Google defaulting to 'dodgy' websites!

[BackofJeanette]

Had this problem before with Google Chrome, so I changed it back to BT Yahoo.

now my son has changed it back to normal Google, but when I start searching, say Bluemoon, it gives me a website for 'Slags looking for c**k!
This is obviously done to by son as my browsing is done in private.
Well it was my wifes birthday last week and I didn't want her to see what I had bought her, honest!

It's gonna be something really simple but if she goes online and sees those ads, well it won't be goody 2 shoes thats been looking, It'll be me.

Any ideas techies?

 

[Carver]

Delete browsing history, edit favourites so that the offending websites are not in it.

In Internet explorer it's under safety, don't know about the other browsers.

 

[TCIB]

It's called a browser hijacker.

Run some virus removal tools with said browser closed.

 

[BackofJeanette]

Just running AVG now.

Just opened browser while scan starting and noticed its changing to different sites as its loading.
Using phone to check BM.

Click track seems to come up a bit!

Thanks anyway , I'll keep you informed!

 

[eyejay51]

I'd also give Malwarebytes a run .... link to the free version here, but it does the job

<a class="postlink" href="http://www.malwarebytes.org/products/malwarebytes_free/" onclick="window.open(this.href);return false;">http://www.malwarebytes.org/products/malwarebytes_free/</a>

 

[BackofJeanette]

Been running Avg all morning and still getting
Trojan horse patched_c.LYT

Also keep getting Trojan horse Generic28.auqh.

Ran malware bytes and that has picked up 5 different virus's.

???

 

[TCIB]

Check pm bud :)

<a class="postlink" href="http://www.bleepingcomputer.com/download/combofix/" onclick="window.open(this.href);return false;">http://www.bleepingcomputer.com/download/combofix/</a>

Run this tool also.

 

[blueinsa]

Check pm bud :)

<a class="postlink" href="http://www.bleepingcomputer.com/download/combofix/" onclick="window.open(this.href);return false;">http://www.bleepingcomputer.com/download/combofix/</a>

Run this tool also.

Had the same issue with a box on start up claiming an issue with shutrf.dll?

Ran this and it deleted said file and 3 other .dll files that i take were malware.

Pissed off as my laptop is fire-walled and I run isolo system mechanics as well.

Thanks for your help mate.

 

[dazdon]

Is it always best to run these programs in safe mode?

 

[BackofJeanette]

BackofJeanette wrote:
The story so far;

Loaded combo fix as bluesort.exe

Tried to load 3-4 times but no joy

Loaded kaspersky virus control, found this, win32 zaccess,
Looked it up and it's a bad un'
Finally this morning after running overnight scan got 'bluesort' to run but had to go out!
It found this root kit. Zero access , tcp/iP stack is infected.
Told me to disable kaspersky , and reboot when scan finished.
Had to go out for 2 hours and came. BAck to blue screen, windows shut it down!
Rebooted in safe mode , did restore point, now trying to run combo fix again, taken 4 attempts but starting to scan now!


Ran it again, took awhile but eventually rebooted and said it was clean!.

Still have kaspersky on trial and that has a details not resolved window, which is showing this bug twice.
Now, if I get kaspersky to clean this bug will it reload it back into the system?
Or would I be better deleting kaspersky altogether and hope it takes the little bastard with it?

 

[TCIB]

Get nod32 antivirus.

Kaspersky being on will not help with combofix.

See how this scan goes.

 

[BackofJeanette]

So should I just delete kaspersky without running it to get rid of the virus it's contained?

From what I've read about this. First it lets kaspersky quarantine it and then clean it. But when you reboot it reloads itself!

I'm confused!!!

????

Or just delete kaspersky and install nod32.

 

[BackofJeanette]

Ok

Deleted Kaspersky after loading Nod32

Seems to have taken the bug with it!

Thank you Gentlemen!!