yes.
5. Your desktop will go blank as it's removing files.  Don't worry, this is normal.
6. It will prompt you to restart your computer, so click OK.
7. When your computer is turned back on, your problem should be gone.
8. The program normally produces a Vundofix.txt file.  Please locate this file and paste the contents in your next post.

And then, just to be thorough...
1. Download VirtumundoBeGone and save it to your desktop.
2. Reboot into Safe Mode.
3. Once you are in Safe Mode, run VirtumundoBeGone and follow the instructions.
4. Exit when it has finished and reboot back into normal mode.
5. The program normally produces a VBG.txt file.  Please locate this file and paste the contents in your next post.




Also, locate that hosts file again and like Broni said, open it with Notepad.  Once you do that, go to File > Save As and save it to your desktop as a .txt (Notepad) file.  Then attach it to your next post.  If you can't, then go ahead and e-mail it to Broni if he has given you his e-mail address.  If you hosts file has been altered by an infection, it can cause many redirects.

Turns out as a Trojan Downloader; ww32/Zlob

[Mod & Malware Specialist]

So...was the infection cleaned?
Are you still experiencing problems?
Let us know.

The software said it was cleaned, but I am not sure. My Out look EXp seems to hang up and I have to run my anti spy thing, then it seems to work.  I seem to get a lot of runtime errors also.  Most of my software works though. 

Is RegCure any good?  What kind of registry repair program would you recommend?

[Mod & Malware Specialist]

Personally, I stay away from registry repairs/cleaners.  Many of them seem to be a bit less than helpful.  However, CCleaner is a great program.  Just make sure you install it without the optional Yahoo! toolbar, then use CCleaner to clean out your temp files and registry (be sure to make a backup when prompted).

Try running a scan with SUPERAntiSpyware in Safe Mode.  If you are still experiencing problems, feel free to post a new HijackThis log so we can see if something else might be lurking about.

I ran ccleaner and downloaded and ran Superantispy in safe mode
CCleaner seemed to remove a lot and I downloaded and ran superantispy in safe mode. It came back negative.

Last night I ran defender in the quick scan mode; came back negative.  Then I ran it in a complete system scan and it found Trojan Downloader: win32Zlob. It did referance HJ as a resource. My computer seems to be running OK, but, I am holding my breath. Thanks again for your help and patience. 
Joe

att. HJL

[saving disk space - old attachment deleted by admin]

Your HJT log is clean....Keep us updated

How is your computer doing, anyway?

BTW...I don't like Windows Defender. Your warning might have been false positive, since no other program detects anything

My computer seems to be running OK. I think the Ccleaner may have helped more than anything.  I have had a lot of runtime errors up until today. I haven't had any today.

The only reason I have defender is because it is a free download. 

I read an article a while back about anti virus programs.  They tested most of the popular programs at the time against 1000 known virus'.  Most of them missed about 5 to 7 percent of them.  None of the missed ones were all the same.  That led me to believe that we have to have 200 anti virus programs to get them all. I can't recall which one was the best, but it wasn't Norton or McAfee.
Thanks again, Joe

Windows Defender is not antivirus program. It's more antimalware program, but it doesn't have too good press.
I'd recommend to disable it.
You have your firewall, and antivirus program running now. That's the basic protection.
On a top of it, I'd recommend, you download two free programs, which will give you an extra protection in real time:
- a-squared: http://www.emsisoft.com/en/software/free/
- Spyware Terminator: http://www.spywareterminator.com/