Kitz Forum
Internet => Web Browsing & Email => Topic started by: renluop on February 23, 2011, 03:07:34 PM
-
Windows7 Home Premium
Firefox 3.6
Default search engine Google
Frequently, although the adress that appears is that of the company I want to connect with, I am directed to googleads.com or a site of similar type. I fail to connect "Firefox can't establish a connection to the server at www.googleadservices.com".
Such incidences are becoming more frequent.
What can I do to solve the problem? Ideas please.
-
That link you have posted takes you to the Google home page,that is not the same as Google search.You can have any homepage you want.You must have Google set as your homepage.
Have you tried doing a scan with Malwarebytes or similar.
You can download the free version safely from here
http://www.filehippo.com/download_malwarebytes_anti_malware/
-
My Home page is another forum I have interest in, and as I said I use Google search.
By way of example I search on "letterbox toys" and in the adress box appears
http://www.google.co.uk/search?q=letterbox+toys+&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-GB:official&client=firefox-a .
It is when I click on the first item of links found that I am directed to googleleadservices, but not letterbox.co.uk, and fail to connect as per attachment.
IMHO malware does not feature as a cause: I did a full scan last night by periodical routine and the problem existed bothe before and after.
I want to ensure that by clicking on any item shown as a search result I am taken to the actual site and not some intermediary, be it googleleadservices or somewhere else.
[attachment deleted by admin]
-
Hmm. I don't have any problems.
I tried your link, and also went to google.co.uk, and typed letterbox toys as search term.
Then when I click on the first link returned by Google, with a light coloured background, I get straight to letterbox.co.uk.
Tried with Firefox 3.6.13 on both Linux and Vista. Also IE8 on Vista.
Cheers,
Peter
-
I also followed your link and then after clicking on letterbox.co.uk I get taken straight to that site.
Have done it with FF 3.6.13 and also Chrome .(Vista SP2)
-
Hmmm..odd. :-\.
What can I do next? Do you Google for searching and have you done a search on letterbox toys rather than from my link with the same outcome? :)
-
It looks like a DNS problem. Do you use your ISP's DNS servers or some other?
-
Read this page - especially the first answer.
http://www.exterminate-it.com/faq (http://www.exterminate-it.com/faq)
But - I'd want to know a lot more about them before accepting their offer of a free scan.
I too had wondered about DNS - what DNS servers do you use?
Cheers,
Peter
-
I have the same issue but it looks like it is a DNS issue, I think I am using OpenDNS.
Try this link and see if it works:
http://www.googleadservices.com (http://66.102.7.96/)
EDIT:
Looks like I am using Sky's DNS servers.
I can access http://www.letterbox.co.uk but not sure if I could before changing to openDNS servers, the googleadservices.com still fails.
-
All of the links above work fine here, using OpenDNS (208.67.222.222, 208.67.220.220).
-
Zzzzz time looms ;) I use ISP's (PN) DNS Servers.
Search engines vary. Yahoo is direct. Answer com is like google,
-
FireFox > Tools > Options > Privacy > Show Cookies ....... look for www.googleadservices.com , if present remove this item and retest.
If that cookie is not present then you have a browser redirect/hijack , HIJACK THIS will show you any added items, Malwarebytes run in SafeMode should remove the problem.
-
All of the links above work fine here, using OpenDNS (208.67.222.222, 208.67.220.220).
My first link "http://www.googleadservices.com" = http://66.102.7.96/ so was trying to prove it was a DNS issue.
-
My first link "http://www.googleadservices.com" = http://66.102.7.96/ so was trying to prove it was a DNS issue.
That's where Try this link and see if it works:
http://www.googleadservices.com
takes me http://66.102.7.96/
-
Those links BritBrat...The first takes me to Google homepage,the second takes me to Google search
-
If I trace the route this is what I get:
C:\Documents and Settings\********>tracert www.googleadservices.com
Tracing route to adservices.l.google.com [209.85.143.96]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 192.168.0.1
2 56 ms 24 ms 90 ms bm1.sspil-dhcp.isp.sky.com [94.7.***.***]
3 47 ms 23 ms 83 ms 10.245.187.241
4 29 ms 99 ms 105 ms te0-2-0-2.er10.txlon.ov.easynet.net [89.200.134.
189]
5 27 ms 100 ms 38 ms 72.14.219.252
6 99 ms 99 ms 27 ms 209.85.255.76
7 101 ms 122 ms 103 ms 209.85.251.190
8 50 ms 108 ms 105 ms 209.85.253.127
9 75 ms 105 ms 106 ms 216.239.47.26
10 41 ms 86 ms 106 ms dy-in-f96.1e100.net [209.85.143.96]
Trace complete.
Where did the adservices.l.google.com come from?
-
That's a bit odd. I don't get that:
traceroute -I googleadservices.com
traceroute to googleadservices.com (67.215.65.132), 30 hops max, 60 byte packets
(This is Linux, so the command is different, but it should give the same result.)
-
traceroute -I googleadservices.com
traceroute: unknown host googleadservices.com
When I use googleadservices.com (http://googleadservices.com) as URL in Firefox the page that appears is http://www.google.co.uk/ (http://www.google.co.uk/)
And Netcraft has never heard of it: http://uptime.netcraft.com/up/graph?site=googleadservices.com (http://uptime.netcraft.com/up/graph?site=googleadservices.com)
Very strange.
Cheers,
Peter
-
Well, now it is working in Opera, IE and Firefox but yesterday never worked in any.
The only change here is my router has auto updated the firmware.
And this is my trace:
C:\Documents and Settings\*******>tracert www.googleadservices.com
Tracing route to www.googleadservices.com [209.85.143.96]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 192.168.0.1
2 24 ms 23 ms 24 ms bm1.sspil-dhcp.isp.sky.com [94.7.***.***]
3 22 ms 22 ms 22 ms 10.245.187.241
4 28 ms 27 ms 26 ms te0-2-0-2.er10.txlon.ov.easynet.net [89.200.134.
189]
5 27 ms 27 ms 25 ms 72.14.219.252
6 31 ms 26 ms 26 ms 209.85.255.76
7 39 ms 38 ms 37 ms 209.85.251.190
8 39 ms 39 ms 42 ms 209.85.253.127
9 54 ms 40 ms 49 ms 216.239.47.38
10 40 ms 40 ms 40 ms www.googleadservices.com [209.85.143.96]
Trace complete.
Please note I do normally have that site blocked in my host files but can turn it on and off using host Switch.
-
You guys are losing me ;D
I am trying to run Hijack This as suggested by AdrianH but get a warning (see att), but the file it refers to is not in my hosts file (MVPS version). This old man is getting even more confused. :)
Consolidated advice?
[attachment deleted by admin]
-
You guys are losing me ;D
I am trying to run Hijack This as suggested by AdrianH but get a warning (see att), but the file it refers to is not in my hosts file (MVPS version). This old man is getting even more confused. :)
Consolidated advice?
You can ignore that warning for now and just run the scan,be sure to run as administrator.
-
You guys are losing me ;D
Just out of interest open the CMD prompt (run - type CMD) and type "tracert www.googleadservices.com" without the "".
Then post what you get, You have to go to edit menu (click top left corner) and select all and enter then paste into notepad.
-
How to tracert >> http://www.mediacollege.com/internet/troubleshooter/traceroute.html
-
@ Britbat
C:\Users\...>tracert www.googleadservices.com
Tracing route to www.googleadservices.com [127.0.0.1]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms GordonEaton-PC [127.0.0.1]
Trace complete.
C:\Users\...>
and indeed in hosts are several entries
127.0.0.1 4.afs.googleadservices.com
127.0.0.1 feedads.googleadservices.com
127.0.0.1 imageads.googleadservices.com #[Tracking.Cookie]
127.0.0.1 pagead2.googleadservices.com
127.0.0.1 partner.googleadservices.com
127.0.0.1 www.googleadservices.com
-
Hmm... 127.0.0.1 is your own PC. I wonder if this is the result of caching?
-
As auggested by AgrianH the Hijack This log
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 07:30:34, on 25/02/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
C:\Users\Gordon Eaton\routerstatslite68\RouterStatsLite.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/USCON/2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=13842&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-US/wlscctrl2.cab
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - https://support.dell.com/systemprofiler/SysProExe.CAB
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: RoxMediaDB12 - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Unknown owner - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 9616 bytes
-
If they are in the host file as 127.0.0.1 they will not work as it is telling it to go local i.e. nowhere.
Change 127.0.0.1 www.googleadservices.com
to
#127.0.0.1 www.googleadservices.com
Save and then click a www.googleadservices.com link and it should work. (NOTE when you save it it should not be a text file i.e. hosts.txt it should just be hosts, so if you have extensions hidden you may have to make them vissable in folder options.)
The "#" disables that item in the host file but you could also delete it.
Or you could download Biss Hosts Switch (http://blocklistpro.com/download-center/biss-hosts-switch/) and then you can disable the host file at will turning it on and off as you like.
-
Hitch, I am sole user with admin rights but am barred from saving the amended file, and run as admin does not seem to be available in either the drop down or through shift/right click.
-
Right click the file select properties and unselect the read only option.
Then when done make it read only again, that is to stop programs putting something there that you do not want.
-
Thanks all :)
@BritBat Read only was removed but still unable to save. I found that my privileges for Host were limited, so changed to full and it worked. :clap:
-
Hijack this :
1) you have SpyBot S+D installed which is why your host files was hard to alter, it is protected by Spybot , personally I would remove this application , it is way past its sell by date and doesn't work well with Win7.
2) In services I would expect to see your antivirus system listed, what are you running?
-
Hi Adrian!
Spybot: Interesting: OOI have you any links about its efficiency or suggested replacements.
Antivirus: ATM MS Security Essentials after some probs with anor prog. The ROUNDUIT is active for something else. ;D
-
Malwarebytes is excellent ,free and well recommended
Download it safely from Filehippo
http://www.filehippo.com/download_malwarebytes_anti_malware/
-
Yup, MalwareBytes and another is SuperantiSpyware both have good free offerings.
SpyBot needs removing but first undo any changes it has made to your system like your hosts files,Tea Timer etc.
There has been varying comment on SB S+D but my own experiences of it in both Vista and Win7 are very poor indeed. It should be noted that Win7 has a lot of inbuilt protection and is a lot better at dealing with malware than previous versions. Ideally you should browse in a limited account which prevents a lot of infections anyway.
-
Spybot is gone!
I was quite satisfied last evening, when I reached the site used as an example with bo trouble, and very grateful :)
Now, despite having placed a # before 127.0.0.1 as suggested by BritBat and ensuring it is still there after updating HOSTS, the problem has re-emerged.
So now what? :crazy: :wall:
-
Are you sure nothing is changing your hosts file and putting the block back?
Find the IP of the site you want to visit then change the host file:
From:
#127.0.0.1 www.googleadservices.com
to
Its IP address www.googleadservices.com
Then it should go to the correct place but should the IP change you may get a blank again.
Example:
74.125.230.116 Google.co.uk
74.125.230.116 (http://74.125.230.116)
-
Rename your host file to hosts_OLD
Open notepad and put the text below in it and save as hosts (not hosts.txt) in "C:\WINDOWS\system32\drivers\etc"
Write protect it.
Are you using Windows 7 as you may have more than one hosts file?
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
-
Thanks BritBat :thumbs: :drink: