For quite some time now, about 5-10 percent of the time I click on a google search result, I am led to a parked domain like page full of text link ads. For instance if I search for "puppies" I might get something like the daily puppy website. I will go to click on the link and end up at a page full of text link ads and such. I push the back button and see that indeed the link I clicked on wasn't visited and so I click on it again and get to the site I wanted to go to.
Spybot S&D is finding things McAfee is not, but still having issues with the redirects. MVT also reports file \program files\mcafee\mpf\mpfsbt.inf is missing.
EDIT: Is there a boot scan option anywhere?Message was edited by: snotweasel on 3/9/10 3:21:53 PM CST
Which version of the McAfee software are you using ?
Have you also installed the SITE ADVISOR ???
I suspect your browser has been hijacked and thus your searches are being redirected to a suspicious website. I suggest you do a reinstallation of your McAfee software and also make sure to install the browser protection. It comes in handy.
Update it and run a scan. Please let me know what are your findings on this
You might also want to check the host file to see if it's been modified via the typical location of C:\windows\system32\drivers\etc\ then file 'hosts'. Typically malware will try to block users from accessing certain sites by changing this host file to block access.
Edit the "hosts" file with the Notepad application to see if there are any additional entries beyond the standard template like below:
# Copyright (c) 1993-1999 Microsoft Corp.
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
# For example:
# 220.127.116.11 rhino.acme.com # source server
# 18.104.22.168 x.acme.com # x client host
I've re-installed and MVT reports clean, but I'm still getting redirects seemingly at random from google search results. If I browse back and retry, it will go through. The hosts file is clean. Still having this issue please help.
No toolbars and just the mcafee, .NET and java plugins in FF. From what I can tell, it only happens (time to time) when I click on a google result, redirecting me to some site that has other links semi-related to the original search. On occasion it will open one of those pages made to look like an XP backdrop saying my system needs cleaned. Thanks for your help so far.
Problem solved. It was a smack forehead solution. Ran MSCONFIG and found a suspicious lil bugger in startup called ODBCSTREAMGLADE.DLL. I disabled it and deleted on reboot. Upon a google search, PrevX was the only hit that came back and recognized it as malware. Now I just need to cross my fingers and hope thats all thats needed for removal. Hope this helps others.