searchportal.information.com redirect 1

[paulhthomas]

Hi all, I'm pretty positive that my problem isn't spyrware / adware / malware trelated which is why I'ev posted it here instead.
I've run software such as Adaware, Spybot, HijackThis, Windows Defender and they all come back clean. I'm also running Mcafee VirusScan Enterprise 8.0i with th anti spyware plugin.

If I'm in work (laptop) and mistype a url, ergewiveh.couk for example, I get a
"The requested URL could not be retrieved" page
What I suprise I hear you say!
However, when I'm at home, if I type the same url, my brower redirects me to searchportal.information.com

I have checked the registry for this value, nothing!
I have tried uncheckingt he "automaticall detect settings" in the Lan Settings options. Still no joy.

I'm struggling here! help!

Any help GREATLY appreciated!

Thanks

Paul


Paul Thomas
Network+ - Passed
70-210 - Passed
70-290 - Passed
70-291 - Passed
70-293 - Working towards

 

[bcastner]

http://www.spywaredata.com/spyware/threat_list/CWS hijack/result.php

See faq608-4650 on removing CWS hijacks.

 

[paulhthomas]

Hi bcastner, thanks for the post.
I've run CWShredder again and it's not found anything.
I'm now running the online Panda scan now, will let you know if it finds anything.

Thanks again

Paul Thomas
Network+ - Passed
70-210 - Passed
70-290 - Passed
70-291 - Passed
70-293 - Working towards

 

[paulhthomas]

ah ha!
Good old Panda found the following, amongst the cookies!

Spyware:Spyware/New.net
Adware:Adware/WebHancer
Adware:Adware/WinAD

Will now look at ways of removing the stuff!
I can't believe how many other products didn't pick this up!

Thanks again!

Paul Thomas
Network+ - Passed
70-210 - Passed
70-290 - Passed
70-291 - Passed
70-293 - Working towards

 

[paulhthomas]

well, after a closer look, all these entries in the panda scan's log, they all pointed to the same file!!
The file was in local settings on an old profile, so I didn't think this would have actually been the problem. I've deleted the old profile, and also followed removal instructions off the symantec site on how to remove the 3 variants it said were found. None of the reg keys/directories mentioned in the removal instructions were there, so unfortunately, back to square 1.

I'll run a Trend Micro scan and see what that finds...

Paul Thomas
Network+ - Passed
70-210 - Passed
70-290 - Passed
70-291 - Passed
70-293 - Working towards

 

[smah]

I assume this is happening with IE. Have you tried any other browsers? - you can even try windows explorer/ my computer by typing an incorrect

http://www address

into the address bar.

Also, have you made any modifications or customizations to the IE search assistant or the Internet Options, Advanced, Search settings?

 

[paulhthomas]

hmmm, it doesn't seem to happen if I mistype a url, eg erveerve.com from explorer but it does if I type

http://erveerve.com.

Yes I'm using IE, I haven't got any other browser installed as yet so will get firefox on here and let you know the outcome.
It's a clean install of IE7 beta, but I was having the problems when I was on IE6 so that's not the problem. No modification to or customization. no toolbars installed etc

Thanks for the post!

Paul Thomas
Network+ - Passed
70-210 - Passed
70-290 - Passed
70-291 - Passed
70-293 - Working towards

 

[bcastner]

Check your HOSTS file:

http://www.mvps.org/winhelp2002/hostsfaq.htm

 

[paulhthomas]

I was going to say that my hosts and lmhosts are fine, checked them earlier today. Also, just downloaded firefox, tried an incorrect url and got the same problem!

The rend micro search is taking an eternity for some reason, the panda one ran ok. will try in work tomorrow with a better connection perhaps.

any other ideas?

thanks for all your suggestions guys

Paul Thomas
Network+ - Passed
70-210 - Passed
70-290 - Passed
70-291 - Passed
70-293 - Working towards

 

[smah]

Could your ISP be causing this?

 

[bcastner]

Internet Options, Content, AutoComplete
clear the entries for all the forms.

 

[bcastner]

Also, check the search entries in the registry. Mine is set to Google:

Go to Start/Run/Regedit

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
"Search Page"="

http://www.google.com"

"Search Bar"="

http://www.google.com/ie"

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL
""="

http://www.google.com/keyword/%s"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
"SearchAssistant"="

http://www.google.com/ie"

 

[paulhthomas]

Hi, I have cleared the forms out as bcastner has suggested. Won't be able to see if it's the solution until tonight when I get home.

I have also checked the reg keys above; my Search Page is set to msn, that's ok.
I don't seem to have a "Search Bar" (but that may be ebcause I haven't got any additional toolbars instealled??), and I don't have the searchURL either.
Search Assistant is also set to use msn.
Either way these are keys for IE, and it's doing the same with a new install of firefox!!

As for the ISP.... maybe, I suppose it's possible. Although I have got other pc's at home that I use the with the same adsl connection and they don't have the problem as far as I've seen.

Thanks again, any more suggestions?

Dazed and Confused.

Paul Thomas
Network+ - Passed
70-210 - Passed
70-290 - Passed
70-291 - Passed
70-293 - Working towards

 

[paulhthomas]

well, clearing the forms hasn't worked.
has anyone else got any ideas? it's an odd one eh!

Paul Thomas
Network+ - Passed
70-210 - Passed
70-290 - Passed
70-291 - Passed
70-293 - Working towards

 

[bcastner]

See again faq608-4650 and download Ewido.
Bring the definitions up to date and let it scan.

 

[paulhthomas]

i again, thanks for the post.
I've downloaded Ewido, let it scan and all it found were cookies.
I've cleared these, but naturally the problem still exists

Paul Thomas
Network+ - Passed
70-210 - Passed
70-290 - Passed
70-291 - Passed
70-293 - Working towards

 

[tlcscousin]

You dont by any chance have a DNS setting set statically?
When at home do you hook up using a router?
If so maybe find out what DNS servers you use at work and if they are the ones from the ISP try setting them statically.

 

[bcastner]

In Internet Options, add the site to your Restricted Sites list.

 

[tlcscousin]

http://noahdfear.geekstogo.com/

They have a download for a utility called smitrem which you might want to run. lots of people being redirected to that site and it points to a spyware infection that might be removed by the smit rem tool.

 

[bcastner]

It does not sound like the smitfraud trojan, but they have an awful lot of sites:

http://www.castlecops.com/article-6430-nested-0-0.html