Weird problem when using google

[Salvador]

This problem just started. Whenever I go to search on google, I get a pop up that says Authentication Required and asks me to "Enter username and password for http://dp.000.in"

I tried searching for it on google of all places and didn't pull up anything that helps.

What is it and how can I get rid of it? It's annoying to say the least.

BTW.. This is an XP Pro machine and I'm using Firefox. It only does it on Firefox. I just tried it on Internet Explorer and it doesn't happen.

TIA

 

[Matan Eldan]

Seems like an Hijacker.

Please download HijackThis from here:
http://free.antivirus.com/hijackthis/

you can analyze your scan results with the help of this site:
http://www.hijackthis.de/

Try to scan your PC with Malwarebytes' as well:
http://www.malwarebytes.org/

 

[nboy22]

If HijackThis Doesn't fix it, try running ComboFix and that might be able to fix it.

 

[pcgeek11]

I agree ... You have been Jacked...

 

[Salvador]

Well.. I ran HijackThis and analyzed it and nothing nasty shows up. I also ran Malwarebytes and nothing showed up there either.

What's weird is it only shows up on Firefox and only when I do a google search. It still pulls up the search fine, but it pops up that box asking for an id and password and I have to exit out of it every time. It doesn't seem like anything malicious. I just can't figure out what it might be.

I'm going to try ComboFix and see if it pulls up anything.

 

[Salvador]

I just got finished reading all the warning messages about using ComboFix on bleepingcomputer.com. I don't know if I want to resort to trying that just yet. My problem is a little annoyance that I don't know is worth screwing over my OS for. The problem is that I don't know how advanced I need to be to use it. I'm not a "malware" removal specialist by any means, but I'm not an idiot either.

Is there anything else worth trying short of ComboFix that might pick up something if HijackThis and Malwarebytes didn't pick it up? Does this problem sound like something that I need to be concerned with or just an annoyance? I'm concerned about something that might capture passwords.

 

[pcgeek11]

If you are uncomfortable with it it is a problem. IMO if there are any doubts and I couldn't determine what was causing the anomally I would format and reinstall or install a backup image. I hate not knowing.

 

[Salvador]

Is ComboFix as scary as they say it is? If I don't delete anything that I don't know anything about, wouldn't I be ok? Are they just trying to keep the typical users away?

I just don't know why there isn't any more information about http://dp.000.in on the internet.

 

[nboy22]

I don't really know what you're worried about... I've ran comboFix on 4 computers now with no issues. All you do is run it and let it do its job. It is an automatic program that as far as I know, gives you absolutely no say in what it does, but its fixed a few computers that I know of. In fact there was a thread here the other day where someone was able to fix their computer using ComboFix when HiJackThis didn't work.

I did a quick search and I saw that a lot of people are tripping out about it deleting system files. I'm sure you'd be ok if you just download it from the legit source, and not some 3rd party source. In my own experience combofix has been a nice utility to add to my computer-fixing arsenal.

 

[AMCRambler]

Have you tried wiping out Firefox and re-installing? It does sound like a browser hijack. You can also take a look under Tools -> Add-Ons and see if there's anything there that doesn't look legit. If you see something shady looking, wipe it out.

 

[Paperlantern]

Well, according to http://centralops.net/co/DomainDossier.aspx, that url refers to local host. Basically the loopback address 127.0.0.1. Curious.

 

[Salvador]

I did wipe Firefox and reinstalled it. That's the first thing that I tried when I found out that it was only a Firefox issue.

The only thing that I see that is strange in add ons is a Java Console that is grayed out with a big red exclamation mark next to it. I can't do anything with it either. All the options are grayed out.

I'm going to try nuking Firefox again and see what happens.

BTW.. I have user accounts on this computer and it doesn't matter which user account I'm in, the problem is the same with all of them with Firefox.

 

[nboy22]

Another thing you might be able to try is going to C:/windows/system32/drivers/etc/ and open your hosts file in notepad and post it up here. Not really sure if it would have anything related to this problem.

 

[aloser]

<flamesuit>Umm... then don't use Google? </flamesuit>

 

[Salvador]

I fixed it. I went into manage add ons and removed everything even if I thought it was ok. It fixed it.

This didn't seem like a hijack. I've been hijacked before and it usually blocks access to anything that will help you fix your computer including links to AV and anti-malware sites. It also had me going to sites that I didn't want to go to. All this thing did was pop up a box asking for a user and password when I did a google search. It didn't even prevent me from going to google or searching. I just had to exit out of it. If it was a hijack, it was pretty lame.

The thing that fixed my computer before when I got hijacked was SmitFraudFix. I had tried everything including Malwarebytes and HijackThis and SmitFraudFix was the only thing that would fix it.

Thanks again for your help and suggestions.