The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    Pricegrabber redirect.

    Discussion in 'Security and Anti-Virus Software' started by Ayle, Apr 13, 2010.

  1. Ayle

    Ayle Trailblazer

    Reputations:
    877
    Messages:
    3,707
    Likes Received:
    7
    Trophy Points:
    106
    Hello guys. My problem is summed up in the title. I'm completely unable to access any of Google website, including gmail. If I try to access Gmail, Firefox and Chrome throw a certificate red flag, and if I try to go on google I'm redirected to pricegrabber.com. Avira is running and up to date. The UAC is also active. Analyzing my hijackthis log, didn't turn up anything either and my host file is clean... My vista desktop had the same problem and I switched it to Ubuntu and it seems to be working, but it appears that my laptop has been hit too. I have a shared folder but it's read only so I don't know it it's a virus or someone is messing with my router...
     
    Ayle, Apr 13, 2010
    #1
  2. MrDJ

    MrDJ Notebook Nobel Laureate

    Reputations:
    2,594
    Messages:
    10,832
    Likes Received:
    363
    Trophy Points:
    501
    MrDJ, Apr 13, 2010
    #2
  3. Deks

    Deks Notebook Prophet

    Reputations:
    1,272
    Messages:
    5,201
    Likes Received:
    2,073
    Trophy Points:
    331
    Instead of Spybot, use Malwarebytes and SuperAntiSpyware.
    Update both and scan the system.
     
    Deks, Apr 14, 2010
    #3
  4. yuyi64

    yuyi64 Notebook Consultant

    Reputations:
    38
    Messages:
    260
    Likes Received:
    0
    Trophy Points:
    30
    I second this suggestion. The only thing Spybot ever found on any of my computers were cookies.
     
    yuyi64, Apr 14, 2010
    #4
  5. Deks

    Deks Notebook Prophet

    Reputations:
    1,272
    Messages:
    5,201
    Likes Received:
    2,073
    Trophy Points:
    331
    Spybot was good several years ago.
    But Malwarebytes and SuperAntiSpyware bested it.

    Generally speaking, Malwarebytes is more than enough ... though having SAS is also recommended as a backup option in situations when you pick up a serious nasty infection that refuses to go.
     
    Deks, Apr 14, 2010
    #5
  6. Ayle

    Ayle Trailblazer

    Reputations:
    877
    Messages:
    3,707
    Likes Received:
    7
    Trophy Points:
    106
    Will try both.
     
    Ayle, Apr 14, 2010
    #6
  7. gerryf19

    gerryf19 I am the walrus

    Reputations:
    2,275
    Messages:
    3,990
    Likes Received:
    0
    Trophy Points:
    105
    ...and my guess is you have a root kit, which both programs have difficulty finding.

    if they come up empty, try gmer or rootkitrevealer
     
    gerryf19, Apr 14, 2010
    #7
  8. Baserk

    Baserk Notebook user

    Reputations:
    2,503
    Messages:
    1,794
    Likes Received:
    1
    Trophy Points:
    56
    Give HitmanPro also a try.
    They really try to keep up with the TDL3/TDSS/Alureon rootkit versions.
    It will only take a couple of minutes for a scan.
     
    Baserk, Apr 15, 2010
    #8
  9. StormEffect

    StormEffect Lazer. *pew pew*

    Reputations:
    613
    Messages:
    2,278
    Likes Received:
    0
    Trophy Points:
    55
    It's possible that a piece of malware has rewritten the DNS servers in your router, especially if you are seeing this behavior on more than one computer.

    The first step is to make sure your system is clean by running a full MalwareBytes Free scan, followed by a full Avira scan. These scans should be run after the scanners have been fully updates, and the computers should be taken off the network while scanning.

    When both computers are confirmed clear, it's time to do a hard reset of your router. Use a pen or something and hold in the little reset nub on the back of the router for like 10 seconds while it is plugged in.

    When resetting up your network MAKE SURE TO SET AN ADMIN PASSWORD that is at least 9 RANDOM numbers and letters.

    That's really the key to knowing if this is a virus or not, did you set a secure password on your router? Otherwise, the issue is really your router giving you a bad DNS server.
     
    StormEffect, Apr 19, 2010
    #9
  10. gerryf19

    gerryf19 I am the walrus

    Reputations:
    2,275
    Messages:
    3,990
    Likes Received:
    0
    Trophy Points:
    105
    if it was his router (I cannot say I have ever seen malware rewrite router configuration), his ubuntu box would also be redirected.

    Has to be a windows trojan/rootkit hitting all of his computers.
     
    gerryf19, Apr 19, 2010
    #10
  11. lbohn

    lbohn Notebook Consultant

    Reputations:
    320
    Messages:
    235
    Likes Received:
    0
    Trophy Points:
    30
    http://blog.washingtonpost.com/securityfix/2008/06/malware_silently_alters_wirele_1.html

    I agree that this particular problem is unlikely to stem from an attack on the router especially since his Ubuntu box doesn't suffer the same redirection. Just wanted to point out a router attack is possible and has been in the wild, not just a proof-of-concept at a security conference.

    --L.
     
    lbohn, Apr 20, 2010
    #11
  12. gerryf19

    gerryf19 I am the walrus

    Reputations:
    2,275
    Messages:
    3,990
    Likes Received:
    0
    Trophy Points:
    105
    thanks...neat

    Yet another reason to change your default router passwords, eh?
     
    gerryf19, Apr 20, 2010
    #12