X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

I keep getting redirected to websites I don't want - it was nearly impossible to get here. Have four virus, malware, spyware &trojan horseprograms and all of them come up clean.

Posted

My tech guy says my Firefox has been hijacked - I couldn't even get to your website. When I google something, no matter what I click on, it goes somewhere else. It even happened when I went to click open an email - a new tab opened with this awful thing in it. Oh, and another thing: when it takes you to the bad website, you can't click on the back button to get back to wherever it was you were. You have to close the entire tab.

This happened

Every time Firefox opened

== it might be a coincedence, but it started when I installed AVG and the yahoo toolbar came with it. I disabled it, but maybe

Chosen solution

Your issue may be caused by Malware. You can run and update the following free anti virus software:

1. Malwarebytes (Free version) - http://www.malwarebytes.org

2. Spybot Search & Destroy - http://www.safer-networking.org

3.Spyware Terminator - http://www.spywareterminator.com (Not all programs detect the same infection)

In addition, there are a number of forums you can use to help get rid of your infection. These include:

Read this answer in context 4

Additional System Details

Installed Plug-ins

  • -Shockwave Flash 10.0 r45
  • 6.0.12.46
  • RealPlayer(tm) LiveConnect-Enabled Plug-In
  • RealJukebox Netscape Plugin
  • Plug-in for Web-Based Email
  • Coupons, Inc. Coupon Printer DLL
  • Coupons, Inc. Coupon Printer Plugin
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • Default Plug-in
  • Adobe PDF Plug-In For Firefox and Netscape "9.3.2"
  • 3.0.50106.0
  • Office Live Update v1.4
  • Google Updater pluginhttp://pack.google.com/
  • Java Plug-in 1.6.0_07 for Netscape Navigator (DLL Helper)

Application

  • User Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729)

More Information

I don't know what this means.

Shawn
  • Moderator
41 solutions 524 answers

Chosen Solution

Your issue may be caused by Malware. You can run and update the following free anti virus software:

1. Malwarebytes (Free version) - http://www.malwarebytes.org

2. Spybot Search & Destroy - http://www.safer-networking.org

3.Spyware Terminator - http://www.spywareterminator.com (Not all programs detect the same infection)

In addition, there are a number of forums you can use to help get rid of your infection. These include:

jimcou 0 solutions 12 answers

Before you try the other complicated solutions, this worked for me today. I figured it out after I tried "Hitman Pros" and some other stuff ffrom Kapersky, etc. I narrowed it down to my Firefox extensions. I "disabled" Xulrunner 1.9.1 and the redirecting went away. If you don't have Xulrunner 1.9.1 installed then you'll have to try those other solutions. My solution is very quick and easy - worth a try.

jimcou 0 solutions 12 answers

In my case, the key to eliminating the XUL Runner 1.9.1 was in finding the registry entry:

HKEY_USERS\S-1-5-21-4084633196-3991238857-972333920-1000/software/mozilla/firefox/chrome. The “chrome” folder contained two files and a sub-folder named “content”. The Chrome folder contained the files “chrome manifest” and “install.rdf”. The content sub-folder contained the files “cfg.js” and “overlay.rdf”.

I found this path thanks to another poster here who tipped me off to the fact that the problem might be being caused by a Firefox extension. Then I was able to stop the problem by selectively disabling my extensions one by one till I found the one causing the redirections. I still wanted to uninstall the extension.

Finding the registry path was strictly hit-or-miss because I didn’t know the name of the files I was looking for. If someone else comes up with this problem, I’d suggest searching the registry for “cfg.js” and/or “overlay.rdf”. This should reveal the registry entry and enable them to eliminate it. Before I deleted the registry key, I took the precaution of saving the files and registry entries in a newly created file in My Documents in case whoever wrote this crap found a way to disable my computer if they were missing from the location where he stuck them.

viruskiller 0 solutions 1 answers

The ComboFix.exe from this link below worked and got rid of my nasty Google Redirect Virus!

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

edwardjclark 0 solutions 1 answers

Helpful Reply

Beginning a few weeks ago, my Firefox browser (the latest non-beta at that time) began redirecting when clicking on returned Google hits, instead of the websites listed in those return hits, usually to those standard "search" websites that are nothing more than a registered domain name site with links similar to what my Google search terms return hits were.

    I used MalwareBytes, and several other spyware/scumware remover programs and was unable to fix the problem.  I removed that version of Firefox and installed the beta 4 Firefox.  Same results, redirections.
    After reading various remarks on this forum, I remembered having had similar redirection problems in the past, so I went and found a quick fix for the redirection (in this case, at least).
    Go to 'tools', 'options', then click on the top right of the options window (the name of the window is listed on the top 'blue' bar across the top), the next-to-last icon to the right that reads, 'advanced'.  THEN, below that 8-icon row, there is a four-tab row.  Choose 'network'.  Then you can look to the first line below that that reads 'connection' (configure how Firefox connects to the internet), and to the right, you'll see the 'settings' button.
    Click on the 'settings' button and you SHOULD see (if Firefox has not been altered by some spyware/malware/scumware program) the first circle with a dot in it, that reads 'no proxy'.  MY Firefox had been changed to have the third entry down, 'use system proxy settings'.
   I assume that somewhere in my registry my proxy settings have been changed for Firefox.  My system settings globally have not been changed, I'm thinking, because no other browser has this problem (I use IE8, Opera, Safari, Flock, etc.).  
   I changed the selection to 'no proxy' and checked to see if that fixed my problem.  It did.  I changed it back and forth several times (toggling in essence) from 'system settings' to 'no proxy' and that seems to fix the problem.
   As my computer clients like to say,  "it's ok, FOR NOW" LOL
   If my curiosity overcomes me and I can cordon off the time, I will hunt that sucker down and discover what/who the real culprit is, but for now, this works and is quicker.  A lot of times, workarounds are acceptable, though they irritate my perfectionistic self. ;)
    If anyone else tries this and it works for them, please post a reply to that effect, ok?

Namaste. Ed Dr. Neutron Computer Service Nashville, TN USA

mike2469 0 solutions 1 answers

Your problem could be that you are running to many different anti virus and malware programs. This is confusing your machine and not allowing any of the programs to function properly. You should try dumping all of them and just stick to one anti virus and malware/spyware program. In order to get a good program you will have to buy it. Free ones are garbage and completely worthless. Not even worth your time spent downloading them.

SamGunsch 0 solutions 1 answers

Your instructions seemd to have worked...mostly. I found the 3rd row had the dot. Put the dot back into No Proxy. So far 7-8 searches...only one redirect. Much quicker loading of the new location totally newbie I am. thank you for the precise instructions. computer melted. got new computer with Windows 7 both Firefox and Internet Explorer have this problem. malware got in I guess

zinda 0 solutions 1 answers

you are having the exact same problem as I am, don't even bother with those antivirus programs because the will not detect it! Malwarebytes doesn't Panda doesn't Kingsoft doesn't! I looked up the web page sources and found them to have only 1 common link between the multitude of useless search pages that I'm redirected to; "itcg." then followed by 5 random numbers then an underscore ( _) then 1 more random number a dot (.) then "information-seeking.com/jump1/?affiliate=itcg&subid=" then the same 5 random numbers underscore same single number then "&terms=" This example I just gave is from a page that has description: happili helps E-retailers capitalize on their exit traffic. Keywords: ecommerce, advertising. Content-Language: En-US. Coverage: Worldwide. Rating: General. Author: happili. This is typical of every site with the only thing binding them together being the "itcg" when I googled them as I suspected they were listed as a helper for E-retailers helper for capitalizing on their exit traffic! I searched my registry for any traces of this name or any of the random named sited that I've encountered but found nothing, so it's not on my computer, it's only affecting my clicks from a google search to another site "LINKS" if I copy the address and paste into browser directly I have no problem. It only happens when I click to open the site or open in a new window or tab. So it's not directly hijacking the browser per sey but redirecting the links if you pay attention to the address bar you will see the page you want is found and will start to go there but just before it appears (sometimes it will flash quickly) it will intercept the page and lead to a useless search engine like the web used to be loaded with some years back. This seems to be the same type of activity that was happening then but without the disguised links that mislead you to click on them. so maybe its google who's having the pages appear and all the links are listed correctly but all have the redirection pages tied to them through the title link and may not even be a browser problem. I also tried Highjack this and found nothing that I would consider an identifiable link to this problem, only 1 line of text was listed as unknown but not in any of the typical useful lines that would be hijacking info. I'm just letting you all know what I've looked into I have no real in depth knowledge in this field, just a long time web user who's had his share of problems and figured out almost every root source to them but this is a new 1 for me. Almost forgot "scour.com" is the other 1 that turns up alot but it is also bound by the "itcg". here's another one to try "http://www.w3.org/1999/xhtml" paste that into your search and then click on any link that would take you to one of it's direct link's to that address, then try one that is just telling you about that address like wiki or any info type link and you'll find that direct links will goto that page without redirection but info links will be redirected to another page from "itcg"!

natmark 0 solutions 1 answers

I second that solution. It found the following Registry Key infected :

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Value: ForceClassicControlPanel -> Quarantined and deleted successfully.

Running an up-to-date version of Malwarebyte's Anti-Malware solved the problem.

girlcousin 0 solutions 1 answers

Hey--followed your advice. Will try to get back to you as to how it worked. I was ready to go get the fire ax and WHAM WHAM WHAM, if you know what I mean!

PlankyInternet 0 solutions 1 answers

Helpful Reply

Try this (it worked): in the address-bar type in "about:config" - this will result in a special warning page - click through this warning.

Now in the 'filter:' box type in "search" and a number of items are listed and I changed "browser.search.suggest.enabled" keyword to "false" - since then no problem!

fireblight 0 solutions 2 answers

To edwardjclark: Thank you so much. Your suggestions worked great! Just one thing to add. After: I changed the proxy settings back to No Proxy, I had to exit Firefox and then restart it for them to take effect.

Fireblight

Modified by fireblight