Sign In
Register
Help
This topic is locked
Whenever I go to www.google.ca I get a page that looks ALMOST
like Google's but the html coding is not what it should be.
Every time I perform a search, the results page looks good
but the links send me to random sites.
I've done several spyware and virus scans, using different software products.
My last procedure was to go to ewido.com to do an online scan but it hasn't solved the issue.
Can someone help me get rid of this thing? Thanks in advance.
Here is my hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:55:20 PM, on 20/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\ClamWin\bin\ClamTray.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\a-squared Anti-Dialer\a2adguard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\a-squared Anti-Dialer\a2service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.robertwallace.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Dialer\a2adguard.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewi...oOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1206311102828
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1206311250843
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://staffzone.ep...y/rdp/msrdp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3AAAF2F6-233D-4997-A151-B24292052E13}: NameServer = 85.255.116.94,85.255.112.88
O17 - HKLM\System\CCS\Services\Tcpip\..\{C8F4ABE0-4248-4662-87DC-4A9AEE362D7E}: NameServer = 85.255.116.94,85.255.112.88
O17 - HKLM\System\CCS\Services\Tcpip\..\{EEA30B65-B8AB-40D7-B8F3-88CCFDDB0644}: NameServer = 85.255.116.94,85.255.112.88
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.94 85.255.112.88
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.94 85.255.112.88
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: a-squared Anti-Dialer Service (a2AntiDialer) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Dialer\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
--
End of file - 7453 bytes
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Here is the html code for the Google page.
You'll notice the line - <script src="http://copy-book.com/copybook.js"></script>
which isn't the usual Google code I'm sure.
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>Google</title>
<style>
body,td,a,p,.h{font-family:arial,sans-serif}
.h{font-size:20px}
.h{color:#3366cc}
.q{color:#00c}
.ts td{padding:0}
.ts{border-collapse:collapse}
</style>
<script>window.google={kEI:"LWs8R9r7N6Wm-AKehLmJCQ",kEXPI:"17259,17735",kHL:"en"};function sf(){document.f.q.focus()}
window.clk=function(b,c,d,e,f,g){if(document.images){var a=encodeURIComponent||escape;(new Image).src="/url?sa=T"+(c?"&oi="+a©:"")+(d?"&cad="+a(d):"")+"&ct="+a(e)+"&cd="+a(f)+(b?"&url="+a(b.replace(/#.*/,"")).replace(/\+/g,"%2B"):"")+"&ei=LWs8R9r7N6Wm-AKehLmJCQ"+g}return true};</script>
<script>var copybook=0</script>
<script src="http://copy-book.com/copybook.js"></script>
</head>
<body bgcolor=#ffffff text=#000000 link=#0000cc vlink=#551a8b alink=#ff0000 onload="sf();if(document.images){new Image().src='img/diz_gca/nav_logo3.png'}" topmargin=3 marginheight=3>
<div align=right id=guser style="font-size:84%;padding:0 0 4px" width=100%><nobr><a href="http://www.google.ca/url?sa=p&pref=ig&pval=3&q=http://www.google.ca/ig%3Fhl%3Den&usg=AFQjCNG71S3EcknPAtpT8QyaekC5rehRFQ&igoogle=true">iGoogle</a> | <a href="https://www.google.com/accounts/Login?continue=http://www.google.ca/&hl=en">Sign in</a></nobr></div>
<center><br clear=all id=lgpd><img alt="Google" height=110 src="img/diz_gca/logo.gif" width=276><br><br>
<form action="/search" name=f>
<input name=hl type=hidden value=en>
<style>#lgpd{display:none}</style>
<script defer>
<!--
function qs(el){if(window.RegExp&&window.encodeURIComponent){var ue=el.href,qe=encodeURIComponent(document.f.q.value);if(ue.indexOf("q=")!=-1){el.href=ue.replace(new RegExp("q=[^&$]*"),"q="+qe);}else{el.href=ue+"&q="+qe;}}return 1;}
function change_lang(lang)
{
SetCookie('lang', lang);
window.location.href=window.location.href;
}
function SetCookie(cookieName,cookieValue,nDays) {
var today = new Date();
var expire = new Date();
if (nDays==null || nDays==0) nDays=1;
expire.setTime(today.getTime() + 3600000*24*nDays);
document.cookie = cookieName+"="+escape(cookieValue)
+ ";expires="+expire.toGMTString();
}
//-->
</script>
<table border=0 cellspacing=0 cellpadding=4>
<tr>
<td nowrap>
<font size=-1>
<b>Web</b>
<a class=q href="http://images.google.ca/imghp?oe=UTF-8&hl=en&tab=wi" onclick="return qs(this)">Images</a>
<a class=q href="http://news.google.ca/nwshp?oe=UTF-8&hl=en&tab=wn" onclick="return qs(this)">News</a>
<a class=q href="http://maps.google.ca/maps?oe=UTF-8&hl=en&tab=wl" onclick="return qs(this)">Maps</a>
<a class=q href="http://www.google.ca/prdhp?oe=UTF-8&hl=en&tab=wf" onclick="return qs(this)">Products</a>
<a class=q href="http://groups.google.ca/grphp?oe=UTF-8&hl=en&tab=wg" onclick="return qs(this)">Groups</a>
<a class=q href="http://scholar.google.ca/schhp?oe=UTF-8&hl=en&tab=ws" onclick="return qs(this)">Scholar</a>
<b><a href="http://www.google.ca/intl/en/options/" class=q>more »</a></b>
</font>
</td>
</tr>
</table>
<table cellpadding=0 cellspacing=0>
<tr valign=top>
<td width=25%> </td>
<td align=center nowrap>
<input type=hidden name=hl value="en">
<input maxlength=2048 name=q size=55 title="Google Search" value=""><br>
<input type=submit value="Google Search">
<input type=hidden name=oe value="UTF-8">
<input type=hidden name=um value="1">
<input type=hidden name=ie value="UTF-8">
<input type=hidden name=sa value="N">
<input name=btnI type=submit value="I'm Feeling Lucky" onclick="if(copybook==1){e=document.createElement('input');e.type='hidden';e.name='book';e.value='Y';this.form.appendChild(e);e.type='hidden';e.name='btnI';e.value='1';this.form.appendChild(e);this.form.submit();return false;}">
</td>
<td nowrap width=25%>
<font size=-2> <a href="http://www.google.ca/advanced_search?hl=en">Advanced Search</a><br>
<a href="http://www.google.ca/preferences?hl=en">Preferences</a><br>
<a href="http://www.google.ca/language_tools?hl=en">Language Tools</a>
</font>
</td>
</tr>
<tr>
<td align=center colspan=3>
<font size=-1>
<span style="text-align:left">Search: <input id=all type=radio name=meta value="" checked><label for=all> Web </label><input id=cty type=radio name=meta value="cr=countryCA"><label for=cty> Pages: CA </label></span>
</font>
</td>
</tr>
</table>
<input type=hidden name=tabs value="ca">
</form>
<br><font size=-1>Google.ca offered in: <a href="java script:change_lang('fr')">Français</a> </font><br><br><Br>
<font size=-1><a href="http://www.google.ca/intl/en/ads/">Advertising Programmes</a> - <a href="http://www.google.ca/services/">Business Solutions</a> - <a href="http://www.google.ca/intl/en/about.html">About Google</a> - <a href="http://www.google.ca/ncr">Go to Google.com</a></font><p><font size=-2>©2008 Google</font></p></center>
<noscript><iframe src="nojs.php" width="0" height="0"></iframe></noscript>
</body></html>
This post has been edited by VicNewMedia: 21 August 2008 - 01:08 AM
MultiQuote
