You're most likely getting redirected because of a malware infection of some sort. I could be wrong, but it never hurts to do a clean up.
What I use at my shop generally is Spybot Search and Destroy v1.6.2 (safer-networking.org), and Avast! Free Anti Virus for the leftovers. Avast is already picking up the problem, but it isn't fixing it.Â
What I'd do is install Spybot, open it and update it (check for updates and get them all). Close it and reboot into Safe Mode.Â
You can boot into Safe Mode by tapping the F8 key repeatedly before Windows begins to load, and choosing Safe Mode with the arrow keys and Enter.
It will boot up and look ugly, but the beauty is drivers/startup sections don't load (for the most part), and you can usually do malware cleanups because in theory they won't be running in active memory and therefore protected by the operating system.
Anyway, you can google Safe Mode if you have trouble getting there.  After that, open Spybot, click on the Mode menu at the top, and then Advanced Mode.
This will show the Advanced tools, on the lower left side. What you want to do is click Tools, and check the boxes on the right next to BHOs and ActiveX. The Startup checkbox should already be checked.
Those 3 buttons will be showing on the left column now, check each one for things you know shouldn't be there. If you're not sure, you can post here and I'll try to reply.
Known safe items will have a green checkmark, or be highlighted green. Yellow (in the startup tab) means its unknown but potentially bad, and red of course means it is known to be bad.
BHOs are Browser "Helper" Objects, such as the Java plugin etc. Often there will be a lot. Most of the time its safe to remove them all; for instance you can just reinstall Java. But stick with the ones you know are bad.  You can also just TOGGLE them off (button at the top) so if it causes a problem you can toggle them back on.
ActiveX is sort of an executable/program that can run in Internet Explorer; Even if you don't use IE, it can contain hazards, so clean it up anyway. The same goes for TOGGLING these.
STARTUP is probably the most important, everything here starts every time your computer does. This is the most common way viruses/malware execute themselves, because it ensures they start every time.
Basically go through the list and look for stuff you know is bad, or that you don't need. This has the added benefit of speeding up your computer, since you won't be wasting memory on stuff you don't need running all the time. If you are unsure what something is, Google it or PM me. Some things here are required for your computer to operate, so don't remove anything you're unsure of without checking. Drivers/software suites for sound cards, video cards, printers etc, load this way often.
You can delete ones you know are bad, and toggle ones you are unsure of, in short.
Once you think you have a handle on those 3 areas, click on Spybot S&D in the top of the left column to go back to the first view. I suggest using the Immunize feature, which will add known bad addresses to your HOSTS file. This redirects them locally so that you basically cannot access these malicious addresses, effectively blocking them from reinfecting you, or getting you in the first place.
Once immunization is complete, click on Search and Destroy above it, and Check for Problems. When it's done, select all and Fix Problems. Hopefully it will fix them all, but if not, reboot and run it once more in Normal Mode.
If spybot asks if you want it to scan on startup, because it couldn't fix a particular problem(s), say no, I've found it to be a waste of time 9/10 times. Scanning in Normal mode after Safe mode, will usually clean up the leftovers. Just remember in Windows Vista, 7, and 8, you have to Right click and Run As Administrator, if you're in regular mode.Â
Once done with Spybot, update and run a full scan with Avast. If it asks to run a scan at startup, say Yes, and let it clean up what it finds.Â
Use this advice as your own risk, but after 15 years of cleaning up pcs professionally, this method works for the vast majority.
Good luck!
Log in to comment