Hijacker Trojan...Big Trouble

[RonB]

I have some very persistent and bothersome bug or trojan in my system. It was the reason I got SAS Pro but it has not taken care of it.

Not too sure but I think it's being called "Google_Redirect". Whatever it is it's made a mess of Firefox and using the internet. Took 6 trys to get here...

I had initially posted about a persistant adware that SAS see's but does not remove...must have been this thing but now it has gotten worse.

Has anyone dealt with this and successfully resolved it? Neither SAS nor Malwarebytes is doing anything.

Any and all suggestions are very much appreciated.

Thanks much,

RonB

[Jahn]

Run complete scans with SAS and MBAM in Safe Mode without Networking (tap F8 during boot).

If that fails, open a support ticket HERE.

[RonB]

Thanks for your suggestions guys...Much appreciated.

Cheers, RonB

[RonB]

Well, I turned off System REstore, booted in Safe Mode, ran full scans of MBAM, SAS and AVG. Restarted in Safe Mode again and ran all a second time. Rebooted regularly ran scans again. Turned on System Restore and restarted. All was running normal...Firefox was back and could access sites again...for about 5min. Then it started all over with a vengence...the internet is useless for me now. I almost quit trying to get here...took at least 10 tries. I was bounced all over the place when I clicked an option. From the Index page to here I went to a lawyer's site in Georgia to somewhere in Poland to an autoparts store in what looked like an Asian country and about 6 other places...it's nuts.

Is ther a way to get rid of this dammed thing?...this is the 5th try to post this...RonB

[RonB]

Berny +++ Thank you my friend...the host file was the trick. In the week I have been hassling with this I must have read at least 50 paragraphs on uncounted forums and tech columns and you are the only person to suggest this, and you did it personally. I am in your debt and will go tomorrow to the Capitol Building Park and feed the pigeons and squirrells with a big bag of cracked corn in your name...

Thanks much...I appreciate your help and will pass it on when my turn comes.

Cheers, Ron

[RonB]

Hi again Berny ++++ (you get an extra + in my posts),

The Host file was corrected in regular mode...seems to have worked. Will set the file as READ ONLY...that is another good tip!

I was thinking of getting NOD but will look at KAV too.

Since cleaning out the system I have been using Sandboxie to run Firefox and deleting it's contents after each session. They claim it keeps everything separated from the system and you can decide what is "recovered" and allowed in, like downloads etc. Operates like one giant electronic condom... Have you tried it?

I am also wondering if a proxie would help prevent virus or hyjacker problems...I know nothing about them or how to set one up but am going to look into it.

Cheers,

Ron

[joe]

Hello Ron and Berny!

I am a real newbie and wondered if i might impose on you guys with a few questions after reading your string?

Iwas home yesterday setting up a new computer for my dad who toasted off his old one. Based on advice form my computer friends at work

I loaded AVG, SUPERANTISPYWARE, MALWAREBYTES AND ADVANCED SYSTEM CARE by IObits. I scanned his computer with no problems except for

MALWARE giving me a hit on an entry called " hijack.DisplayProgram". I Google'd it and determined that it was (apparently) safe to put on the ignore

list, which i did.

I came home to my computer, a very recently acquired Sony Vaio laptop with Vista. I have been having a problem the last few days getting the

SUPERANTI. to upgrade from the trial to the purchased "PRO" version. I am scanning with all the others listed above successfully, without incident and have also

run the free SUPERANTI. without incident until I upgraded last week - now I continually get the "trial offer has ended box" and I'm locked out / prevented from using

the SUPERANTI. program (just that one, all else works ok). While in the forums looking for any info on the "PRO" problem, prior to emailing them, I ran across your string.

With that as a background , I have 2 questions:

1- is the hijack.DisplayProgram truly no big deal? would you have any input on this?

2- Berny, I saw your comment on making HOST a read only file and i did that. However I saw that I had another small entry below the 127 line in my host

file that reads ::1 localhost I have posted it below. Can you tell me if this belongs there?

# Copyright © 1993-2006 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

::1 localhost

Thank you again for your time and any thoughts you might have on these items, I greatly appreciate it!

John H (joe)

Yorba Linda, California

PS..I saw your post on SB and am exploring that too - Thanks !!!

[calliope2503]

hi, im not a very technical user, in fact you can scratch off the very.at the moment i only have sas and spybot and since i downloaded sas ive had no problems at all. But this weekend ive had a total nightmare. i think it might have been a fake anti virus poping up on my screen. each time it said i had 24 trojans and i was having difficulties even loading in sas. when i finally got through i had 82 trojans, rootkits and stuff.

it took about 4 hours to get it what i thought was clean but yesterday it was fine.this morning it started up again and ive done 3 scans the last one said i had no dangerous virus' or anything. but it did say there was a rogue xp antispyware 2009.what i do you suggest i do? is it something i can get rid of myself or do i need to get someone in to deal with it?

[rayco]

i have this same problem. i did what bstandaert said but google is still redirecting me to differnt sites.....some sites dont but some do....