Google hijacks

I am searching from the Google homepage.   Intermittently, after I have performed a Google search and am going through the returned results, I will click on a result that has a valid internet address (ie xxx.blablabla.com) instead of being sent to xxx.blablabla.com I will be sent to shopzilla.com.  Then if I do a back arrow to return to where I came from I will get a screen that says nothing but  "continue" on it, then if I hit the back button again I will be returned to the Google home page.  I have just recently started getting the same thing, but instead if being sent to shopzilla I am being sent to findstuff.com.  Are you asking what plug-ins I have installed?

plugins, add-ons, extensions, themes, everything (just the names and versions) (tools, add-ons, then the three tabs extensions, themes, and plugins)

also, run an antivirus scan

Extentions:
AVG Safe Search 8.5
Java Quick Starter 1.0
LpgMeIn, Inc. Remote Access Plugin 1.0.0.439

Themes:
Default 3.5.2

Plugins:
2007 Microsoft Office System 12.0.4518.1014
Office Plugin for Netscape Navigator

Adobe Acrobat 9.1.0.163
Adobe PDF Plug-in for Firefox and Netscape

Coupons Inc., Coupon Printer Manager 4.0.0.5
Coupons, Inc. Coupon Printer DLL

DivX Player Netscape Plugin 6.1.0.0
npdivxplayerplugin

DivX Web Player 1.4.2.7
DivX Web Player

Google Update 1.2.183.7
Google Update

Google Updater 2.4.1591.6512
Google Updater plugin htt[://pack.google.com/

Java Deployment Toolkit 6.0.150.3
NPRuntime Script Plug-in for Java(TM) Deploy

Java (TM) Platform SE 6 U11 6.0.110.3
Java(TM) Platform SE binary

Java (TM) Platform SE 6 U15 6.0.150.3
Next Generation Java Plug-in 1.6.0_15 for Mozilla browsers

LogMeIn, Inc. Remote Access Components 1.0.0.356
LogMeIn, Inc. Remote Access Components

LogMeIn, Inc. Remote Access Components 1.0.0.439
LogMeIn, Inc. Remote Access Components

Microsoft DRM 9.0.0.4503
DRM Netscape Network Object

Microsoft DRM 9.0.0.4503
DRM Store Netscape Plugin

Microsoft Windows Media Player Firefox Plugin 1.0.0.8
np-mswmp

Mozilla Default Plug-in 1.0.0.15
Default Plug-in

QuickTime Plug-in 7.6.2
Default Plug-in

RealJukebox NS Plug-in 1.0.36.69
RealJukebox Netscape Plugin

RealPlayer Version Plugin 6.0.12.69
6.0.12.69

RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) 6.0.12.69
RealPlayer(tm) LiveConnect-Enabled Plugin

Shockwave Flash 10.0 r22
Shockwave Flash 10.0.r22

Silverlight Plug-In 2.0.40115.0
2.0.40115.0

Windows Genuine Advantage 1.5.723.1
1.5.0723.1

Windows Media Player Plug-in Dynamic Link Library 3.0.2.629
Npdsplay dll

Windows Presentation Foundation 3.5.21022.8
Windows Presentation Foundation (WPF) plug-in for Mozilla browsers

Yahoo! activeX Plug-in Bridge 2007.3.9.1
Yahoo! activeS Plug-in Bridge

I don't see anything too suspicious, unless it is something connected to the "Yahoo! activeX Plug-in Bridge "

What anti-virus program(s) do you have?

Try running hijack this and post the result.

I'm running AVG Free anti-virus software.  I have auto updates daily and complete computer scans every Monday and Thursday.

I have attached the log file from Hijack this.

Try manually running a complete scan, or check if it lists any unresolved issues.

 I am checking the hijackthis log.


How often does the problem occur, and does it always happen with the same sites, the same search queries, or the same "number" search result (ex. always the fifth result)?

When I do a Google lookup I can always get it to happen at least once.  It does not seem to be happening in any given pattern.  It may be the first instance returned by Google, or it could be the fifth.  It also does not seem to happen with any given sites.  It has happened on many different sites.

I have a scan running now and will look at it tomorrow.  I will have to be away from home most of tomorrow so don't give up on me if I don't answer you back right away.

Thanks for your help.

I haven't found anything too suspicious in the hijackthis log.  

Ok.  See if you can reproduce the issue with firefox in safe mode, windows in safe mode, and firefox and windows in safe mode.

It does happen in Firefox safe mode.  I will have to try Windows in safe mode tomorrow.

Ok, that is fine.  Firefox safe mode eliminates extensions and plugins as the culprit, so it is most likely another program on your computer.

Try GooredFix, and if the problem persists we can try MalwareBytes or Combofix.

Please download GooredFix and save it to your Desktop.
http://www.geekstogo.com/forum/redirect.php?url=http%3A%2F%2Fjpshortstuff.247fixes.com%2FGooredFix.exe

Double-click GooredFix.exe on your Desktop to run it.
Select "2. Fix Goored" by typing 2 and pressing Enter.
Make sure all instances of Firefox are closed at this point.
Type y at the prompt and press Enter again.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: If you receive a message saying that GooredFix needs your system to be restarted, please close all applications and reboot your system.
Please also allow any registry changes that may be prompted by any of your security programs.

And fix these bad entries in Hijackthis:

O4 - HKLM\..\Run: [AVStartup] C:\WINDOWS.0\schost.exe.exe
O4 - HKCU\..\Run: [Windows Update] C:\WINDOWS.0\system32\Winudate32.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E184D58F-07A7-4A3D-B346-6C04A45AD3B0}: NameServer = 85.255.112.228,85.255.112.93 G
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.228,85.255.112.93 G
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.228,85.255.112.93 G
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.228,85.255.112.93


And run MalwareBytes if GooredFix did not fix it.
Download Malwarebytes' Anti-Malware to your desktop, check for the tool's Updates before running a scan.
http://www.malwarebytes.org/mbam.php

Check your 'hosts' file to make sure nothing is wrong with it... chances are, something may be wrong. it doesn't have an extension, but you can just open it using notepad.

below is the list of different places your hosts file depending on your OS:

Windows 95 - C:windows
Windows 98 - C:\windows
Windows Me - C:\windows
Windows 2000 - C:windows\system32\drivers\etc
Windows XP - C:\windows\system32\drivers\etc
Windows NT - C:\winnt\system32\drivers\etc
Windows Vista - C:\windows\system32\drivers\etc

here's a link to a good article about the 'hosts' file:
http://www.timeatlas.com/mos/Term_to_Learn/General/Taking_Control_with_the_Hosts_file/

It seems as if there was a DNSChanger infection. Please run ComboFix with instructions here: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When I run GooredFix I do not see where to type 2 to select "2. Fix Goored".
It just runs and then returns the following log:

GooredFix by jpshortstuff (12.07.09)
Log created at 07:50 on 19/08/2009
Firefox version 3.5.2 (en-US)

========== GooredScan ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [01:32 01/10/2006]
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [14:44 27/05/2007]
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [02:13 08/09/2007]
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [04:55 21/10/2007]
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} [14:46 11/03/2008]
{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} [04:47 22/03/2009]
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [16:28 09/09/2008]
{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [04:31 24/01/2009]
{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [18:24 15/04/2009]
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [00:52 10/08/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG8\Firefox" [14:05 11/06/2008]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [04:30 24/01/2009]

-=E.O.F=-

Wonder why you didn't see it..

Did you fix those entries in Hijackthis? those 017 entries are DNS hijackers whether hijackthis could fix them without using any tool just try. Otherwise you would need MBAM or Combofix.

My hosts file looks OK.

Should I delete the 04 and 017 entries that you listed above with Hijackthis, or just the 017 entries?

including the 04 entries.... hijackthis doesn't delete the physical files that's why it also good to run a tool because some nasties can also hide from the hijackthis scan.

Phateon, since your post seemed so sure that running ComboFix would fix my problem I installed ComboFix and ran it.  My problem does indeed seem to have gone away.  

This was one of those problems that did not keep me from using my system; but, it sure was annoying.  I am glad that it is fixed.

Also, I just want to thank everyone that has worked on this problem with me for all your help.