I am having all of my browsers hijacked, (ie, mozilla and chrome) when I try to go to www.google.com, it goes to an aol page that says "page not found, the page requested cannot be found. Please chec

With today's malicious virus and spyware infections, a multi-pronged approach is required to cleanly removing all traces of an infection from a system.  Anti-virus companies today filter through approximately 50,000 new viruses a day so unfortunately, even the most expensive and up-to-date anti-virus tool is not 100% effective at all times.  Thankfully, there are very effective and FREE resources to help remove this malicious infections from your system.

*NOTE* Once a system is infected, the only real method for ensuring the system is clean of any malicious infection is to perform a installation of the operating system from a safe source such as media acquired from a legitimate vendor.  With that said, the following tools can be used to help clean an infection from a system.

I would suggest using these anti-virus/anti-spyware tools in the following order:

1.  Malwarebytes' Anti-Malware (http://www.malwarebytes.org/) - A solution that combines mulitple techniques in discovering and removing malicious infections from a system.
2.  SUPERAntiSpyware (http://www.superantispyware.com/) - An advanced spyware removal tool which detects and removes over a million malicious infections.
3.  ComboFix (http://www.combofix.org/) - Another solution that can act as a an additional layer of support in detecting and removing infections.

Additionally, to help detect and remove rootkits, you could use the following tools:

1.  F-Secure's Blacklight (http://www.f-secure.com/en_EMEA/products/technologies/blacklight/) - An extremely effective rootkit detector and removal tool from F-Secure.
2.  Trend Micro's Rootkit Buster (http://www.trendmicro.com/download/rbuster.asp) - Another effective rootkit detector and removal tool from TrendMicro.

If you ever have an issue downloading or running one of these applications from your system, you can rename the file as it is downloaded to help circumvent any anti-security controls the malicious infection has implemented.

Hope these help & good luck!

Mike

Based on the hijackthis report, the hosts file only has localhost:
O1 - Hosts: ::1 localhost

Also based on your hijackthis report you have a ton of Browser Helper Objects (BHO's) that may be the cause.  If you don't need them, I'd disable them.   I would do the same with any firefox addons that you don't need.  

The ones that come to mind:
Skype toolbar, MSN toolbar, Google Toolbar.  
Each on of these will want to change the default startup page and search provider of whatever browser is installed when those agents were installed.  It's quite a pain sometimes.  

However,  I do not see anything based on the hijackthis report that indicates that AOL is the default search provider (i.e. if you type in an address that doesn't work, it will attempt to do an internet search for whatever was typed in the address bar  just as if it was typed in the "search" box.)  or even if AOL Instant messenger is actually installed.

If you could answer 1dot44mb's question regarding whether it's just google.com or any webpage would help.  

if it is when you only goto www.google.com, try putting in google's ip address and see if that works:  http://64.233.169.106

if that works, it could be an odd name resolution issue occuring.  goto start -> run and type in "cmd" without the quotes.  A black box should appear.  From there, type in "ping www.google.com"  without the quotes and paste the results here.  Also type in: "ping -a 64.233.169.106"  again without the quotes and paste the results here.  That should help us determine if it's a name resolution issue or something else going on.

I would test the followong things:
1) boot the PC with a live linux and try google
2) connect a laptop to the same port on the router and try google
3) perhaps your provider has some problems and did some misconfiguration, send an email to them with the question about the issue.
4) your anti virus tool may have some extra gimick like saver surfing or something like that, try deactivating it

With this you should be able to isolate the problem.

Regards,

Oli

Only Google redirects... I can go to bing.com, etc... and in fact I am on expert-exchange...  nothing related to google.com

I tried the ip address, it goes to google.com, the www.google.com goes to aol


paste from pings
Microsoft Windows [Version 6.0.6002]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Users\Stephan Tobias>ping www.google.com

Pinging www.l.google.com [74.125.65.103] with 32 bytes of data:
Reply from 74.125.65.103: bytes=32 time=168ms TTL=52
Reply from 74.125.65.103: bytes=32 time=169ms TTL=52
Reply from 74.125.65.103: bytes=32 time=168ms TTL=52
Reply from 74.125.65.103: bytes=32 time=172ms TTL=52

Ping statistics for 74.125.65.103:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 168ms, Maximum = 172ms, Average = 169ms

C:\Users\Stephan Tobias>ping -a 64.233.169.106

Pinging yo-in-f106.1e100.net [64.233.169.106] with 32 bytes of data:
Reply from 64.233.169.106: bytes=32 time=181ms TTL=241
Reply from 64.233.169.106: bytes=32 time=179ms TTL=241
Reply from 64.233.169.106: bytes=32 time=179ms TTL=241
Reply from 64.233.169.106: bytes=32 time=179ms TTL=241

Ping statistics for 64.233.169.106:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 179ms, Maximum = 181ms, Average = 179ms

C:\Users\Stephan Tobias>

C:\Users\Stephan Tobias>

I have a notebook on the same router and there are no issues

hmm, that is odd.  you can ping www.google.com and it does return a valid google address.  74.125.65.103 does load google.com when I visit it as well, so it's not a hosts file issue.  

let's try this.  let's create a blank firefox profile and see if it works.  First close all firefox windows.  Then goto start -> run and type ( or copy/paste) exactly as below:
"c:\program files\mozilla firefox\firefox.exe" -ProfileManager

A profile manager window should open up, create a new one, name it whatever you want and when firefox loads, it will be totally clean of any addins etc.  try visiting www.google.com from there.  if it works, then it's some piece of addin or other browser plugin  doing it.   if it still loads the AOL site, then it may be a deeper issue.  Odd that only google is hijacked though.  What is the URL in the address bar once the "page not found" aol page is loaded?

mozilla and ie now work fine... chrome still does not
in Chrome, if I type www.google.com, my.aol.com page comes up
My home page is google news, if I hit the web button, the page not found comes up with this url , http://www.google.com/webhp?hl=en&tab=nw

If I go to a search for a search engine and then select google, it still goes to aol in chrome

sounds like it's definitely an addon/add-in then if a new firefox profile works properly.  What did you do to fix IE?  Did you perform my suggestion of uninstalling the various addons in IE fix the issue as well?

I'm not as familiar with Chrome as I don't use it, however, a similar option for removing addons should exist.  

How do I remove these files?

I ran spybot... that was it