TechSpot

Google redirect virus

By loannlam
Dec 6, 2009
  1. I have a nasty redirect virus. When I use google/yahoo or any search engine to search, the links found are redirected to other unwanted sites. How do I remove and clean the virus? Also, it takes longer to boot up the computer and it runs a lot slower. Attached are my logs. Please HELP!
     
  2. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    You have both McAfee and Avira Antivirus installed
    I'm unsure which one you acually want, but if its Avira (here's hoping)
    Then uninstall McAfee and then run the McAfee removal tool
    Restart

    Run IE Reset Fixit Tool:
    [​IMG]
    Or manually from here http://www.techspot.com/vb/post682762-2.html
    Then restart Internet Explorer

    Then run a full updated scan with Avira
     
  3. loannlam

    loannlam TS Rookie Topic Starter

    I removed Avira Antivirus.

    I ran a quick updated scan with McAfee. Nothing was detected.

    Still have redirecting problem.
     
  4. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Please run ESET Online Scanner: http://www.eset.com/onlinescan/

    You should disable McAfee during the scan

    Please provide the log report from Eset as an attachment
    Then restart and provide a fresh HJT scan log as an attachment
     
  5. loannlam

    loannlam TS Rookie Topic Starter

    kimsland

    I forgot to mention...before the redirect virus, I was hit with Antivirus System Pro. I removed the virus by doing a system restore...then I discovered I have problem with redirecting when doing google/yahoo searches.

    Do I need to reset system restore point?
     
  6. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Well System Restore is usually the first place that is infected by Malware
    Actually at the end of confirming your system is clean we actually remove all System Restore points, by unchecking it and applying, then re-checking it, in System in Control Panel,

    You can uninstall SUPERAntiSpyware now as well (done in Add/Remove Programs in Control Panel)

    Combofix:
    • Download [​IMG]Combofix to your desktop.
    • Disable your Antivirus (as Combofix will remove any found malwares)
    • Double click ComboFix & follow the prompts.
    • A window will open with a warning.
    • When the scan completes it will open a text window. Please attach that log back here
    Also restart and provide a fresh HJT Scan log
     
  7. loannlam

    loannlam TS Rookie Topic Starter

    kimsland

    I uninstalled SUPERAntiSpyware and ran ComboFix and HJT . Attached are the logs.

    I did a few searches and the links seem not redirect anymore. Did the ComboFix remove the virus? Is my system clean of viruses?

    Should I clean out the system restore point?
     
  8. loannlam

    loannlam TS Rookie Topic Starter

    Opps...forgot to attach the logs. Here they are.
     

    Attached Files:

  9. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    McAfee has so many entries its annoying :D

    Anyway, the logs look clean, and Combofix got rid of more stuff
    I was going to mention a Vundo scan, but I don't think its required

    Un-install Combofix
    • Click START then RUN
    • Now type Combofix /uninstall in the runbox and click OK
    • Any popup errors about Antivirus just ok or close
    Note: 1 space after ComboFix in that uninstall command

    Clear & Reset System Restore's Cache
    Go to Start >> Run - type or copy/paste control sysdm.cpl,,4 and then press Enter
    • Tick on the checkbox - Turn off System Restore on all drives
    • Click Apply
    Turn it back 'On' by unticking the same checkbox & click Apply, and then OK
     
  10. loannlam

    loannlam TS Rookie Topic Starter

    I did a scan with CA Yahoo! Anti Spy and it said I have Bifrost, WinAntiVirus Pro 2006, and WinSpywareProtect that ComboFix did fix or remove. Are those viruses? I did a quick scan with Malwarebytes Anti-Malware, but it did not detect anything.

    How do I identify and close non essential programs that don't load with Windows? My computer takes longer to load up than it used to.

    Attached are recent HJT and mbam logs.
     
  11. loannlam

    loannlam TS Rookie Topic Starter

    kimsland

    I did a scan with CA Yahoo! Anti Spy and it said I have Bifrost, WinAntiVirus Pro 2006, and WinSpywareProtect that ComboFiX DID NOT fix or remove. Are those viruses? I did a quick scan with Malwarebytes Anti-Malware, but it did not detect anything.

    How do I identify and close non essential programs that don't load with Windows? My computer takes longer to load up than it used to.
     
  12. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Malwarebytes Anti Malware (updated first) will remove those
    So not sure why it hasn't :confused:

    There's removal instructions here for: WinAntiVirus Pro http://www.411-spyware.com/remove-winantivirus-pro-2006#deletefiles

    And removal instructions here for: WinSpywareProtect http://www.411-spyware.com/win32-galorion-family-removal#deletefiles



    Currently I'm reading the logs to work out what happened

    Edit:

    Well your Malwarebytes database is 1 day old, but that should not have mattered

    Edit2:

    Can you provide the log from CA Yahoo Anti-Spy

    Edit3:

    Its not in the logs, therefore I need the log from CA Yahoo Anti-Spy
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...