Unexplained systematic forwarding to spam (and search engines) in Firefox/Chrome

Question

I have a nuts issue with Firefox. Each time I do a search on Google, then right-click a link to open it in a separate tab/window, Firefox stalls for a couple of seconds, then opens some spam/advertisement link instead of the proper page.

• I have run SpyBot, SuperAntiSpyware, CCleaner and my PC is clean.
• I have tried to re-install Firefox and requested to delete all history and data. It did not solve the issue.
• I have deleted the content of my firefox/extensions folder, but it did not help.
• I have AGV anti-virus installed. It even says that the links are safe...

I searched other forums and websites for a solution, but could not find any. I am now posting this question here. Has anyone encountered this issue? How can I fix it?

EDIT

Often, a pop-up from Firefox asks me whether I want to save a file called 's'.

The issue does is not specific to a browser. It also happens with Chrome.

I ran recent versions of Ad-Ware, CCleaner, SpyBot, Emsisoft Anti-Malware, MalwareBytes and SUPERAntiSpyware, but it did not solve the issue.

EDIT 2

I have followed JdeBP's recommendations (obtain the IP addresses automatically via DHCP). I also found a strange entry in my registry which I have deleted. I rebooted, but the problem is still there.

When I perform a ipconfig /displaydns, a get a long list of entries which seem to correspond to the spam I get. All of them have A (host) record set to 127.0.0.1.

When I perform ipconfig /flushdns followed by ipconfig /displaydns, then entries are still there...

When I perform ipconfig /renew, I get: No operation can be performed on Local Area Connection while it has its media disconnected. I am not really sure what that means. I am accessing the Internet via wireless (not ethernet cable). When I switch off the wireless on my PC, I get the same message for Wireless Connection.

I have disabled the Local Area Connection and tried ipconfig /renew, but it stalls...

EDIT 3

Here is the output of ipconfig /all. I am currently connected to the Internet via Wireless:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : NoKidding
   Primary Dns Suffix  . . . . . . . : 
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Marvell Yukon 88E8055 PCI-E Gigabit Ethernet Controller
   Physical Address. . . . . . . . . : 00-1D-BA-AC-D9-26
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Intel(R) WiFi Link 5100 AGN
   Physical Address. . . . . . . . . : 00-21-5D-EB-34-A8
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::193:2bc9:cbb0:168b%10(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.1.148(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : vendredi 10 juin 2011 2:10:57
   Lease Expires . . . . . . . . . . : samedi 11 juin 2011 2:31:02
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 268443997
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-11-91-8C-91-00-1D-BA-AC-D9-26
   DNS Servers . . . . . . . . . . . : 167.206.245.130
                                       167.206.245.129
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter VMware Network Adapter VMnet1:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet1
   Physical Address. . . . . . . . . : 00-50-56-C0-00-01
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::ccd8:6bfa:a3a4:7dfb%18(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.20.1(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : vendredi 10 juin 2011 2:18:29
   Lease Expires . . . . . . . . . . : vendredi 10 juin 2011 10:31:02
   Default Gateway . . . . . . . . . : 
   DHCP Server . . . . . . . . . . . : 192.168.20.254
   DHCPv6 IAID . . . . . . . . . . . : 436228182
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-11-91-8C-91-00-1D-BA-AC-D9-26
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter VMware Network Adapter VMnet8:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet8
   Physical Address. . . . . . . . . : 00-50-56-C0-00-08
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::3419:22f2:c13b:e8fa%19(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.132.1(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : vendredi 10 juin 2011 2:19:04
   Lease Expires . . . . . . . . . . : vendredi 10 juin 2011 10:31:04
   Default Gateway . . . . . . . . . : 
   DHCP Server . . . . . . . . . . . : 192.168.132.254
   DHCPv6 IAID . . . . . . . . . . . : 453005398
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-11-91-8C-91-00-1D-BA-AC-D9-26
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   Primary WINS Server . . . . . . . : 192.168.132.2
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter VirtualBox Host-Only Network:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : VirtualBox Host-Only Ethernet Adapter
   Physical Address. . . . . . . . . : 08-00-27-00-D4-EA
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::413a:949e:27db:860c%22(Preferred) 
   Autoconfiguration IPv4 Address. . : 169.254.134.12(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 
   DHCPv6 IAID . . . . . . . . . . . : 503840807
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-11-91-8C-91-00-1D-BA-AC-D9-26
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.lan:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{8C86257F-65F0-49A9-B3DF-A61CC7F73546}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{A98786DD-7682-4826-88F4-A03BA1D824A5}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{A53A0A7E-6A3D-4A72-A11F-30A6322B957C}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{FC119556-5E94-4BAB-8451-5D240BF581A5}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #5
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Apparently the DNS associate to the wireless is 167.206.245.130 which resolves to "vdns2.srv.prnynj.cv.net".

EDIT 4

I have noticed that I did not have a hosts file. I don't know how I got into that situation. Windows 7 never complained about this.

Some backups of hosts where there in the directory, including one made by SpyBot. I have created a new hosts file from it and rebooted, but I still face the same issue.

I have tried ipconfig /displaydns again, and it still displays the problematic entries. These entries are not in my hosts file:

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
::1             localhost
# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1   www.007guard.com
127.0.0.1   007guard.com
127.0.0.1   008i.com
127.0.0.1   www.008k.com
127.0.0.1   008k.com
127.0.0.1   www.00hq.com
127.0.0.1   00hq.com
127.0.0.1   010402.com
127.0.0.1   www.032439.com
...

127.0.0.1   www.zxsex2.info
127.0.0.1   zxsex2.info
127.0.0.1   zyban-zocor-levitra.com
# This list is Copyright 2000-2008 Safer Networking Limited
127.0.0.1   suportevendas.com
127.0.0.1   www.suportevendas.com
# End of entries inserted by Spybot - Search & Destroy

EDIT 5

Sorry, I retract. The problematic entries returned by ipconfig /displaydns did appear in my hosts file. So, I started with a fresh one:

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
::1             localhost

Here is where it gets REAL crazy. After rebooting my PC, display DNS returns:

Windows IP Configuration

    1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa
    ----------------------------------------
    Record Name . . . . . : 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
    Record Type . . . . . : 12
    Time To Live  . . . . : 86400
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    PTR Record  . . . . . : localhost


    1.0.0.127.in-addr.arpa
    ----------------------------------------
    Record Name . . . . . : 1.0.0.127.in-addr.arpa.
    Record Type . . . . . : 12
    Time To Live  . . . . : 86400
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    PTR Record  . . . . . : localhost


    localhost
    ----------------------------------------
    Record Name . . . . . : localhost
    Record Type . . . . . : 1
    Time To Live  . . . . : 86400
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 127.0.0.1


    localhost
    ----------------------------------------
    Record Name . . . . . : localhost
    Record Type . . . . . : 28
    Time To Live  . . . . : 86400
    Data Length . . . . . : 16
    Section . . . . . . . : Answer
    AAAA Record . . . . . : ::1

After going to google, search for some dummy term, then right-click any link to open a page in a new tab, I get the spam. When I perform display DNS again, I get:

Windows IP Configuration

    1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa
    ----------------------------------------
    Record Name . . . . . : 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
    Record Type . . . . . : 12
    Time To Live  . . . . : 86400
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    PTR Record  . . . . . : localhost


    1.0.0.127.in-addr.arpa
    ----------------------------------------
    Record Name . . . . . : 1.0.0.127.in-addr.arpa.
    Record Type . . . . . : 12
    Time To Live  . . . . : 86400
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    PTR Record  . . . . . : localhost


    clickalmost.org
    ----------------------------------------
    Record Name . . . . . : clickalmost.org
    Record Type . . . . . : 1
    Time To Live  . . . . : 30
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 69.65.49.114


    t3.gstatic.com
    ----------------------------------------
    Record Name . . . . . : t3.gstatic.com
    Record Type . . . . . : 5
    Time To Live  . . . . : 28
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    CNAME Record  . . . . : tbn.l.google.com


    www.gregorypacks.com
    ----------------------------------------
    Record Name . . . . . : www.gregorypacks.com
    Record Type . . . . . : 5
    Time To Live  . . . . : 1785
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    CNAME Record  . . . . : gregorypacks.com


    www.gap-system.org
    ----------------------------------------
    Record Name . . . . . : www.gap-system.org
    Record Type . . . . . : 5
    Time To Live  . . . . : 7185
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    CNAME Record  . . . . : turnbull.mcs.st-and.ac.uk


    www.cityofgregory.com
    ----------------------------------------
    Record Name . . . . . : www.cityofgregory.com
    Record Type . . . . . : 5
    Time To Live  . . . . : 3585
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    CNAME Record  . . . . : cityofgregory.com


    www.gregorysshoes.com
    ----------------------------------------
    Record Name . . . . . : www.gregorysshoes.com
    Record Type . . . . . : 5
    Time To Live  . . . . : 3585
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    CNAME Record  . . . . : gregorysshoes.com


    twitter.com
    ----------------------------------------
    Record Name . . . . . : twitter.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 7
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 199.59.148.10


    Record Name . . . . . : twitter.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 7
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 199.59.148.82


    Record Name . . . . . : twitter.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 7
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 199.59.149.198


    online.wsj.com
    ----------------------------------------
    Record Name . . . . . : online.wsj.com
    Record Type . . . . . : 5
    Time To Live  . . . . : 34
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    CNAME Record  . . . . : online.wsj.akadns.net


    www.gregory1.com
    ----------------------------------------
    Record Name . . . . . : www.gregory1.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 14385
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 98.190.238.71


    www.utrecsports.org
    ----------------------------------------
    Record Name . . . . . : www.utrecsports.org
    Record Type . . . . . : 5
    Time To Live  . . . . : 3585
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    CNAME Record  . . . . : utrecsports.org


    adwords.google.com
    ----------------------------------------
    Record Name . . . . . : adwords.google.com
    Record Type . . . . . : 1
    Time To Live  . . . . : 251
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 72.14.204.112


    localhost
    ----------------------------------------
    Record Name . . . . . : localhost
    Record Type . . . . . : 1
    Time To Live  . . . . : 86400
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 127.0.0.1


    localhost
    ----------------------------------------
    Record Name . . . . . : localhost
    Record Type . . . . . : 28
    Time To Live  . . . . : 86400
    Data Length . . . . . : 16
    Section . . . . . . . : Answer
    AAAA Record . . . . . : ::1


    www.newadvent.org
    ----------------------------------------
    Record Name . . . . . : www.newadvent.org
    Record Type . . . . . : 1
    Time To Live  . . . . : 3321
    Data Length . . . . . : 4
    Section . . . . . . . : Answer
    A (Host) Record . . . : 208.87.26.197

Some stuff is managing to pollute my DNS information just from browsing. And to make sure it was not in Firefox's history, I performed CCleaner before all that.

I start to believe it comes from the net and exploits a weakness in Windows 7 and browsers.

EDIT 6

I have tried to reboot in safe mode with network, then I started Firefox. The problem still happens. I restarted Firefox in safe (i.e., disabling all add-ons etc...). The problem still happens.

My home page is http://www.google.com. I type KB66. The URL changes to:

http://www.google.com/#sclient=psy&hl=en&site=&source=hp&q=KB66&aq=f&aqi=&aql=&oq=&pbx=1&bav=on.2,or.r_gc.r_pw.&fp=5014d35bb6efb157&biw=1280&bih=671

I right click on a link called 'www.faucetdirect.com › ... › Kingston Brass Tub and Shower' (for example) to open it in a separate tab (or window). The link in the new tab becomes:

http://7search.com/scripts/validation/v1/validate.aspx?x=dy9ygBqjMxLd%2fx4LgOz5nQ%3d%3d_nO1ntDEYzcueda6yqGuUEeCV6c3Bxc6tmw%2fI%2fM6cQTK3SaB9RpCN6iq7Oi6xnF6w0rps%2b%2bhP2MyCTu9vIpIX4yX3Rbb3DEqizuSnIrOMbXnjc%2bPLs5ynvpAR7ks6T%2b9EdGLnPWbO2Cu7Mv3V1w1MUhZAz6VAxhb3x4jYKaGcSRGjiUq%2bq0gHn2Ztqy2ZO0SJvCokHOYmlvuWGAEsf6xaAZ6sdsUfpzQXggpBWlZYwVIMNbCU9Y%2fhVzEWcKJ6XO4HZrlIhZwXAJ9%2brzRxqtwdegQ8fzHsM1DnhYe0kpgzZi4XCYIHjW%2fg5sf%2brshMYtgq

Sometimes, I get different links to other spam or search web sites.

When I right-click on the 'cached' linked to open content in a separate tab, I get:

http://webcache.googleusercontent.com/search?q=cache:Y5x8Fw4B-OgJ:www.faucetdirect.com/kingston-brass-kb66-px-double-handle-tub-and-shower-with-rough-in-single-function-showerhead-tub-spout-and-porcelain-cross/p1507409+KB66&cd=2&hl=en&ct=clnk&gl=us&source=www.google.com

I followed harrymc's recommendation regarding autoruns, I can't find something suspicious in my startup items.

I have been using this PC both in Europe and in the US and the issue happens in both locations.

P.S.: Yesterday, I also ran all anti-spyware, bot and anti-virus again and 0 issues were found.

For the records

Reformatting my PC from scratch solved the issue. I never thought I would have to go that far. Pffffff.....

Answer 1

You see this in two separate WWW browsers, so this is not a WWW browser problem. Fiddling with your WWW browsers won't fix this.

This is a malware problem. But it's not a problem caused by malware actually running right now on your machine. The malware ran at some point in the past, and it reconfigured your machine so that it only uses Internet services provided by the malware's author(s)/distributor(s). In particular, it adjusted your machine's idea of whom to ask for any DNS lookups — whence to obtain proxy DNS service.

Proxy DNS server redirection by malware

Your machine is now contacting a maleficial proxy DNS server for all DNS name→IP address lookups. That server is, in its turn, telling you that the entire Internet (or at least the popular bits like Google) exists at one particular network. (Common to several reports such as this one from February 2011 that was 93.188.163.0/23 and 93.188.160.0/24, but these aren't the only people to do this trick, by any means.)

So your machine contacts IP addresses on that network for all content HTTP servers that it is trying to talk to. On that network are (amongst other things) similarly maleficial HTTP servers that serve up a subtly distorted view of the actual World Wide Web. They copy everyone's WWW pages, to allay your suspicions, and slyly modify things like the URLs in Google's search results pages, so that instead of taking you to the actual parts of the WWW that Google is listing, they take you to advertising WWW pages, exactly as you are seeing.

DNS lookup overrides by malware

The behaviour that I've described above, in the original version of this answer, is that of the (amongst other things) the Zlob trojan horse program's "DNSChanger" variant. This is not the only malware to modify one's DNS settings, just as Promnet Ltd., whose IP addresses were given above, is not the only target network running maleficent servers. Another malware is the QHosts-1 (McAfee's name) trojan horse program.

This, too, modifies the proxy DNS server settings. But what it also does, in addition to that, produces the effects observed in the addendum to the question that was added after my answer. It also, as pointed out by McAfee, modifies the hosts file. Again, this isn't the only maleficent program to do this, by any means.

The hosts file is used in one of two ways on Microsoft Windows. If one is not running the DNS Client (dnscache) service, then it is consulted directly by applications that wish to map names to IP addresses, before the DNS is queried. If one is running the DNS Client service, then that service initializes its lookup cache from the contents of the hosts file when it starts, whever the hosts file's modification timestamp is changed, and whenever the service is instructed to re-initialize itself by the ipconfig /flushdns command. The output of ipconfig /displaydns is what is in the DNS Client's cache, and the fact that its initial contents is a whole load of malicious entries indicates that those entries are in the hosts file.

7search

Since my second version of this answer, we've been told about the domain name 7search.com.. As I've already mentioned, Zlob DNSChanger isn't the only software to alter one's configuration. Other such programs include 7FaSSt and BrowserAccelerator (It is unclear whether these are two generations of the same thing or two different things.), both of which are toolbars that plug in to WWW browsers that have the effect decribed of funnelling all Google searches through 7Search.

It's worth noting that the classification of these browser toolbar plug-ins is somewhat murky. 7Search sued McAfee in 2008, to have it stop calling its toolbar "spyware", and several reports that can be found explicitly classify this as "not a virus". (Of course, spyware doesn't have to be a virus to be spyware.) SpyBot adds hosts file entries to exclude access to 7Search from machines, on the grounds that it is associated with the spyware toolbars, and 7Search in retaliation goes around decrying what SpyBot does as "bad" and providing instructions to help users restore the "clean" hosts file without the SpyBot prophylactics.

Local fixes

Proxy DNS server redirection

Since you aren't running the malware now, the local fix for this is to just set your machine's configuration back to how it was, using the proxy DNS servers that you used to use. You either used to use your ISP´s proxy DNS server or a local proxy DNS server on your own network (such as a corporate Microsoft Windows Domain Controller, for example). You did this in one of two ways

• You were told one or more IP addresses to hardwire by your ISP/domain admin. In this situation, you just need to restore those IP addresses, in place of the IP address of the maleficial DNS server.
• You obtained the IP addresses automatically via DHCP. The malware will have switched this off, and switched you over to manually specified DNS server IP addresses. You simply need to switch this back on and renew your DHCP lease.

For Microsoft Windows, there's a step-by-step guide to doing this on Technet. Don't forget to erase all of the maleficent DNS server IP addresses from all of your network adapter settings.

Note that I'm not here including instructions for going back to having your machine use some third party's public proxy DNS server, such as Google's or OpenDNS'. You are witnessing firsthand exactly why it is very dangerous to use third party public proxy DNS servers — run by anyone that you don't have a contractual relationship with or other reason to trust. When proxy DNS servers are run by the malicious, they can do exactly this sort of thing to your machine at whim, without needing to run anything on your machine itself. And indeed, as noted, some of them have ulterior motives and in fact, just like the people who've hijacked your proxy DNS service here, already do exactly the same trick of mapping vast tracts of the Internet back to their own servers.

DNS lookup overrides

Again, since you aren't running the malware now, the local fix is quite simply to edit all of these entries back out of the hosts file.

And again, Microsoft provides a step-by-step guide for doing this, and a fix-it "wizard", in its KnowledgeBase.

7Search

Several spyware removal utilities claim to be able to uninstall 7FaSSt and BrowserAccelerator. Spyware Terminator does, for example. More usefully, perhaps, is that Spyware Terminator's WWW page for 7FaSSt lists all of the files and registry entries that 7FaSSt employs. Similarly, this ThreatExpert report appears to list all of the files and registry entries employed by BrowserAccelerator.

Answer 2

The message about "media disconnected" probably relates to the fact that the Local Area Connection is really disconnected.

As the command ipconfig /renew only works on adapters configured for dynamic (DHCP) addressing, maybe configuring the disabled Local Area Connection not to use DHCP may solve part of the problem.

In the more general case, you should configure your computer to automatically accept DHCP and DNS from the router. The router's setting will this way apply to all your computers.

The router should have its DNS servers set to that suggested by your ISP, as being the closest network-wise. Or choose among Google Public DNS or OpenDNS or DNS Advantage. Check the relative speeds of each, as for example in my case DNS Advantage is faster than my ISP.

EDIT

The additional entries in hosts were added by the Spybot Search and Destroy immunization, so no big deal. On the other hand, clickalmost.org looks extremely suspicious.

I suggest that you boot in Safe mode with networking, to see if this is happening. If it it stops happening, then an installed product is responsible. You should then, using autoruns, examine all startup items for suspicious or unwanted programs.

EDIT2

I believe that your installation was compromised by some click-fraud malware, which is not detected by anti-virus. The reason that it goes undetected may be :

1. The infection is in your DNS, which is not checked by anti-virus.
   Follow my recommendations to reset them correctly in the router and computer.
2. The virus that infects you is of a type that is currently unknown.

In the second case, contact the Support of the antivirus products that you are using and ask for help : Emsisoft, MalwareBytes or SUPERAntiSpyware rather than Google Security. I also recommend trying Avast and Avg : Install them and deep-scan, then report the problem if nothing is found (both give reasonable support).

You can also use an antivirus online scan such as ESET Online Scanner, Trend Micro House Call and Kaspersky Labs Free Virus Scan. Please note that they might require you to use Internet Explorer as your browser as an administrator, and that each scan may take several hours.

If all fails, reformating the hard disk and reinstalling Windows is the only solution (some people recommend it on any suspicion of a deep and hard to remove infection).

Answer 3

You are proably infected with an Adware .

Download and run Combofix .

Download here

Run it as per the instructions given here

Now post the Combofix log here (it is located at c:\Combofix.txt)

Answer 4

I was experiencing the same issue as you listed here with the Firefox browser. I looked to this discussion for a solution, but none seemed to work for me either.

I went to the Firefox menu and selected Tools > Options. Once in the "Options" window, I went to the "Advanced" tab and then connection settings. Under the proxy options, I saw that my browser had Automatic proxy configuration URL selected. I switched this to Auto-detect proxy settings for this network.

So far for the past week, I haven't experienced the issue. I'm not sure what this change in configurations did, but it seems to work for me so far.