Bing/Yahoo/Google redirects ... no other symptoms

[Xander]

Okay, it's been a while since I put my hat in my hand and posted one of these but this virus is kicking my ass.

Win7 Home system. MSN is his homepage and when he uses the Bing search box, it 404s. Tried going to Bing.com and it gives you a "You must update to Flash Player Pro" page.
All links on the page still say Bing.com. Even image properties on the page claim it's from Bing (thinking if it was some random site, I could search the registry for references).
It also does this in Safe Mode.

Reset anything network relevant with D7II.
Flushed DNS.
ADW found some common junk but didn't fix it.
MBAM ... same...just crumbs of the other stuff.
Combofix...nothing.
Nothing standing out in HijackThis.
Ran stuff I usually don't: Emsisoft CMD, Norton Power Cleaner, Norman and a few others....NOTHING.

Adapter settings are plain jane. Same results when wired or wireless.
HOSTS is empty.

He'd been running MSSE but I've swapped that for their KAV trial (nothing found).

I'm running a KAV offline disc but it's 90% done and has found nothing yet.

Next step will be an offline SFC in case it's one of those ATAPI.SYS type infections.

I even had him bring his router with him just in case it had been tampered with (but it did the same things on my network so it was just wishful thinking)

 

[ohio_grad_06]

Have you run Rogue Killer? Might run that, and also use their tools there to try to kill off any proxies and to reset the host file.

Might take Kaspersky off temporarily and hit it with combofix also. What browser is he using? IE? Might try alternate browser to see if behaviors change. If so, then you might do a reset on IE. Also, maybe running the tweaking.com tool to reset all services etc may help?

 

[nlinecomputers]

Have you changed the DNS to known good servers like OpenDNS?

If you PING google or other sites who does it ping to?

 

[nlinecomputers]

if you use ip numbers instead of names do you go to the correct site. Bing for example is 204.79.197.200

 

[altrenda]

I didn't see anywhere that you checked the proxy settings.

 

[Xander]

Good ideas. As expected, the KAV Rescue found nothing.
Just restarted the offline SFC. Got a "found corrupt files but was unable to fix some of them." The CBS.log file was huge so I've deleted it and started it again for only-relevant info.
(Edit: Argh - second SFC didn't even create a log. Screw it. I'll come back to that one later)

Sorry, yes, Proxy settings were blank but now I'm remembering once where there was a second location other than Internet Options....where the heck was that? Did find that setting changed once, will just have to get back into Windows and try to remember where that location was.

 

[mr m]

What browser is the client using? I'd bet Firefox.

See if a manual proxy was set up.

 

[Xander]

Happens cross-browser.
Well, when I got into Windows, I was greeted with a 169.254 address. {sigh}
Before I spotted that, Bing was still redirected so it was still doing it offline. Hmmmm...

Pulled up Tweaking.com's Repair and ran that on the parts relevant. Rebooted and....normal Bing. Yay!...but I'd rather know exactly where the little ******* (setting) was hiding. This was the slipperiest little bugger I've come across in a couple of years.

And now I really want to remember where that other Proxy setting was that came up once. I'm thinking it was in the registry. Will need to find it and check if Nick has it covered in D7II's resets.

 

[nlinecomputers]

Doesn't tweaking's tool make a log? Might check there to see what was fubar'd.

 

[nlinecomputers]

Hijackthis should have told you the proxy was set.

 

[Xander]

True and it wasn't in there.

 

[ohio_grad_06]

Glad you seem to have worked it out. Those can be interesting.

 

[Xander]

Just checked Tweaking's log.... nothing useful. Just "reset this" and "reset that", it doesn't do any checking on whether or not there's a bad setting in the first place.

 

[altrenda]

every once in a while there is an additional proxy server entry in

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings .

 

[Xander]

That's the one. Evernoted.