Redirect Virus

[Rusty]

Got a redirect virus that's been annoying me today, seems to mainly function on Google but has randomly annoyed me on other sites as well. I've run my various anti this and anti that programs and they've shown a couple of things up, that I've deleted, but there have still been a couple of issues with it. Any help or advice gratefully received

[irishs2]

Make sure there are no extra lines referring to those sites in your hosts file usually located in C:\Windows\System32\drivers\etc

Also try this http://www.malwarebytes.org/ usually gets rid of crap like that. The free version works fine.

[Nuvo]

Which Browser are you running? What anti-malware tools have you tried so far?
Download and run this tool and copy and paste the log file in your reply.

[Rusty]

AVG Free
Spybot S&D
CCleaner Reg scanner
Deleted all old history / files from IE5
Host file locked and entries deleted
Same problems in IE and FF

[driftin jo]

AVG Free
Spybot S&D
CCleaner Reg scanner
Deleted all old history / files from IE5
Host file locked and entries deleted
Same problems in IE and FF

Well that's just made me laugh ,
the stuff you are running I mean.

I had a mate running AVG free , I told him many times that its **** and he should go and buy Kaspersky.
After 3 months or so he eventually bought kaspersky , it found 29 Trojans on his pc , AVG said it was fine.
The lesson here is you get what you pay for ! Nuff said.

Spy bot is also a waste of time .

[Nuvo]

The only thing that jumps out at me in your log file is this entry:

O4 - HKCU\..\Run: [cleansweep.exe] C:\cleansweep.exe\cleansweep.exe

You don't want this, its a nasty trojan virus. Follow these steps to freedom: linky

Other than that everything looks normal.

[Rusty]

Cheers for that, all removed.

I'm glad my problems have caused you amusement, thanks for the advice tho, I'll do some research into that... any other suggestions whilst I'm about it?

[Nuvo]

Cheers for that, all removed.

No problem.

[Evilgoat76]

Erm, did my post get zapped?

[Rusty]

Not by me... post it up.

[Evilgoat76]

www.malwarebytes.org

I thought I hit submit as a customer came in, may have hit preview, oh well, the gist of it was ...

I see about 3/4 of these a week, the redirect is generically known as a DNS Hijack. I actually have two on the bench now.

After a week of testing Symantec came out as pretty much the worst av Kapersky wasnt far behind. AVG, Avast! Avira and Bitdefender (Bullguard 9) cane our pretty well. Paid wise on EsSet and Bullguard 9 did pretty well. McAffee is currently deleting windows system files as per another thread I posted.

Spybot on its own isnt great but its not THAT bad. Spybot with SDhelper and Teatimer is a pain in the rear.

Two ways to sort this without faffing about. Find another computer and download to a memory stick:

Avast!
Malwarebytes
Combifix (this is important, else it'll come back) - Google it Its free and make sure its legit

The chances are you wont be able to get any of this on the infected PC. You'll also notice Windowsupdate is probobly broken too. Depending on the infection this might be permanent.

Reboot the PC, as it comes to the end of the BIOS screens hit F8 repeatedly, you should get the boot menu. if not, reset, rince and repeat until you do.

Choose 'Safe mode with networking' and let it boot

Run Combofix first, let it update and install the recovery console. Just do whatever it says and eventually it will finish. This will have removed a lot of the nastier hard to shift infections and any rootkits. Many of these trojans drop root kits that arent detected, then after a week or so you end up back at square 1. This was learned the hard way

Back into Safe mode with networking and install, update, update again and run a FULL scan with Malwarebytes, this will pick up the more benign stuff combofix ignores. The results of Malwarebytes scans can be pretty horrific. PLEASE read the results least and look for password stealers etc. If you see them, consider any personal info on your machine (passwords, card transactions, online banking) compromised. Let if fix the issues and reboot as normal.

Disable or remove AVG, Install Avast and update. Do a full system scan, this will mop up the last few bits. Let it do its thing then either uninstall or register it (free)

Reboot one last time and re-run a basic malwarebytes scan, it should now be clear. If it isnt, Combifix time again, rinse and repeat until clear. Update and run Spybot/Adaware/ccleaner afterwards just because


Its taken 12 months of this to get this routine right, it does work and normally shifts most things. Its only rare this routine hasnt worked, maybe 2/3 times out of 280 machines. In these cases it was a 0 day virus that No-one other than Avast and Nod32 could detect.

Its important you do it in this order too. Skip Combofix and you will end up re-infected pretty fast. Dont do a quick scan at the end and the same applies.

If you get any 'backdoor.' hits on Malwarebytes you should treat it as pretty serious and consider the possibility your router may be compromised. We've seen a handfull of Netgear router now that have been reflashed to attack other machines etc. Running a cursory Malware/AV scan on nay other machines you have is always a good idea and give them the full treatment if anything is found.

Yes I know my typing is poor too but I've had a long day

*** Edit

Symantec, McAffee and Kapersky all have fairly serious Performance hits. In this respect AVG is bad unless you knock Linkscanner on the head. Avira came out tied with Avast 4.8. Bullguard 8 is Atrocious in every respect, 9 is actually pretty decent.

[S2central.net]

Or alternatively - buy a Mac

[HPmuirt]

Or alternatively - buy a Mac

Wash your mouth out young man!

Whilst writing a virus for a MAC is a bit like spraying graffiti on the underside of a drain cover or tattooing the underside of your tongue - painful to do and who the hell cares anyway, it is complete fantasy that MACs don't get viruses - they do and there are some quite nasty ones, you just hear about PC based ones more often.

Also, you think that Windows has security issues (although finally many are being closed off by Windows 7) the MAC is just as bad - again you just don't hear about it because again, who the hell cares?

The Safari web browser is about as secure as the economy under Brown meaning that even a monkey with a stick could exploit it. Granted there are very few wild mass exploits for the MAC but any user could get hit with a phishing attack.

Although that said, who in their right mind would own an S2 that they plan to upgrade and a MAC that they cannot

Cheers n

Si

[Rusty]

Combofix didn't pick up much.
Malwarebytes picked up 1 root kit..

[Evilgoat76]

Combofix didn't pick up much.
Malwarebytes picked up 1 root kit..

The rootkit is the ticket. Had that been left it would have been a problem. Combofix tends not to be too vocal about what it finds, tis one small annoyance. Just does its thing.

The whole 'get a mac' argument really hacks me off. Other than the arguments raised, I dont have to pay £25k tax to the Church of Steve Jobs for the privilege of working on PCs

The biggest reason is simply 'attack surface' and impact. Out of the 600 odd customers on my books, only a handful (<20) have macs. PCs provide the highest profile end result. I always feel really bad about having to send these people to the Apple store 30 miles away knowing they will get shafted

</soapbox>