Browsers (ie, Chrome, FF) can acess websites, all but search (google, bing, yahoo)

[fedaykinn]

I have a user that for the last week cannot perform searches through the internet... regardless of the browser. I she types a website it works fine, but search pages do not load at all. Looked like some kind of malware, but Malwarebytes does not find anything.

She's running windows XP, a work environment with business firewall installed. All my other users with the same setup can work just fine.

Any ideas?

 

[drifter77]

This situation can be caused by several issues. You say its a work environment and have a firewall installed, but she could be infected by a backdoor trojan or malware.

Try this:
- Clear all browsing data and cookies

- Have you tried different browsers? (Chrome / Firefox / IE / Opera)

- Download these free scanners and try them one by one:
RootkitBuster: http/free.antivirus.com/us/rootkit-buster/index.html
Stinger: http/www.mcafee.com/us/downloads/free-tools/stinger.a...
SpyBot: http/www.safer-networking.org/mirrors/

- If the above doesn't work try ComboFix:
http/api.viglink.com/api/click?format=go&key=552a35ca1eb1421626a0f973ac2a90af&loc=http%3A%2F%2Fwww.techspot.com%2Fcommunity%2Ftopics%2Fi-cant-access-any-search-engines-google-etc.135983%2F&v=1&libid=1366030284019&out=http%3A%2F%2Fwww.bleepingcomputer.com%2Fcombofix%2Fhow-to-use-combofix&ref=https%3A%2F%2Fwww.google.com.eg%2F&title=I%20can't%20access%20any%20search%20engines%2C%20google%2C%20etc%20-%20TechSpot%20Forums&txt=%3Cb%3E%3Cspan%20style%3D%22color%3A%20Blue%22%3EHERE%3C%2Fspan%3E%3C%2Fb%3E&jsonp=vglnk_jsonp_13660305736332

For ComboFix:
- Disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection
- Run ComboFix.exe and follow the prompts
- Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later
- Wait for the scan to be completed and reboot

If the above doesn't help, try searching a file named "hosts" in Windows Search (or under C:\WINDOWS\system32\drivers\etc).
Open that file with notepad and you can find some paragraphs in it. Delete all those paragraphs, and then save.
Check your browser.

 

[fedaykinn]

This situation can be caused by several issues. You say its a work environment and have a firewall installed, but she could be infected by a backdoor trojan or malware.

Try this:
- Clear all browsing data and cookies

- Have you tried different browsers? (Chrome / Firefox / IE / Opera)

- Download these free scanners and try them one by one:
RootkitBuster: http/free.antivirus.com/us/rootkit-buster/index.html
Stinger: http/www.mcafee.com/us/downloads/free-tools/stinger.a...
SpyBot: http/www.safer-networking.org/mirrors/

- If the above doesn't work try ComboFix:
http/api.viglink.com/api/click?format=go&key=552a35ca1eb1421626a0f973ac2a90af&loc=http%3A%2F%2Fwww.techspot.com%2Fcommunity%2Ftopics%2Fi-cant-access-any-search-engines-google-etc.135983%2F&v=1&libid=1366030284019&out=http%3A%2F%2Fwww.bleepingcomputer.com%2Fcombofix%2Fhow-to-use-combofix&ref=https%3A%2F%2Fwww.google.com.eg%2F&title=I%20can't%20access%20any%20search%20engines%2C%20google%2C%20etc%20-%20TechSpot%20Forums&txt=%3Cb%3E%3Cspan%20style%3D%22color%3A%20Blue%22%3EHERE%3C%2Fspan%3E%3C%2Fb%3E&jsonp=vglnk_jsonp_13660305736332

For ComboFix:
- Disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection
- Run ComboFix.exe and follow the prompts
- Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later
- Wait for the scan to be completed and reboot

If the above doesn't help, try searching a file named "hosts" in Windows Search (or under C:\WINDOWS\system32\drivers\etc).
Open that file with notepad and you can find some paragraphs in it. Delete all those paragraphs, and then save.
Check your browser.

Done all the above save combofix (don't want to risk it)

I have a feeling she had a trojan that before got cleaned by the corporate antivirus modified the host file... I will be rebuilding it tomorrow and letting you know of he result.

Thanks!!