[Resolved] Google search brings up wrong webpages

Nope the only extension I have is Java Quick Starter

Apologies, that refers to the Default Theme, my bad. Do you have many/any settings (other than bookmarks) that you wish to keep? We may have to re-install the Firefox profile to clear this thing out.

I cant do anything with the default theme nope I have tried uninstalling a re installing firefox but that didnt seem to work dont know anything about the firefox profile tho so no I have nothing I wish to keep

Hi,

OK, let's try and re-install the profile. First, let's backup your Bookmarks (if you have any you wish to keep).

Click Bookmarks >> Organize Bookmarks. Click the Import and Backup button, click Backup… and then save the backup file to a location of your choice (like "My Documents"). Just make sure that you do not save it in this folder:
c:\documents and settings\administrator\application data\mozilla\firefox\profiles\n7xx419v.default

We need to make sure all hidden files are showing so please:

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Show hidden files and folders.
• Uncheck the Hide protected operating system files (recommended) option.
• Click Yes to confirm.
• Click OK.

Right-click your Start button and select Explore. Navigate to the following folder:
c:\documents and settings\administrator\application data\mozilla\firefox\profiles

Right click on the n7xx419v.default folder and select Send To > Compressed (zipped) Folder.

Please go to this site:
http://www.bleepingcomputer.com/submit-mal….php?channel=72

And submit the .zip file we just created (should be called n7xx419v.default.zip, in the same folder we just navigated to).

Now close Firefox (make sure all instances of Firefox are closed).

Next, navigate back to:
c:\documents and settings\administrator\application data\mozilla\firefox\profiles

Delete these items:
n7xx419v.default
n7xx419v.default.zip

Start Firefox. You should be "greeted" as if this is the first time you have run it. All you settings should be reset. You can restore your bookmarks by doing the following:

Click Bookmarks >> Organize Bookmarks. Click the Import and Backup button, click Restore > Choose File… and then select the backup we created earlier.

Please check for the same redirect problem.

Let me know how all that goes, any questions about any part of it just let me know.

Thanks.

I did everything you said but still… im being redirected !

Hi,

That's no good

Click Tools >> Options. Go to the Content tab. Uncheck the Enable Javascript checkbox and then click Ok. Restart Firefox and check for redirects.

This is a tricky one, never seen something this stubborn and sneaky before.

Just letting you know I may be off soon, but I will post back tomorrow as soon as I can. Just in case you wonder why I suddenly stop replying.

Thanks.

Still getting the redirects, I have noticed that when I click a link it says www.clickfraudmanager.com with alot of text after it down the bottom of the page, it will then take me to unwanted search engines and different sites, you sure its something to do with the extensions not the trojan still tampering around

Hmm. The thing that makes me think it is a problem with a Firefox component is that you don't have the redirects in Safe Mode. There are infections that are Firefox components and they do things like cause search engine redirects etc, purely targeting Firefox.

Nevertheless, you are right, we cannot rule external causes out.

Please start MalwareBytes' AntiMalware. Update it, and run a Full System Scan. If it finds anything, post the log.

Just want to check another Firefox setting.

Click Tools >> Options. Go to the Advanced tab. Within this tab, go to the Network tab, and click Settings. Check that it No Proxy is selected.

Thanks.

The No Proxy is selected, I will post the log as soon as it has finished scanning

Malwarebytes' Anti-Malware 1.33 Database version: 1739 Windows 5.1.2600 Service Pack 2 10/02/2009 01:16:15 mbam-log-2009-02-10 (01-16-15).txt Scan type: Full Scan (C:\|) Objects scanned: 109895 Time elapsed: 1 hour(s), 27 minute(s), 44 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) It did find virus's, I deleted them but for some reason it hasnt listed them in the log

Hi,

Any chance you can remember any of the infection names? No worries if you can't.

Have you had AVG scan your whole system recently? If not, please do that now, since it was the program that found the Virus in the first place.


Let's get another opinion as well.

Download avz4.zip from here

• Unzip it to your desktop to a folder named avz4
• Double click on AVZ.exe to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window: [external image: Posted Image]
• Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

• After the update, from the "File" menu, choose "Standard Scripts"
• Put a check next to item 2: Advanced System Investigation
• Click Execute selected scripts
• At the next prompt, click the OK button
• Let the scan run and click "OK" when the completion prompt pops up
• Now Close out of the Standard Scripts window, and exit AVZ
• Navigate to the avz4 folder and locate the folder LOG
• Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip
• Attach virusinfo_syscheck.htm to your next reply.

Thanks.

I cant remember the virus no all I know is that they were Trojans AVG found no trojans but it did find quite a few tracking cookies

Hi,

Are you definitely only getting this in Firefox, not in Internet Explorer?

I have another folder that I would like you to upload, exactly the same as before:
C:\Program Files\Mozilla Firefox\extensions\{D96F1D71-4F95-443A-8AF3-541BFDBA096D}

Thanks.

Its definitely firefox ive checked IE and theres no redirects at all I cannot upload that folder at all it wont let me