locked
being redirected RRS feed

  • Question

  • When I am searching the web and click on a site I get redirected to another site. How to fix this? I have run norton 360 and nothing.
    Tuesday, December 27, 2011 6:48 PM

Answers

  • The Hosts file has probably been changed by a hijack program. It is normally located at C:\Windows\System32\Drivers\etc\.

     

    If the file is Read-only, right-click it > Properties and remove the check mark. Make a backup copy of it, then using Notepad change its contents and save it (not as a .txt file, i.e. it has no extension). The file contains a number of comment lines beginning with # followed by IP Address entries, e.g. 127.0.0.1 localhost, which refers to the IPv4 address of the host computer, i.e. this computer. Entries beginning with ::1 localhost are the IPv6 equivalent of the IPv4.


    A line beginning 127.0.0.1 stops access, so don’t remove entries like 127.0.0.1 MalwareWebSite.com as they help to protect the system from accessing malware sites. However, if you see entries with legitimate names like 127.0.0.1 bbc.co.uk or 127.0.0.1 microsoft.com, you should remove them, as malware is trying to block access to them (using 127.0.0.1) or, more normally, redirecting them to another website (using n.n.n.n). The immunisation feature of programs like Spybot add the malicious websites to the Hosts file.

     

    If you’re being redirected to the wrong sites, check this registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix. The (Default) field in the right pane should contain http://  It may be suffixed with something like ehttp.cc/, if so just change it and restart the computer.

     

    If it is still misbehaving, download HijackThis and delete any redirection entries beginning with 01, 13 and 17.


    If you’re still having problems, go to one of the specialised HijackThis sites, read the instructions and post a log.

    • Edited by BurrWalnut Wednesday, December 28, 2011 9:40 AM Missed a bit out.
    • Proposed as answer by Sabrina Shen Thursday, December 29, 2011 7:15 AM
    • Marked as answer by Sabrina Shen Tuesday, January 3, 2012 9:26 AM
    Wednesday, December 28, 2011 9:05 AM
  • What about to open a new known website other than searching and click on the results?

     

    Also, I would like to provide the following suggestions:

      

    1. You may contact the Norton support to see if they have special update or tools to scan and complete remove the virus or spyware.

     

    2. Actually, the officially recommended method is still to format and re-install the compromised computer from a known good build (i.e. operating system CD + all security patches while disconnected from the network). For more information on hacking, please see these links:

     

    Help: I Got Hacked. Now What Do I Do?

    http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

     

    Help: I Got Hacked. Now What Do I Do? Part II

    http://www.microsoft.com/technet/community/columns/secmgmt/sm0704.mspx

     

    How A Criminal Might Infiltrate Your Network

    http://www.microsoft.com/technet/technetmag/issues/2005/01/AnatomyofaHack/default.aspx

     

    Malicious Software Removal Tool

    http://www.microsoft.com/security/malwareremove/default.mspx

     

    The Day After: Your First Reponse To A Security Breach

    http://www.microsoft.com/technet/technetmag/issues/2005/01/IncidentResponse

     

    3. You can also contact your antivirus vendor for assistance with identifying or removing virus or worm infections. If you need more help with virus-related issues, contact Microsoft Product Support Services.

    For information about Security updates, visit the Microsoft Virus Solution and Security Center for resources and tools to keep your PC safe and healthy. If you are having issues with installing the update itself, visit Support for Microsoft Update for resources and tools to keep your PC updated with the latest updates.

    I hope this helps. Thank you for your time and cooperation!

     

    (Please note that the newsgroups are staffed weekdays by Microsoft Support professionals to answer your non-urgent, break/fix systems and applications questions. Our goal is to provide 24 hour response to all questions. If this response time does not meet your needs, please contact Customer Service and Support (CSS) for more immediate assistance. For more information on available CSS services, please click here: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607.)

     


    Sabrina

    TechNet Community Support


    • Marked as answer by Sabrina Shen Tuesday, January 3, 2012 9:26 AM
    • Edited by Sabrina Shen Friday, April 6, 2012 2:47 AM PCSafety Center update
    Thursday, December 29, 2011 7:20 AM

All replies

  • The Hosts file has probably been changed by a hijack program. It is normally located at C:\Windows\System32\Drivers\etc\.

     

    If the file is Read-only, right-click it > Properties and remove the check mark. Make a backup copy of it, then using Notepad change its contents and save it (not as a .txt file, i.e. it has no extension). The file contains a number of comment lines beginning with # followed by IP Address entries, e.g. 127.0.0.1 localhost, which refers to the IPv4 address of the host computer, i.e. this computer. Entries beginning with ::1 localhost are the IPv6 equivalent of the IPv4.


    A line beginning 127.0.0.1 stops access, so don’t remove entries like 127.0.0.1 MalwareWebSite.com as they help to protect the system from accessing malware sites. However, if you see entries with legitimate names like 127.0.0.1 bbc.co.uk or 127.0.0.1 microsoft.com, you should remove them, as malware is trying to block access to them (using 127.0.0.1) or, more normally, redirecting them to another website (using n.n.n.n). The immunisation feature of programs like Spybot add the malicious websites to the Hosts file.

     

    If you’re being redirected to the wrong sites, check this registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix. The (Default) field in the right pane should contain http://  It may be suffixed with something like ehttp.cc/, if so just change it and restart the computer.

     

    If it is still misbehaving, download HijackThis and delete any redirection entries beginning with 01, 13 and 17.


    If you’re still having problems, go to one of the specialised HijackThis sites, read the instructions and post a log.

    • Edited by BurrWalnut Wednesday, December 28, 2011 9:40 AM Missed a bit out.
    • Proposed as answer by Sabrina Shen Thursday, December 29, 2011 7:15 AM
    • Marked as answer by Sabrina Shen Tuesday, January 3, 2012 9:26 AM
    Wednesday, December 28, 2011 9:05 AM
  • What about to open a new known website other than searching and click on the results?

     

    Also, I would like to provide the following suggestions:

      

    1. You may contact the Norton support to see if they have special update or tools to scan and complete remove the virus or spyware.

     

    2. Actually, the officially recommended method is still to format and re-install the compromised computer from a known good build (i.e. operating system CD + all security patches while disconnected from the network). For more information on hacking, please see these links:

     

    Help: I Got Hacked. Now What Do I Do?

    http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

     

    Help: I Got Hacked. Now What Do I Do? Part II

    http://www.microsoft.com/technet/community/columns/secmgmt/sm0704.mspx

     

    How A Criminal Might Infiltrate Your Network

    http://www.microsoft.com/technet/technetmag/issues/2005/01/AnatomyofaHack/default.aspx

     

    Malicious Software Removal Tool

    http://www.microsoft.com/security/malwareremove/default.mspx

     

    The Day After: Your First Reponse To A Security Breach

    http://www.microsoft.com/technet/technetmag/issues/2005/01/IncidentResponse

     

    3. You can also contact your antivirus vendor for assistance with identifying or removing virus or worm infections. If you need more help with virus-related issues, contact Microsoft Product Support Services.

    For information about Security updates, visit the Microsoft Virus Solution and Security Center for resources and tools to keep your PC safe and healthy. If you are having issues with installing the update itself, visit Support for Microsoft Update for resources and tools to keep your PC updated with the latest updates.

    I hope this helps. Thank you for your time and cooperation!

     

    (Please note that the newsgroups are staffed weekdays by Microsoft Support professionals to answer your non-urgent, break/fix systems and applications questions. Our goal is to provide 24 hour response to all questions. If this response time does not meet your needs, please contact Customer Service and Support (CSS) for more immediate assistance. For more information on available CSS services, please click here: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607.)

     


    Sabrina

    TechNet Community Support


    • Marked as answer by Sabrina Shen Tuesday, January 3, 2012 9:26 AM
    • Edited by Sabrina Shen Friday, April 6, 2012 2:47 AM PCSafety Center update
    Thursday, December 29, 2011 7:20 AM
  • I have the same problem for years, I have even installed windows 7 and 8.1 evaluation but it is still redirected ! I went to the police to make a declaration about it but they don't care about my problems.  I have contacted support but they keep closing my case. I also asked questions on the answers support page but they edit my post and then deleted my question. They also blocked my profile. HELP !


    Wednesday, December 3, 2014 10:43 PM