After months of using Mozilla Firefox browser it began going to
www.brightwebsite.com when ever I enter ://www.google.com or
http://www.goolge.ca.  I have checked my WinXP Sp2 system with up to
date AdAware, Spybot and AVG virus scanning.

---

Request for Question Clarification by seizer-ga on 23 Jan 2005 07:22 PST

Hi pajudd -

If you click on "Tools", then "Options", and click on "General" on the
left, what is currently written in the "Location" box?

Thanks,

seizer-ga

---

Clarification of Question by pajudd-ga on 05 Feb 2005 07:18 PST

It has always been 'about:blank'.

Alas, the problem (not being able to go to google.com or .ca) has
mysteriously gone away. Bummer (sort of).  Now I cannot do more
research to find out what happened.

Thanks to all anyway.

Peter

Hijack This
http://www.download.com/HijackThis/3000-8022_4-10307556.html?tag=lst-0-1

Should have added the following to my question:
(I wish there were a way to edit/add to our questions after entering)

Other attempts:
Ran HijackThis and checked log for 'google' and 'brightwebsite'
Searched for all instances of HOSTS file on harddrive
 - all contain only reference to local host, no 'google' or 'bright'
Searched registry for 'google' and 'bright', found nothing related

Interesting, a couple of weeks ago I sorted out a similar problem on a
friend's machine - his IE was being 'diverted' to a Ukranian 'spy
site'.

HijackThis located the culprit

In your case brightwebsite.com looks as if it is a legitimate site
with, I think, web content management tools. Its ownership looks Ok -
as far as I can see.

Is there any possibility that you, or someone else, has installed some software.

Did HijackThis come up with any suspicious IP adresses eg: 127.1.1.99 ?

I suppose the other thing is to check that the version of HijackThis
that you used is the latest.

Recently installed s/w:
RSS Reader
http://www.feedreader.com/

Firebird database
- http://www.ibphoenix.com to
- http://www.flamerobin.org/
- http://www.isqlviewer.com/

Compression
http://www.mimarsinan.com/comprexx.asp

Ran latest HijackThis with these results:
Logfile of HijackThis v1.99.0
Scan saved at 5:05:19 AM, on 2005-01-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\MicroCreate\Alt-Tab Thingy v2\AltTabThingy.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\ctfmon.exe
E:\SpyBot\TeaTimer.exe
E:\NetMeter\NetMeter.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
E:\OpenOffice\program\soffice.exe
E:\Replicator\PTReplicator.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
E:\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
E:\VPN\UltraVNC18\WinVNC.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
E:\PopFile\popfileib.exe
C:\WINDOWS\system32\hpoipm07.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
E:\Eudora\Eudora.exe
C:\WINDOWS\system32\wscntfy.exe
E:\MOZILLA\FIREFOX\FIREFOX.EXE
C:\WINDOWS\system32\cidaemon.exe
E:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
- C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
E:\SpyBot\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -
C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event
Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media
Experience\PCMService.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common
Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch
Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch
Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WinVNC] "E:\VPN\UltraVNC18\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [AltTabThingy] C:\Program Files\MicroCreate\Alt-Tab
Thingy v2\AltTabThingy.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\SpyBot\TeaTimer.exe
O4 - HKCU\..\Run: [E:\NetMeter\NetMeter.exe] E:\NetMeter\NetMeter.exe
O4 - Startup: OpenOffice.org 1.1.0.lnk = E:\OpenOffice\program\quickstart.exe
O4 - Startup: Replicator.LNK = E:\Replicator\PTReplicator.exe
O4 - Startup: Run POPFile.lnk = E:\PopFile\runpopfile.exe
O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk =
C:\Program Files\Hewlett-Packard\AiO\hp psc 700
series\Bin\hpobrt07.exe
O4 - Global Startup: Microsoft Office.lnk = E:\msOffice\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program
Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://E:\msOffice\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
- C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINDOWS\system32\msjava.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MUSICMATCH MX Web Player -
{d81ca86b-ef63-42af-bee3-4502d9a03c2d} -
http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: eBay - Homepage -
{EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - E:\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
- C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O16 - DPF: {62FA83F7-20EC-4D62-AC86-BAB705EE1CCD} (SmartCode ViewerX
VNC Control) - http://www.s-code.com/viewerx/viewerx_static.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)
- http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097292095078
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. -
E:\Diskeeper\DkService.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation -
C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. -
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server - UltraVNC - E:\VPN\UltraVNC18\WinVNC.exe

No 127.1.1.x found
Thanks for your interest so far.  Wil raise payment level if desired.
Peter

Along with the usual suspects (AdAware, Spybot, HijackThis) BHODemon
may be useful: http://www.majorgeeks.com/download3550.html

Actually, although I haven't actually seen this happen I have heard of
spyware redirecting DNS requests by changing your network settings to
point to their DNS servers. This would function in a manner similar to
writing incorrect information to the hosts file. You would check this
in network properties.

"Tools", then "Options", and click on "General" gives 'about:blank'
Remember it is not the home page that has been compromised.  I cannot
get to Google.com or -.ca when it is _typed in_ to the address box or
called from a shortcut.

Can you ping Google from the command line?

Have you tried a scan with Microsoft's Anti-Spy Beta version.  You can
find a link to it here
http://www.vermontpcsolutions.com/tools_microsoft.html.  I have run
this on several machines after running SpyBot and AdAware, if found
spyware/adware that Spybot and AdAware did not pick up.