Web Browser Opens Up Random Sites?

Orpheous · 20 Jan 2010

Frostmourne said:

Back in your first combo fix log, the url's pointed to hxxp - I'd reinstall 7, clean format.

Missed that completely as I was only checking th HJT file....

hxxp according to Wiki
uStart Page = hxxp://www.google.co.uk/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office14\EXCEL.EXE/3000
LSP: c:\progra~1\SPEEDB~1\sblsp.dll
TCP: {BB929842-C69D-49F1-BCF1-183BECE4CD17} = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\Brijesh Patel\AppData\Roaming\Mozilla\Firefox\Profiles\5xaz82fm.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://www.google.co.uk/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

Jacee · 20 Jan 2010

The hxxp:// is a 'munged' URL, in case it's malicious. That way, people looking at a CF log won't accidently click on a working link to malware.
In this case, it's by design and it's a safe URL

bp96 · 20 Jan 2010

Here's GooredFix Log I did in Safe Mode as it kept on freezing on 'General Malware' in Normal Mode

Code:

 GooredFix by jpshortstuff (08.01.10.1)
Log created at 15:54 on 20/01/2010 (Brijesh Patel)
Firefox version 3.5.6 (en-US)

========== GooredScan ==========


========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [17:10 24/10/2009]
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [17:45 24/10/2009]
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [10:51 18/01/2010]

C:\Users\Brijesh Patel\Application Data\Mozilla\Firefox\Profiles\5xaz82fm.default\extensions\
foxmarks@kei.com [13:20 05/12/2009]
SkipScreen@SkipScreen [18:52 15/12/2009]
yetanothersmoothscrolling@kataho [11:39 19/01/2010]
{73a6fe31-595d-460b-a920-fcc0f8843232} [08:46 18/01/2010]
{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [08:08 19/12/2009]
{c36177c0-224a-11da-8cd6-0800200c9a91} [14:23 06/12/2009]
{cf47767d-5f3a-4e32-9fce-5d79565c9702} [19:17 15/01/2010]
{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [16:18 08/01/2010]
{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [07:05 25/10/2009]
{DDC359D1-844A-42a7-9AA1-88A850A938A8} [16:14 12/01/2010]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
(none)

-=E.O.F=-

jav · 20 Jan 2010

Frostmourne said:

Back in your first combo fix log, the url's pointed to hxxp - I'd reinstall 7, clean format.

wait, what do you mean?
all hxxp I can find point to the legit and safe site (google)
except one which points to google search results

EDIT: ohh, haven't seen Orpheous and Jacee's replies

bp96 · 20 Jan 2010

Doesn't anyone know how to fix this?

Carolyn · 20 Jan 2010

Hi bp96,

I recommend that you post for assistance at one of the malware removal forums

Security Cadets
MalWare Removal
Spyware Warrior

jav · 20 Jan 2010

ok, try these.
1. Download Ccleaner CCleaner - Home
and clean up your temp files and browser cache.

2. Press Start.
Write cmd
right click, run as admin
write Ipconfig /flushdns

3. Download http://www.funkytoad.com/download/HostsXpert.zip
Unzip it
Click Restore Microsoft's Host files

4. Press Start
write clean
Enter Disk Cleanup
Tick Temporary files, Temporary Internet Files, Offline webpages
And delete them

5. Try disabling all extensions on your browser.

6. Try reverting back to your own ISP dns server

Vino Rosso · 20 Jan 2010

bp96 said:

Doesn't anyone know how to fix this?

Suggest you wait for Jacee's reply.

jav said:

3. Download http://www.funkytoad.com/download/HostsXpert.zip
Unzip it
Click Restore Microsoft's Host files

Already done by running a previous tool.

Carolyn · 21 Jan 2010

Vino Rosso said:

bp96 said:

Doesn't anyone know how to fix this?

Suggest you wait for Jacee's reply.

Oops, sorry Jacee

I suggest you follow Vino's suggestion :)

Jacee · 21 Jan 2010

There is nothing suspicious in the log.

Clear Firefox's cache:
Tools, options, Advanced, Network, Offline Storage <--cache, click 'clear now'.

In case one of your add-on's isn't working properly, you can check it in 'safe mode':
Safe Mode