Expert: Brian Benosky - 1/4/2009

Question
Here is the problem.  Using either Firefox or IE and going to home page for google (or yahoo - haven't tried others) when search term is put in the search window and hit ENTER the results of the search are a correct heading but the URL that it sends you to is some marketing page.   For example,  google page is up.  The word "dogs" and the first search result sends you to this site:  www.deal-land.com  whereas the correct search result is:  www.nextdaypets.com/ HOWEVER, the dialog associated with the fake search is the same as the right one.  So what is happening is the search is hijacked and redirected to some adware or marketing sites.  

I have tried several adware and spyware such as spybot, STOPzilla, etc. and they have not found it.

My Flock and Netscape browsers search correctly with all search engines that I have tried; it is just when using Firefox and IE.  When I go into aol.com and use the search in their site it gives the correct urls. When I go into yahoo.com and use their search it gives the wrong results.

Finally, in all cases if I use advanced search it always gives the correct listings/results.

Hope you have a suggestion.  

Answer
Hi ZZ

Let's try running a Malwarebytes scan, preferably in Safe Mode.  Please download Malwarebytes' Anti-Malware to your desktop from here:

http://www.besttechie.net/tools/mbam-setup.exe

Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to
o Update Malwarebytes' Anti-Malware
* then click Finish.
* If an update is found, it will download and install the latest version.  Do not run a scan yet.

Restart the computer in Safe Mode by continuously tapping the F8 key on boot until a black screen with a menu appears.  Choose to Start Windows in Safe Mode.  Log on as usual.  Open Malwarebytes and run a Full Scan.

* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.  Save that log and reboot normally.

After rebooting, please download HijackThis to your desktop from here:
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
Make sure you close EVERY open window and ALL browser windows. The only thing that should be open is the HijackThis program.
Double-click on the file you just downloaded.
Click on the "Install" button.
Upon install, HijackThis should open for you.
Should it not open, go to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe
Choose 'Do a system scan and save a log file'.
Copy the text file which opens in Notepad and paste it in your follow-up, along with the Malwarebytes log.
 * Do not fix any entries in HijackThis, as they may be harmless.

Brian