Browser automatically redirecting to an unknown URL from Google search

aspwin7 said:

Hi,

For the past 2 weeks or so, all Google search results from my computer are getting automatically redirected to this unknown URL: http://www.nohginrotgea.com/ and then to http://www.clicks123.com (something similar to that). If I hit the back button and again click on the particular Google result, it will repeat the process. On hitting the back button and the result for a third time, everything becomes normal and the browser goes to the proper website.

Google does not provide any info on this. Neither has it been mentioned anywhere in this forum. Can you please help? I'm pasting the relevant link when I tried searching for 'advantage of write back over write through':

http://www.nohginrotgea.com/search.php?q=advantage%2Bof%2Bwrite%2Bback%2Bover%2Bwrite%2Bthrough&n=1301057908

Thanks.

Edit: This occurs with all the browsers on my computer:
Google Chrome, IE 9, Firefox 3.6.15, Flock 2.6.2

Hi and welcome to SF! :)
I think it's time to download, install, update a run a full scan with http://www.malwarebytes.org/mbam.php
Let us know the results!

It is a classic browser hijack. It can happen to the best of us. But as Wallonn7 said try running Malwarebytes, but I have to add one thing I would suggest running it in safemode. Just in case they hijack has effected system files.

mckillwashere said:

It is a classic browser hijack. It can happen to the best of us. But as Wallonn7 said try running Malwarebytes, but I have to add one thing I would suggest running it in safemode. Just in case they hijack has effected system files.

Thanks for adding!

Flush the bad DNS cache and restore MS's Hosts files
Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop. Right click to run as Administrator. Your computer will reboot itself.

Next, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Now, rescan with Malwarebytes'.

* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. Copy and Paste that log into your next reply.

Jacee said:

Flush the bad DNS cache and restore MS's Hosts files
Copy and paste these lines in Note pad.

Hi,
Thanks for the reply. Please guide me through further steps.

Here is what I did:

1) To flush DNS: Opened command prompt with admin privileges and ran ipconfig /flushdns
2) Restored hosts file in system32 and SysWow64 with this code from MS website:

Code:

 
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host
# localhost name resolution is handle within DNS itself.
#       127.0.0.1       localhost
#       ::1             localhost

3) Ran flush.bat as admin. System restarted.
4) Downloaded TFC, ran as admin and restarted the system.
5) Performed a quick scan using MalwareBytes.

Here is the log file:

Code:

 
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6169
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
27-03-2011 1:26:19 AM
mbam-log-2011-03-27 (01-26-19).txt
Scan type: Quick scan
Objects scanned: 183590
Time elapsed: 4 minute(s), 21 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Edit: I cannot see the hosts file in system32 folder even though 'Show hidden files' is selected.