Using IE To View A Forum Website, Pages Being Replaced By Other Site

woodbine · 10 Jan 2015

I'm having strange things happening when using IE11 to view one particular forum website. I would appreciate a little advice.

The forum is this one -

DIY and Home Improvement Forum - DIYnot.com

I have been using this forum OK for years, but yesterday I kept getting pages on the forum replaced by websites for slimming pills, health foods, etc. Clicking on the forum's home or menu page is normally OK, but when I try to click on other pages on the site, most of the time - but not every time, the page I want appears for a split second then is replaced by some of the unwanted sites I mentioned.

The site is now virtually unuseable, as I keep back clicking, trying again, the page briefly loads but is instantly replaced by spam websites. It's also a bit random. Some times I can actually open and view a page and even make a post on a thread. Then I will be unable to open that page a few mins later.

I have Avira and Super Anti Spyware for my security. They are both up to date, and I have run scans but found nothing.

This is one of the pages that appears -

The Doctors_

This is another -

Special Report 2015: How to Lose at Least 21 lbs of Stomach Fat in Just 1 Month.

But this is the address that appears in the tool bar top left of my screen -

ttp://lemode-mgz.om/fd/gm-3609-3610/special-report.html?voluumdata=vid..00000000-bf3b-48d8-8000-000000000000__vpid..1cbee800-98ea-11e4-893e-d2b51fecb4b7__caid..d886a87d-8d81-463a-a4f6-0728daf2bf13__lid..6c948f9b-a12f-48f0-9784-deff789626fe__rt..R__oid1..a14ef0fd-04c9-491b-a066-adc53d3dfb20__oid2..e0532829-7906-42cf-9f6d-5348b15e2d24__var1..adwynne__var2..uk__var3..1__var4..728-90__var5..1420912716899__var6..http%3A%2F%2Fgoogleads%5C.%5Cg%5C.%5Cdoubleclick%5C.%5Cnet%2Fpagead%2 Fads%3Fclient%3Dca-pub-4488154060300839%26output%3Dhtml%26h%3D90%26slotname%3D7929345431%26adk%3D2297873532%26w%3D728%26lmt %3D1420912716%26region%3Dtest%26flash%3D16%5C.%5C0%5C.%5C0%26url%3Dhttp%3A%2F%2Fwww%5C.%5Cdiynot%5C. %5Ccom%2Fforums%2Fviewforum%5C.%5Cphp%3Ff%3D25%26dt%3D1420912716026%26bpp%3D11%26bdt%3D344%26shv%3Dr 20150106%26cbv%3Dr20141212%26saldr%3Dsa%26correlator%3D7698084732046%26frm%3D20%26ga%5C_%5Cvid%3D413 754250%5C.%5C1385481952%26ga%5C_%5Csid%3D1420910881%26ga%5C_%5Chid%3D1490778%26ga%5C_%5Cfc%3D1%26u%5 C_%5Ctz%3D0%26u%5C_%5Chis%3D28%26u%5C_%5Cjava%3D1%26u%5C_%5Ch%3D1024%26u%5C_%5Cw%3D1280%26u%5C_%5Cah %3D984%26u%5C_%5Caw%3D1280%26u%5C_%5Ccd%3D24%26u%5C_%5Cnplug%3D2%26u%5C_%5Cnmime%3D4%26dff%3Dtimes%2 0new%20roman%26dfs%3D13%26adx%3D264%26ady%3D132%26biw%3D1263%26bih%3D855%26eid%3D317150304%26oid%3D3 %26ref%3Dhttp%3A%2F%2Fwww%5C.%5Cdiynot%5C.%5Ccom%2Fdiy%2Fthreads%2Fparis%5C.%5C423224%2Fpage-7%26rx%3D0%26eae%3D0%26fc%3D8%26docm%3D11%26brdim%3D0%2C106%2C-8%2C-8%2C1280%2C%2C1296%2C1000%2C1280%2C855%26vis%3D1%26abl%3DCS%26ppjl%3Df%26fu%3D0%26bc%3D1%26ifi%3D1%2 6xpc%3D49mSkbHLob%26p%3Dhttp%3A%2F%2Fwww%5C.%5Cdiynot%5C.%5Ccom%26dtd%3D104&account=adwynne&campaign =uk&adgroup=1&banner=728-90&it=1420912716899&refurl=http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4488154060300839&output=html&h=90&slotname=7929345431&adk=2297873532&w=728&lmt=1420912716&region=tes t&flash=16.0.0&url=http://www.diynot.com/forums/viewforum.php?f=25&dt=1420912716026&bpp=11&bdt=344&shv=r20150106&cbv=r20141212&saldr=sa&correlator=7 698084732046&frm=20&ga_vid=413754250.1385481952&ga_sid=14

(Please note I have removed the 'h' from the beginning of the above detail to show what the full address is without it just appearing on here as a link)

Any help or advice would help as this is driving me nuts!!!

(Please make any advice straightforward as I'm far from being a computer expert)

ThrashZone · 10 Jan 2015

Hi and welcome to SevenForums,
The site seems fine to me,
Review Jacee’s instructions to run Adwcleaner here post #7,
Ignore the title of the thread,
https://www.sevenforums.com/system-security/316404-instant-savings-app.html
Screen shot of the download button to use for Adwcleaner
You can use these free tools to see if they find anything,
Manually Update them before running full scans,
Try not to use your computer while the scans are running, (one at a time of course).
See this tutorial on how to download and run Malwarebytes,
https://www.sevenforums.com/tutorials/338716-malwarebytes-anti-malware-free.html
Also use the Custom scan option not the Threat scan,

Please Do Not clean/ Delete or Remove Any detections before posting the scan results first before review especially Malwarebytes,
http://www.malwarebytes.org/products/malwarebytes_free
SAS is safe to remove anything it finds

http://www.superantispyware.com/?tag=SUPERANTISPYWARE
This one is the longest up to 4 hours, the others are only about 45 minutes,
http://www.microsoft.com/security/scanner/en-us/default.aspx

woodbine · 10 Jan 2015

Thanks for your quick reply. I will have a look through the info you have given me.

Please note - I forgot to mention that if I view the problem site via a proxy server, it works fine. Hope this info may help diagnose.

Thanks again.

woodbine · 10 Jan 2015

OK. I've downloaded and scanned with Adwcleaner.

The first thing that came up after the scan was a result asking me to uncheck anything I didn't want to remove. There was one item on the list that was checked called 'Partner Service'. I have no idea what this is. Should I remove/clean it?

This is a copy of the report -

# AdwCleaner v4.107 - Report created 10/01/2015 at 19:05:49
# Updated 07/01/2015 by Xplode
# Database : 2015-01-03.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Ian - IAN-PC
# Running from : C:\Users\Ian\Desktop\AdwCleaner.exe
# Option : Scan
***** [ Services ] *****
Service Found : Partner Service
***** [ Files / Folders ] *****
File Found : C:\Users\Public\Desktop\eBay.lnk
File Found : C:\Users\Public\Desktop\eBay.lnk
Folder Found : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Folder Found : C:\ProgramData\Partner
Folder Found : C:\Users\Ian\AppData\Roaming\dvdvideosoftiehelpers
Folder Found : C:\Users\Ian\AppData\Roaming\OpenCandy
***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ams1.ib.adnxs.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\fra1.ib.adnxs.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ib.adnxs.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\nym1.ib.adnxs.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\uk.ask.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\Ask.com - What's Your Question?
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Key Found : HKLM\SOFTWARE\Classes\AppID\{28A88B70-D874-4F73-BBBA-9B2B222FB7D6}
Key Found : HKLM\SOFTWARE\Classes\AppID\kt_bho_dll.dll
Key Found : HKLM\SOFTWARE\Classes\CLSID\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Key Found : HKLM\SOFTWARE\Classes\kt_bho.KettleBho
Key Found : HKLM\SOFTWARE\Classes\kt_bho.KettleBho.1
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{86676E13-D6D8-4652-9FCF-F2047F1FB000}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17496

*************************
AdwCleaner[R0].txt - [2505 octets] - [10/01/2015 19:05:49]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [2565 octets] ##########

ThrashZone · 11 Jan 2015

Hi and thanks Yes I would,
Looks as though you've picked up some pup's tag alongs from other downloads from trash download sites,
What were the scan results from the other scanners ?
Cheers.

Owe after removing those items fully reset your browser/ s.

woodbine · 11 Jan 2015

Hi ThrashZone.

OK, I will try removing the 'partner service' that Adwcleaner found.

Before I do this, could you explain how I need to reset my browser (I only use IE), as I'm not sure what you mean by resetting.

Also, I used to have both free Superantispyware and free Malwarebytes on my old pc with AVG security. Then I had problems with AVG, so when I got my new PC I changed to Avira (premium paid for). Then I learned from somewhere/someone? that Malwarebytes isn't compatible with and Avira - I think. Can't remember exactly the reason, so I ditched Malware. and just have Avira and free SAS on my pc. Was this wrong? Is free Malw. and Avira compatible on a Windows 7 pc? I only ask this because of your suggestion to download and scan with Malwarebytes.

Many thanks

woodbine · 12 Jan 2015

BUMP

Hi. Does ThrashZone (or anyone) know how I should reset my browser after I remove the items with Adwcleaner? I need to remove the items to hopefully sort out my problem, but will wait until I know how to reset browser.

ThrashZone · 12 Jan 2015

Malwarebytes free is okay to have with just about any antivirus program so what you were told about a clash is totally false
Yes please re-install it

Export Favorites to html file before resetting Internet explorer/ just to be safe.
Internet Explorer - Import and Export Favorites

Tutorial of Resetting Internet explorer,
Internet Explorer - Reset
Accessing Internet Options from the Start menu search,
Reset process first opening Internet explorer
Manage add-ons this works for all version of ie,
Manage add-ons for Internet Explorer - Windows Help

woodbine · 12 Jan 2015

Thanks for your reply. Had a quick look through the reset links, etc - shouldn't be too difficult.

Just two (final) questions;

When I do step 5 on here - Internet Explorer - Reset do I need to delete personal settings as well?

On my 'Manage Add-Ons' list (tool bars and extensions), I have 5 add-ons - one of which is disabled. After the reset, how will this list appear? Will the 5 add-ons still be on the list, or will the list be blank? Presuming the 5 add-ons are still listed, will they all be disabled and it's up to me to enable the 4 that were enabled before the reset?

Hope this makes sense and thanks for your patience.

ThrashZone · 12 Jan 2015

Hi,
I would delete personal settings but you do need to Export your Favorites first to a html file first so they are not lost,
Yes existing add-ons should still be there but simply Disabled,
Cheers.