Google searches redirected, but no Viruses detected by McAfee

[Arcadianu9]

I know I have a virus, because my Google searches send me to random, unwanted webpages whenever I click on a link.  This is reproducable in both Internet Explorer 8 as well as Chrome.

I have McAfee Security Center 9.15, and it does not detect any viruses.  I have also installed the Virtual Technician, and it says that everything is working properly.

However, my web browsers continue to misdirect me to unwanted websites.

Please me to fix this.  Thank you.

[Dinz]

Hi,

This will help you clear your IP stack and DNS cache to resolve issues which may be caused by malicious software or incorrect configuration.

1. Click Start, Settings, and select Control Panel.
2. Double-click Network Connections.
3. Right-click the Network Connection icon and select Properties.
4. Select Internet Protocol (TCP/IP) and click Properties.
5. Verify that your settings are identical to those displayed below. If they are not, make the necessary changes and click OK.
   
   
   
    
6. Click Start, Run, type cmd, and press ENTER.
7. In the command prompt window, type:
   
   ipconfig /flushdns
   
    
8. Press ENTER.
9. When the command prompt is returned, type:
   
   ipconfig /renew
   
    
10. Press ENTER.
11. Close the command prompt window.

For Windows Vista computers

1. Click Start and Control Panel.
2. Open Network and Sharing Center.
3. Click Manage network connections in the left pane.
4. Right-click Network Connection and select Properties.
5. Select Internet Protocol (TCP/IP) and click Properties.
6. Verify that your settings are identical to those displayed below. If they are not, make the necessary changes and click OK.
   
   
   
    
7. Click Start, Search, type cmd.exe, and press ENTER.
8. In the Search Results window, right-click cmd.exe and select Run As Administrator.
9. In the command prompt window, type:
   
   ipconfig /flushdns
   
    
10. Press ENTER.
11. When the command prompt is returned, type:
    
    ipconfig /renew
    
     
12. Press ENTER.
13. Close the command prompt window.

And let me know if you have any more issues on this.

Thanks,

Dinesh K

[Arcadianu9]

Hi, thanks for the response.

I tried your suggestion, and it did not seem to work.

I verified my TPC/IP settings matched your images, and I ran the command lines, and successfully flushed the DNS cache.

However, if I bring up Google, search for anything, and click on the links, it may not happen the first time, but the second, third, and fourth times it continues to bring me to random, unwanted sites, instead of the link that's actually on the Google search.

Thanks in advance for any more help you can provide.

[Dinz]

Hi Jeff,

If your system is infected with this Trojan, your web browser and other Internet applications will be unable to access the intended website, and are instead redirected to unwanted websites

1. Download the Stinger tool from the link below:

http://download.nai.com/products/mcafee-avert/stinger.exehttp://download.nai.com/products/mcafee-avert/stinger.exe

2. Double-click Stinger and select Preferences.
3. Enable the Report Applications option.
4. Click OK.
5. Click Scan Now and allow the scan to complete.

NOTE: During the scan, you may receive a clean error during on certain .cab files. Ignore the error and allow the scan to complete. The files will be removed when the system is restarted.

6. Restart your computer.
7. Run Stinger again using the steps above.

Update me on the status after running the scan.

Regards,
Dinesh K
McAfee Online Community Moderator

[chickenpilot]

I am having the same problem  it just started today. I ran the stinger program once and it didnt find anything. Running it again now but hasnt found anything and I am still getting a new browser tab sending me to a unrequested  new site  every once in a while.

[wileyken]

I'm having a similar issue, browser windows pop-up at random but they are directed to betting sites or sat.TV.

I ran Microsoft's MRT, it found Win32/Rustock.  McAfee found something different.  I let MRT remove Rustock and McAfee remove what it found buried in a java distribution of some sort.

While the number of browser invokes are fewer, they are still there.

I also tried HiJackThis, but found no trail with that tool.

[SamSwift]

Moving this thread to the Security Awareness community.

Also:

You might want to check the host file to see if it's been modified via the typical location of C:\windows\system32\drivers\etc\ then file 'hosts'.  Typically malware will try to block users from accessing certain sites by changing this host file to block access.

Edit the "hosts" file with the Notepad application to see if there are any additional entries beyond the standard template like below:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

Hope this helps.

Sam

[chickenpilot]

Ran the stinger program and  McAfee both programs are up to date  but neither fixed the problem. Is this something that is an easy fix or should I reformat? Looking for the easiest fix for a non tech computer person.

[judithd]

I did what you suggested and the screen looked exactly the way you described... except... it had a number below the last line, to wit   127.0.0.1 local host

Should that be there? Judith

[NicoleW]

All I can say is goodluck.  I have a similar issue and have total care  vers 9.15 installed - it says I am protected - have fully scanned no less than 20 times in the past 4 days.  Went through paid support virus removal 5 days ago through McAfee - they have spent countless hours connected to my pc ran every utility known to man and havent been able to fix or even locate the issue.  They initially pointed the finger at IE but it is the same with Firefox AND Opera.  Some of my searches go through but for the most part...doesnt matter - yahoo, google, msn...they get redirected.  I was even on a secured site - no other browsers open no email running no messenger - NO OTHER APPS....and a window popped up for dish network.

Paid support has been disappointing... they never call back when they say they will YOU have to hold for 1- 1.5 hours to get through and they say....we were just about to call you.  Seriously?  Is that the best you can do?  I pay for total care then pay for support and McAfee cant remove a virus?  Really?

I have a home based business and this is an issue that affects my business and costs me money in a BIG way.