Computer problems?

[luvmy3jewels]

I'm hoping that someone on this board can help me diagnose what is going on with my computer. Last week I started noticing that when I try to run a google search I get re-directed to another site. There have been a few times that I have been on the site that I wanted to read and the screen begins to re-direct to another site.

The first time I noticed this, I immediately thought it must be a virus. However, I have run a full scan using Symantec (up to date) and have not been able to detect anything. (The computer also has periods where it sounds like my hard drive is revving up).

Does anyone have any suggestions as to what could be going on with my machine? I am purely a plug n play kind of girl, so I am at wits end (and I am afraid to google this question).

 

[Luvchefmic]

I'm hoping that someone on this board can help me diagnose what is going on with my computer. Last week I started noticing that when I try to run a google search I get re-directed to another site. There have been a few times that I have been on the site that I wanted to read and the screen begins to re-direct to another site.

The first time I noticed this, I immediately thought it must be a virus. However, I have run a full scan using Symantec (up to date) and have not been able to detect anything. (The computer also has periods where it sounds like my hard drive is revving up).

Does anyone have any suggestions as to what could be going on with my machine? I am purely a plug n play kind of girl, so I am at wits end (and I am afraid to google this question).

I don't think its your computer at all...I think its google itself. Last night I tried to do a google search & a screen came up saying something about a search that my computer was trying to do and asked me to prove that the search is legit ? try using dogpile.com or bing.com and see if your computer does anything bizarre...I like both those search engines..Good Luck sorry can't help about the "revving up" you mentioned....no knowledge there

 

[lynxstch]

Try another virus checking program or run some program that checks for spyware..Symantec may just not be catching it..I think someone on here advised the following once..
http://www.malwarebytes.org/mbam.php
I never tried it, but I believe that it's a free download and may help you out

there are also a lot of spyware programs that are free for the trying..one of them may get rid of your problem, unless it turns out to be just a google problem!

as for the 'revving sound'..we have an older computer and our hard drive does that sometimes also..usually when it's trying to run more than 1 program at a time..I periodically use a can of air dust spray on the back of the computer to clean out the dust..it usually helps quiet the sound

Good luck with both issues!

 

[love2disney]

I had almost the exact same problem today and none of my anti-spyware programs (SpyBot, AdAware, MalwareBytes, Housecall) could fix it. Fortunately, I found the solution on another board. As a little bit of background, viruses sometimes will alter your "hosts" file, which is basically a file that controls the redirecting for your browsers (specifically, this file makes it faster for your computer to convert URLs into the relevant IP addresses by having a shortcut list of IP addresses instead of having to look them up when you type in the URL). Alternately this is a malware called Kittyateit.

Anyway, enough background, here's what you need to do to fix:

(1) Click START > RUN > and type in "C:\windows\system32\drivers\etc\hosts"
(2) When prompted, open the HOSTS file in either Notepad or Wordpad
(3) Delete all the lines of IP addresses in the text document except for "127.0.0.1 localhost".

If you find several lines of IP numbers other than localhost in your hosts file, then this is almost definitely your problem and will be fixed right away. If not, then this probably isn't the issue, but it's worth a look.

Let me know how it goes -- best of luck! Let me know if it doesnt and I will tell you another solution.

 

[FireDancer]

I had almost the exact same problem today and none of my anti-spyware programs (SpyBot, AdAware, MalwareBytes, Housecall) could fix it. Fortunately, I found the solution on another board. As a little bit of background, viruses sometimes will alter your "hosts" file, which is basically a file that controls the redirecting for your browsers (specifically, this file makes it faster for your computer to convert URLs into the relevant IP addresses by having a shortcut list of IP addresses instead of having to look them up when you type in the URL). Alternately this is a malware called Kittyateit.

Anyway, enough background, here's what you need to do to fix:

(1) Click START > RUN > and type in "C:\windows\system32\drivers\etc\hosts"
(2) When prompted, open the HOSTS file in either Notepad or Wordpad
(3) Delete all the lines of IP addresses in the text document except for "127.0.0.1 localhost".

If you find several lines of IP numbers other than localhost in your hosts file, then this is almost definitely your problem and will be fixed right away. If not, then this probably isn't the issue, but it's worth a look.

Let me know how it goes -- best of luck! Let me know if it doesnt and I will tell you another solution.

This is the first thing I was going to suggest. You very well might have gotten some malware on the computer. Symantec won't catch all viruses, especially if you have a rootkit.

It sounds like you have something that is spoofing DNS. The easy way to do this is via the hosts file which is mentioned above. It could also be done my placing something directly into the TCP/IP stack which is pretty hard to get out. I would run the Microsoft Malicious Software Removal Tool which can be done by Clicking Start -> Run -> type MRT into the box -> enter. If windows is up to date it will show a date of June 2010 (July will be out tomorrow). Run a full scan.

Antivirus 2009 and 2010 displayed similar characteristics to what you are describing and whenever I came across computers with those I just wiped it and started over.

 

[msmayor]

Its definitely malware.

I had the re-direct issue on my desktop a few weeks ago. I tried a number of things to resolve it, and ultimately ended up reinstalling the OS to clean it up.

There is a wonderful forum at bleepingcomputer.com that has some great techs ready and willing to help you diagnose and fix computer issues.

I don't doubt that the 'easy' fix shown here by a PP may work, but often these malware attacks run much deeper. Some attacks will have a "wing-man" file embedded elsewhere that will automatically spring into action if the original file is deleted or disabled.

Whatever you do...PLEASE...don't make any system changes until you have completely backed up your files.

 

[tasha99]

I was going to say sounds like a rootkit virus as well. I had one that did the same thing and I was successfully able to remove it using malwarebytes and combofix. I say "successfully" because the symptoms are gone, but in truth, you never can tell. Some people prefer to start with a fresh install when something like that happens.

 

[browneyes106]

Like others have said it is likely malware but the problems you are having are known as the google redirect virus
http://ask.metafilter.com/100853/Oh-that-nasty-Google-Redirecting-Virus
http://www.brighthub.com/internet/google/articles/66090.aspx

 

[browneyes106]

Like others have said it is likely malware but the problems you are having are known as the google redirect virus
http://ask.metafilter.com/100853/Oh-that-nasty-Google-Redirecting-Virus
http://www.brighthub.com/internet/google/articles/66090.aspx

 

[Meriweather]

I also have this happening on my laptop....started in Dec.
DS ran it through a ton of malware, virus scans etc and it is still like that.
the computer is at my house in AZ, so nothing I can do now, but I will be down there next week.....I think we need to just start over.

Not only does google not respond, but anything associated with it, so I can not get to my gmail account from that computer.

 

[luvmy3jewels]

I had almost the exact same problem today and none of my anti-spyware programs (SpyBot, AdAware, MalwareBytes, Housecall) could fix it. Fortunately, I found the solution on another board. As a little bit of background, viruses sometimes will alter your "hosts" file, which is basically a file that controls the redirecting for your browsers (specifically, this file makes it faster for your computer to convert URLs into the relevant IP addresses by having a shortcut list of IP addresses instead of having to look them up when you type in the URL). Alternately this is a malware called Kittyateit.

Anyway, enough background, here's what you need to do to fix:

(1) Click START > RUN > and type in "C:\windows\system32\drivers\etc\hosts"
(2) When prompted, open the HOSTS file in either Notepad or Wordpad
(3) Delete all the lines of IP addresses in the text document except for "127.0.0.1 localhost".

If you find several lines of IP numbers other than localhost in your hosts file, then this is almost definitely your problem and will be fixed right away. If not, then this probably isn't the issue, but it's worth a look.

Let me know how it goes -- best of luck! Let me know if it doesnt and I will tell you another solution.

I have tried your suggestion and everything looks OK here (only had the localhost IP address). I also tried FireDancer's suggestion and ran Microsoft's Malicious spyware scan, which didn't find anything either. I tried another version of a spyware scan and it found a bunch of adware tracking files, but that was it. Whatever is going on with my machine must be buried pretty deeply!!

Thanks for everyone that provided advice. I hope the people that send out this crap on the internet get what is coming to them!!

 

[tvguy]

We upgraded our Norton anti-virus and now it takes you to ASK.COM instead of GOOGLE. It's bungled in Norton, which is why Norton is coming off the computer when the subscription is up.

 

[smphbear]

I take care of the computers at our school. I despise Norton. DH and I have cleaned many computers with a working Norton subscription that had viruses and malware.

One of the teachers brought me her husband's laptop for his business. It was running Norton, but a serious rootkit got right on through. First thing I do is get rid of Norton. Many of them will tell us to get rid of it now since their computers were so infected.

There are some pretty good free anti-virus programs out there.

 

[love2disney]

If this is still an issue The software I use to remove rootkit is called Hitman Pro 3.5
http://www.hitmanpro.com

It scans your PC in just 2-3 minutes and successfully cures the atapi.sys / Google redirect infection.

Best way to download it is thru cnet.com This is freeware and will definitley cure ur PC

 

[FireDancer]

Unfortunately it is almost impossible to get a rootkit out of your system. Even if it appears to be gone it very well could be sitting there waiting for a future exploit. I would just backup your data, wipe the drive, and reinstall Windows from bare bones. Make sure to also wipe and recovery partitions as a good rootkit could bury itself in there only to come back at a later time.

I would also get away from Norton. Unless you are in an enterprise environment there is no reason to pay for AV software. Most commercial products are bloated at this point anyway. I recommend AVG, Avast, or Microsoft Security Essentials.

 

[mrodgers]

If this is still an issue The software I use to remove rootkit is called Hitman Pro 3.5
http://www.hitmanpro.com

It scans your PC in just 2-3 minutes and successfully cures the atapi.sys / Google redirect infection.

Best way to download it is thru cnet.com This is freeware and will definitley cure ur PC

My solution.... When in the Google results, I have to right click, copy link location, paste it into the address bar manually.

I've had this now for months and months. I've tried everything I could think of and every solution I've found on the internet, including every suggestion in this thread.

Checked the host file
Malwarebytes
Superantispyware
Spybot S&D
Adaware
Hitmanpro
Microsoft malicious spyware scan
ComboFix
Every other scanner that is recommended on the Bleepingcomputer.com and similar sites.

I can't get rid of it.

 

[msmayor]

Unfortunately it is almost impossible to get a rootkit out of your system. Even if it appears to be gone it very well could be sitting there waiting for a future exploit. I would just backup your data, wipe the drive, and reinstall Windows from bare bones. Make sure to also wipe and recovery partitions as a good rootkit could bury itself in there only to come back at a later time.

I would also get away from Norton. Unless you are in an enterprise environment there is no reason to pay for AV software. Most commercial products are bloated at this point anyway. I recommend AVG, Avast, or Microsoft Security Essentials.

But folks should also be aware that these are not cure-all programs.

I faithfully ran AVG and did everything experts say to keep my system clean...and STILL got the redirect malware. Nothing is going to stop every infection possibility.

The best defense is simply making sure you regularly back up your data, and ensure you have everything needed to restore your system. A full reinstallation of the OS is the only sure-fire way to eliminate a problem, and as long as you have the back-ups its quite easy to do.

I've restored my laptop three times over the last 6 years, and had to do my desktop once. Takes a few hours, but its not a big deal as long as you have everything.

An external hard-drive for backing up can be your best friend.

 

[luvmy3jewels]

Thanks to everyone that has posted. It has been very interesting reading all of the comments and suggestions. At this point after trying multiple scans and not finding anything I think I will have to back up my data and reload windows (what a pain!!).

Should I worry about my security (passwords, acct info, etc) on this computer?

 

[cteddiesgirl]

An external hard-drive for backing up can be your best friend.

As long as you have a USB 2.0 port. My computer is so old that it has older USB ports and it takes hours just to copy a couple gigs of files. I can't even try to let it copy everything on my computer over night. It just wouldn't get done.
I'm in the process of trying to copy my files to an external hard drive. Mainly because my computer is so old that it will probably just die on me any time. I don't want to lose the 100 or so gig of music on my computer.

 

[FireDancer]

But folks should also be aware that these are not cure-all programs.

I faithfully ran AVG and did everything experts say to keep my system clean...and STILL got the redirect malware. Nothing is going to stop every infection possibility.

The best defense is simply making sure you regularly back up your data, and ensure you have everything needed to restore your system. A full reinstallation of the OS is the only sure-fire way to eliminate a problem, and as long as you have the back-ups its quite easy to do.

I've restored my laptop three times over the last 6 years, and had to do my desktop once. Takes a few hours, but its not a big deal as long as you have everything.

An external hard-drive for backing up can be your best friend.

Absolutely. The most important protection from anything is user behavior. Anti-Virus, firewalls, registry monitors, etc are all secondary to user behavior.

As long as you have a USB 2.0 port. My computer is so old that it has older USB ports and it takes hours just to copy a couple gigs of files. I can't even try to let it copy everything on my computer over night. It just wouldn't get done.
I'm in the process of trying to copy my files to an external hard drive. Mainly because my computer is so old that it will probably just die on me any time. I don't want to lose the 100 or so gig of music on my computer.

You can install a PCI card with either USB 2.0 ports or firewire ports and get your speed that way.