google redirects to sitesure.com

[Symp EL]

Google.com and iGoogle (Google search works fine) started redirecting to
sitesure.com this morning. I have ran AVG, Spybot S&D, Windows Defender, CWS
Sredder and all have found nothing. My system is heavily protected and I use
a HOST file as well. Any ideas?

--

-Jesse

[skiwi1@gmail.com]

On Feb 17, 12:47*am, "Symp EL" <no.s...@for.me> wrote:
> Google.com and iGoogle (Google search works fine) started redirecting tositesure.com this morning. I have ran AVG, Spybot S&D, Windows Defender, CWS
> Sredder and all have found nothing. My system is heavily protected and I use
> a HOST file as well. Any ideas?
>
> --
>
> -Jesse

I'm also getting this .. does anyone hve any ideas?

[Symp EL]

Must not be our machines.


<skiwi1@gmail.com> wrote in message
news:d36a5b18-dcbb-42ba-bd73-eccdf994c714@u10g2000prn.googlegroups.com...
On Feb 17, 12:47 am, "Symp EL" <no.s...@for.me> wrote:
> Google.com and iGoogle (Google search works fine) started redirecting
> tositesure.com this morning. I have ran AVG, Spybot S&D, Windows Defender,
> CWS
> Sredder and all have found nothing. My system is heavily protected and I
> use
> a HOST file as well. Any ideas?
>
> --
>
> -Jesse

I'm also getting this .. does anyone hve any ideas?

[Symp EL]

http://forums.cnet.com/5208-6035_102...sageID=2705891

<skiwi1@gmail.com> wrote in message
news:d36a5b18-dcbb-42ba-bd73-eccdf994c714@u10g2000prn.googlegroups.com...
On Feb 17, 12:47 am, "Symp EL" <no.s...@for.me> wrote:
> Google.com and iGoogle (Google search works fine) started redirecting
> tositesure.com this morning. I have ran AVG, Spybot S&D, Windows Defender,
> CWS
> Sredder and all have found nothing. My system is heavily protected and I
> use
> a HOST file as well. Any ideas?
>
> --
>
> -Jesse

I'm also getting this .. does anyone hve any ideas?

[rrcampbellphd@gmail.com]

On Feb 16, 3:47 am, "Symp EL" <no.s...@for.me> wrote:
> Google.com and iGoogle (Google search works fine) started redirecting tositesure.com this morning. I have ran AVG, Spybot S&D, Windows Defender, CWS
> Sredder and all have found nothing. My system is heavily protected and I use
> a HOST file as well. Any ideas?
>
> --
>
> -Jesse

If anyone figures it out, let me know. I am having the same problem.
Our other computer works just fine. I also have pretty good security.

[David H. Lipman]

From: <rrcampbellphd@gmail.com>


|
| If anyone figures it out, let me know. I am having the same problem.
| Our other computer works just fine. I also have pretty good security.

I'm not seeing this in any browser.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

[David H. Lipman]

From: "Symp EL" <no.spam@for.me>

| Google.com and iGoogle (Google search works fine) started redirecting to
| sitesure.com this morning. I have ran AVG, Spybot S&D, Windows Defender, CWS
| Sredder and all have found nothing. My system is heavily protected and I use
| a HOST file as well. Any ideas?
|

I have been thinking about this. You say you have an etc/hosts file but you still
redirected.
There is a new series of DNS Changer Trojans that AVG is presently failing to detect.

Run HiJackThis!
{ Do NOT post the log here }

Look for the following...

O17 - HKLM\System\CS1\Services\Tcpip\..\{79E79409-5F0B-46F1-8C75-DAA276C25110}: NameServer =
85.255.116.52,85.255.112.108
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.108

Is anything similar seen in the O17 entries ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

[Symp EL]

it has been fixed. check the link in my earlier post.

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:i2Ctj.109$kD3.64@trnddc08...
> From: "Symp EL" <no.spam@for.me>
>
> | Google.com and iGoogle (Google search works fine) started redirecting to
> | sitesure.com this morning. I have ran AVG, Spybot S&D, Windows Defender,
> CWS
> | Sredder and all have found nothing. My system is heavily protected and I
> use
> | a HOST file as well. Any ideas?
> |
>
> I have been thinking about this. You say you have an etc/hosts file but
> you still
> redirected.
> There is a new series of DNS Changer Trojans that AVG is presently failing
> to detect.
>
> Run HiJackThis!
> { Do NOT post the log here }
>
> Look for the following...
>
> O17 -
> HKLM\System\CS1\Services\Tcpip\..\{79E79409-5F0B-46F1-8C75-DAA276C25110}:
> NameServer =
> 85.255.116.52,85.255.112.108
> O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
> 85.255.116.52 85.255.112.108
>
> Is anything similar seen in the O17 entries ?
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>
>

[Judicandus]

On Feb 16, 3:15 pm, "Symp EL" <no.s...@for.me> wrote:
> it has been fixed. check the link in my earlier post.
>
> "David H. Lipman" <DLipman~nosp...@Verizon.Net> wrote in messagenews:i2Ctj.109$kD3.64@trnddc08...
>
> > From: "Symp EL" <no.s...@for.me>
>
> > | Google.com and iGoogle (Google search works fine) started redirecting to
> > | sitesure.com this morning. I have ran AVG, Spybot S&D, Windows Defender,
> > CWS
> > | Sredder and all have found nothing. My system is heavily protected and I
> > use
> > | a HOST file as well. Any ideas?
> > |
>
> > I have been thinking about this. You say you have an etc/hosts file but
> > you still
> > redirected.
> > There is a new series of DNS Changer Trojans that AVG is presently failing
> > to detect.
>
> > Run HiJackThis!
> > { Do NOT post the log here }
>
> > Look for the following...
>
> > O17 -
> > HKLM\System\CS1\Services\Tcpip\..\{79E79409-5F0B-46F1-8C75-DAA276C25110}:
> > NameServer =
> > 85.255.116.52,85.255.112.108
> > O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
> > 85.255.116.52 85.255.112.108
>
> > Is anything similar seen in the O17 entries ?
>
> > --
> > Dave
> >http://www.claymania.com/removal-trojan-adware.html
> > Multi-AV -http://www.pctipp.ch/downloads/dl/35905.asp

Most probably your DNS server was changed? Dave's DNS servers are the
ones from the Storm Worm.
Try checking it in your connections TCP/IP Settings

[SiteSure]

On Feb 16, 6:02 am, "David H. Lipman" <DLipman~nosp...@Verizon.Net>
wrote:
> From: "Symp EL" <no.s...@for.me>
>
> | Google.com and iGoogle (Google search works fine) started redirecting to
> |sitesure.com this morning. I have ran AVG, Spybot S&D, Windows Defender, CWS
> | Sredder and all have found nothing. My system is heavily protected and I use
> | a HOST file as well. Any ideas?
> |
>
> I have been thinking about this. You say you have an etc/hosts file but you still
> redirected.
> There is a new series of DNS Changer Trojans that AVG is presently failing to detect.
>
> Run HiJackThis!
> { Do NOT post the log here }
>
> Look for the following...
>
> O17 - HKLM\System\CS1\Services\Tcpip\..\{79E79409-5F0B-46F1-8C75-DAA276C25110}: NameServer =
> 85.255.116.52,85.255.112.108
> O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.108
>
> Is anything similar seen in the O17 entries ?
>
> --
> Davehttp://www.claymania.com/removal-trojan-adware.html
> Multi-AV -http://www.pctipp.ch/downloads/dl/35905.asp

Dave, et al,

Has anyone figured out what caused the issue? We run sitesure.com, and
used to host Google Gadgets from the site. Recently, due to a billing
issue the domain name expired and the site went offline. Network
Solutions redirected the DNS entries to a "holding site" on their
servers until we noticed and renewed. Could this have contributed? I
apologize for any inconvenience, but we have done nothing intentional
to cause the problem. I am currently combing the server to ensure that
we were not hacked -- but can find nothing subspicious.

Bill Hall