Virus of some sort?

[Onion]

Firstly, this is my mom's laptop, so I'm not sure what she's been doing with it. It does have Avast 6, so she couldn't have done all that much with it. My problem is, if I try to go to a known working site, like head-fi.org in this case (does it for many others though), it sometimes redirects me to a qbyrd or ask.com search for my url, and even if I do click one of the search results, it just refreshes the page. I've run avast scans and it shows clean results, and same for malware bytes. There are no symptoms aside from what I've mentioned. What could this be? How should I fix it?

[Alexandre]

What browser are you using? Have you tried different browsers?

 

If it happens across all browsers it might be that you have a trogan virsu on the computer.

 

Maybe try a different virus/bot checker like "Spybot search and destroy" to see if it picks up anything.

[Onion]

I'm not sure if it does it on other browsers, I only use firefox. It doesn't do it very often, so I couldn't be sure unless I use IE for at least 2 days. I'll give spybot a go and see what's up. Thanks.

[MercuryDoun]

Try booting in safe mode. THEN run the scans. Some virus's launch a program that runs in a background that hides the real virus from the scans.

[Nephilumos]

As earlier said, boot into safemode and attempt to run a virus scan. Once you've cleared out the viruses, check to make sure that your "hosts" file looks something like:

 

# Copyright © 1993-2009 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

 

# localhost name resolution is handled within DNS itself.

# 127.0.0.1 localhost

# ::1 localhost

 

 

The hosts file can be located in:

C:\Windows\System32\drivers\etc

 

Some viruses rewrite the hosts file to redirect you to desired other websites.

Edited March 18, 2011 by nitem4re

[Onion]

Ran a boot time scan, and checked my hosts file, and everything's clean. Anyone else have any suggestions?

[Black64]

I have seen this before. Are you going into the websites by clicking on the Google link? Try just copy and pasting the web site in to the address bar. It don't know if it is a virus but I think it may be a spyware. Try using CCleaner and super anti spyware.

[Onion]

It does it when I put the full web address into the url bar. I've run ccleaner many times, and I usually do it weekly. I'll give super anti spyware a try soon.

[jjjrmy]

Oh, I just had this virus. I downloaded something, when I go to my other computer with the program on it, I'll send you the link. It fixed it right up.

[Onion]

Ooh sweet. Thanks.

[jjjrmy]

Ooh sweet. Thanks.

 

http://support.kaspersky.com/viruses/solutions?qid=208280684

 

Try that, it's what I used.

[Onion]

No threats found, and it still does it. It constantly does it when I try to access my router by typing 192.168.1.9 in my address bar.