link getting redirected ? virus ?

[prince76]

guys , iam facing this problem please help me out wenever i click on any link , like website, blog link , it redirects me to another page , something like "95p.com " or activityclickshield.com" , or mediashifting.com . . so what i have to do is everytime i have to copy the link and den paste it on the adress bar , and its works fine , so iam really fudged up coz i have to do dat everytime to get to the desired page , can u tell me what the problem is ? is dis a virus ? i scanned my pc twice nothing found

[AceInfinity]

Where are you finding these links? I was going to suggest that you check your HOSTS file until I saw this:

so what i have to do is everytime i have to copy the link and den paste it on the adress bar , and its works fine

It's probably just the site you go to. What links are you trying to get on? And WHAT sites are you clicking the links for to get to that page you want to get to?

[prince76]

Where are you finding these links? I was going to suggest that you check your HOSTS file until I saw this:

It's probably just the site you go to. What links are you trying to get on? And WHAT sites are you clicking the links for to get to that page you want to get to?

bro for each single link , its getting redirected , even if i wanna go to supportforums.net , so if i google it , and den i click on the link it redirects me to another page , , so what i have to do is everytime i have to copy paste the link and put it in the address bar to go to the right place , for every single website iam facing this problem bro

[AceInfinity]

So links from google open random pages? It could be a virus then. But before we assume that...

1) Go to your start menu, type in "Run" (without quotes), hit enter
2) In the Run command type in "%SystemRoot%\System32\drivers\etc" (without quotes)
3) Look for the file named "hosts" and open it in notepad, (you can open notepad first and drag this file over the notepad editor to open it)
4) Copy everything, paste it in your next reply.

[prince76]

So links from google open random pages? It could be a virus then. But before we assume that...

1) Go to your start menu, type in "Run" (without quotes), hit enter
2) In the Run command type in "%SystemRoot%\System32\drivers\etc" (without quotes)
3) Look for the file named "hosts" and open it in notepad, (you can open notepad first and drag this file over the notepad editor to open it)
4) Copy everything, paste it in your next reply.

its like iam opening trusted websites still it is redirecting me , its not dat iam opening any phishing link or somethin , for each and every website iam having diz bro 4 files appeared wen i did dat stuff on run command , i found lmhosts , here is a text file contains dat ..


# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to computernames
# (NetBIOS) names. Each entry should be kept on an individual line.
# The IP address should be placed in the first column followed by the
# corresponding computername. The address and the computername
# should be separated by at least one space or tab. The "#" character
# is generally used to denote the start of a comment (see the exceptions
# below).
#
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# files and offers the following extensions:
#
# #PRE
# #DOM:<domain>
# #INCLUDE <filename>
# #BEGIN_ALTERNATE
# #END_ALTERNATE
# \0xnn (non-printing character support)
#
# Following any entry in the file with the characters "#PRE" will cause
# the entry to be preloaded into the name cache. By default, entries are
# not preloaded, but are parsed only after dynamic name resolution fails.
#
# Following an entry with the "#DOM:<domain>" tag will associate the
# entry with the domain specified by <domain>. This affects how the
# browser and logon services behave in TCP/IP environments. To preload
# the host name associated with #DOM entry, it is necessary to also add a
# #PRE to the line. The <domain> is always preloaded although it will not
# be shown when the name cache is viewed.
#
# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
# software to seek the specified <filename> and parse it as if it were
# local. <filename> is generally a UNC-based name, allowing a
# centralized lmhosts file to be maintained on a server.
# It is ALWAYS necessary to provide a mapping for the IP address of the
# server prior to the #INCLUDE. This mapping must use the #PRE directive.
# In addtion the share "public" in the example below must be in the
# LanManServer list of "NullSessionShares" in order for client machines to
# be able to read the lmhosts file successfully. This key is under
# \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
# in the registry. Simply add "public" to the list found there.
#
# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
# statements to be grouped together. Any single successful include
# will cause the group to succeed.
#
# Finally, non-printing characters can be embedded in mappings by
# first surrounding the NetBIOS name in quotations, then using the
# \0xnn notation to specify a hex value for a non-printing character.
#
# The following example illustrates all of these extensions:
#
# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC
# 102.54.94.102 "appname \0x14" #special app server
# 102.54.94.123 popular #PRE #source server
# 102.54.94.117 localsrv #PRE #needed for the include
#
# #BEGIN_ALTERNATE
# #INCLUDE \\localsrv\public\lmhosts
# #INCLUDE \\rhino\public\lmhosts
# #END_ALTERNATE
#
# In the above example, the "appname" server contains a special
# character in its name, the "popular" and "localsrv" server names are
# preloaded, and the "rhino" server name is specified so it can be used
# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
# system is unavailable.
#
# Note that the whole file is parsed including comments on each lookup,
# so keeping the number of comments to a minimum will improve performance.
# Therefore it is not advisable to simply add lmhosts file entries onto the
# end of this file.

---

So links from google open random pages? It could be a virus then. But before we assume that...

1) Go to your start menu, type in "Run" (without quotes), hit enter
2) In the Run command type in "%SystemRoot%\System32\drivers\etc" (without quotes)
3) Look for the file named "hosts" and open it in notepad, (you can open notepad first and drag this file over the notepad editor to open it)
4) Copy everything, paste it in your next reply.

nd yeah for eg i googled " facebook" ok now results are "www.facebook.com " and "en.wikipedia.org/wiki/Facebook" and some more , now wen i clicked on facebook.com it redirected me to this page "http://hooot.com/?search=facebook&subid=37&key=1168d879ec52bb39b0b9"

[AceInfinity]

You're probably got a virus... I'm about %95 sure that you've got a virus. There's nothing in your HOSTS file.

Download MalwareBytes: http://www.malwarebytes.org/

Run a scan, post a results and let us know if it returned anything bad. I wouldn't be surprised though, you should be cautious about what you allow into your computer.

[King]

I have the exact same thing on my other computer. Too lazy to fix it. I scanned with MBAM and it didn't fix the issue and I cannot be bothered going through the full malware removal process. What you can do is when you Google something, put your cursor to the right of the result and it'll show a preview of the page and it'll also have a link to a 'Cached' version. Clicking on the cached version works also and you can then click on the direct link to the site through Google's cache. It's just a pain in the ass.

Let us know how that scan goes.

[prince76]

I have the exact same thing on my other computer. Too lazy to fix it. I scanned with MBAM and it didn't fix the issue and I cannot be bothered going through the full malware removal process. What you can do is when you Google something, put your cursor to the right of the result and it'll show a preview of the page and it'll also have a link to a 'Cached' version. Clicking on the cached version works also and you can then click on the direct link to the site through Google's cache. It's just a pain in the ass.

Let us know how that scan goes.

yeah its really a pain in the ass wel i clicked on the cached version bro same thing happened , it redirected me to another page

---

You're probably got a virus... I'm about %95 sure that you've got a virus. There's nothing in your HOSTS file.

Download MalwareBytes: http://www.malwarebytes.org/

Run a scan, post a results and let us know if it returned anything bad. I wouldn't be surprised though, you should be cautious about what you allow into your computer.

bro i scanned my pc and removed all the infected malwares , but there is no change , stil iam getting redirected to another link

[prince76]

y no 1 is replying please help me if someone can

[AceInfinity]

Alright, i'll provide you with some steps.

Open notepad, and type this in:

Code:

tasklist > out_log.txt

Save as .bat, and run this file. Then provide me with the out_log.txt file contents that get produced.