Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Can't get to Google's site 4

Status
Not open for further replies.
rosie123

rosie123

Technical User
Dec 15, 2003
46
US
This problem has me at my wits end.
Whenever I type in my browser (IE 6)instead of being taken to google's site I get an advertisement for SpyBouncer and I can't get past it.
The only way I can get to google's site is by searching for it in another search engine and then following that link there.

I have ran an adware/spyware program on my PC and have no adware/spyware...checked for viruses and i'm in the clear.

At this point i'm just trying to figure out WHY this is happening...it's REALLY annoying.
I checked my start up and cleared everything unnecessary out of it. Deleted temporary internet cookies, files, history, etc.

Has this happened to anyone else?? What can I try?

Sincerely,
One flusterated Network Administrator
 
Sort by date Sort by votes
I'm running a program called Ad-ware 6.0 and also Spybot.

When I click on your Test link I get to google.
It's REALLY wierd. I have to use links to get there I cannot get there by typing the web address in my browser.
 
Upvote 0 Downvote
You probably need to run "Hijack This" (HJT) looking for hijack entries in your HOSTS file such as the following:

O1 - Hosts: 66.98.142.163 yahoo.com
O1 - Hosts: 66.98.142.163 O1 - Hosts: 66.98.142.163 google.com
O1 - Hosts: 66.98.142.163
You will notice above that all the URLS resolve to the same IP number - accordingly clearly hijacking such entries.

Go to for more info on HJT and/or to post a HJT log ( should you need more assistance.
 
Upvote 0 Downvote
I ran Hijack This and here's my log:

Logfile of HijackThis v1.97.7
Scan saved at 7:55:56 AM, on 5/27/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\PROGRA~1\AWS\WEATHE~1\WEATHER.EXE
C:\Program Files\SlickRun\sr.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\rosiec\LOCALS~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
R3 - URLSearchHook: (no name) - {D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - (no file)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5Cmozilla.org%5CMozilla%5Csearchplugins%5CNetscapeSearch.src"); (C:\Documents and Settings\rosiec\Application Data\Mozilla\Profiles\default\51kiils8.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\WEATHER.EXE 1
O4 - HKCU\..\Run: [SlickRun] "C:\Program Files\SlickRun\sr.exe"
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - O16 - DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} (Quicksilver Class) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = interland.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7E504F8-A3EB-478D-9F40-FFAE9F044155}: NameServer = 192.168.2.210,204.254.120.7
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = interland.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = interland.com
 
Upvote 0 Downvote
Hi Rosie123,

Run HijackThis and have it fix the following options:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
R3 - URLSearchHook: (no name) - {D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - (no file)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - O16 - DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} (Quicksilver Class) -
John
 
Upvote 0 Downvote
Still no luck
I deleted those things. Here's my new log:

Logfile of HijackThis v1.97.7
Scan saved at 8:53:16 AM, on 5/27/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\PROGRA~1\AWS\WEATHE~1\WEATHER.EXE
C:\Program Files\SlickRun\sr.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis.exe

N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5Cmozilla.org%5CMozilla%5Csearchplugins%5CNetscapeSearch.src"); (C:\Documents and Settings\rosiec\Application Data\Mozilla\Profiles\default\51kiils8.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\WEATHER.EXE 1
O4 - HKCU\..\Run: [SlickRun] "C:\Program Files\SlickRun\sr.exe"
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = interland.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7E504F8-A3EB-478D-9F40-FFAE9F044155}: NameServer = 192.168.2.210,204.254.120.7
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = interland.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = interland.com
 
Upvote 0 Downvote
Actually---i just tried it again...going to google's site and i get to it!!!!!!!!!!!!
Looks like it worked...thanks everyone :)
 
Upvote 0 Downvote
Upvote 0 Downvote
I left the weather.exe installed.
I have the weather bug installed and i don't want to get rid of it.
 
Upvote 0 Downvote
rosie123

Does the computer have any applications on that use adverts? If not, it can probably safely go, but of course I don't know exactly what is installed on your PC.

John
 
Upvote 0 Downvote
I would also get rid of:

C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE

Use "google toolbar" to stop pop-ups. PSFREE.EXE is malware.





Unix IS user friendly... It's just selective about who its friends are.
 
Upvote 0 Downvote
rosie123, if weatherbugs server gets infected, you are infected unless you've got good anti-virus software installed. (I've seen it happen.)

Glen A. Johnson
If you're from Northern Illinois/Southern Wisconsin feel free to join the Tek-Tips in Chicago, Illinois Forum.

TTinChicago
Johnson Computers
 
Upvote 0 Downvote
I never thought of that.
It running on a bunch of our production PC's.
Probably be best if it wasn't ...thanks Glen!
 
Upvote 0 Downvote
I had a similar problem and downloaded a program called CWShredder. If still having problem, might try this.
 
Upvote 0 Downvote
I have found Spy Sweeper to be better than either Spy Bot or Ad Aware. Has anyone else used Spy Sweeper? I'm not sure if it would have helped you in your case.
 
Upvote 0 Downvote
Hopefully this is the right group to ask for assistance with this problem.
I created a database in Access 2000 and used the security to protect it from user changes. The company has now upgraded to Office 2003. The problem is now I can not make changes because the security shows the current owner is unknown and my profile as administrator will not allow me to change the owner.
Is my only choice to copy the tables etc and rebuild?

Thanks in advance for any assistance. Randy
 
Upvote 0 Downvote
RandyRMS

Your problem is a new one, unrelated to the content of this thread. I would recommend starting a new thread.

John
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

K
  • Question
PABX SL1000 to add Ext Operator
Replies
0
Views
395
kennychin
K
idahomitel
  • Locked
  • Question
SX 200 cfna to operator
Replies
0
Views
361
idahomitel
idahomitel
Mirzapur
  • Locked
  • Question
NEC SV9100 Trunk to Trunk Transferred call Not disconnecting issue
Replies
0
Views
483
Mirzapur
Mirzapur
T
  • Locked
  • Solved
Not able to log into my previous account, and there's no "Forget Password"
Replies
15
Views
1K
Chris Miller
Chris Miller
DrB0b
  • Locked
  • Question
Help Please, Trying to Convince Company Mixing Personal and Corporate Email is Bad Practice
Replies
9
Views
565
DrB0b
DrB0b

Part and Inventory Search

Sponsor

Back
Top