Search results forward to spam sites

FoxIX · 08 Aug 2011

I have been having this problem for a few days now and is getting quite annoying. For searches, when I click on a link I am forwarded to a spam site. This is temperamental so I cannot guess when it is or is not going to happen.

This is what I have done so far:

Un-installed and re-installed all browsers (bar IE for obvious reasons)
Run a complete virus scan using AVG
Run Malwarebyte's Anti-Malware - which picked up 7 infections
Noticed that AVG had an install date of the 5th August (when I have had it installed for over 6 months)
Un-installed using Revo uninstaller
Un-installed all programs that were installed in the past 10 days.
Attempted to install MSE but it would not install
Installed Zonealarm Internet Security Suite 2012 and ran full scan. Nothing picked up.
Ran Malwarebyte's Anti-Malware. Nothing picked up.

I am unable to do a system restore as I do not have any restore/backup points on my computer.

Can anyone suggest what else I could try?

TIA

**cluberti** · 08 Aug 2011

You could give Microsoft's Standalone System Sweeper boot disc a try and scan the machine offline to make sure it really is clean before doing anything further (because it sounds like you're still infected, potentially by something you won't be able to remove while Windows itself is online and running).

bru · 08 Aug 2011

FoxIX said:

Attempted to install MSE but it would not install

This is a tell tale sign that you are still infected. I'm surprised you were able to install other security software.

MBAM has a forum where volunteers will help clean your computer.

Borg 386 · 08 Aug 2011

First off, if this is recent, any chance that you can do a system restore to an earlier time, preferably a couple days before the infection? If not....

Try running these tools while in safe mode and disconnected from the net:

Microsoft Safety Scanner - Antivirus | Remove Spyware, Malware, Viruses Free

This is the SUPERAntiSpyware Portable Scanner, you'll be able to run it from a FD. Please note : The scanner is saved under a random filename so that malware infections won't block the scanner.

SUPERAntiSpyware.com - SUPERAntiSpyware Portable Scanner

Run Malwarebytes again, in safe mode while disconnected from the net.

Norton Power Eraser: For this tool you will need an active internet connection.

Norton Rescue Tools

Because Norton Power Eraser uses aggressive methods to detect threats, there is a risk that it can select some legitimate programs for removal. You should use this tool very carefully.

If you're unsure about any file, you can submit it to Norton for further analysis as an option from Power Eraser.

Another option is to run a AV Boot Disk.

http://www.techmixer.com/free-bootab...download-list/

Kaspersky Rescue disk hasn't played well with Windows lately, so you may wish to steer clear of it.

FoxIX · 09 Aug 2011

Thanks for all of your replies. It is very much appreciated. I have gone through all of your suggestions and worked through them one by one. Unfortunately nothing was picked up and I am still having the same problems.

Athene · 09 Aug 2011

Hi FoxIX,

You may want to go to this forum which specialises in malware removal:
Bleeping Computer - Computer Help and Discussion

You can sign up for free; you might have to wait for a little until someone helps you since the Bleeping Computer experts are kept on their toes all the time. Read the "Are you new to Bleeping Computer?" section carefully. If you decide to sign up over there, please post your system specs and describe the issues you are experiencing and which troubleshooting steps you have taken so far.

FoxIX · 09 Aug 2011

Okay, thank you. I will look into that.

brady · 09 Aug 2011

Check proxy settings in your IE:
Tools/Internet Options/Connections (tab)/Lan Settings.
Make sure your "use a proxy server" is unchecked.

Then you'll want to check your Hosts file:
C:\windows\system32\drivers\etc\hosts (open in notepad)
You can paste your hosts file here so we can take a look.

FoxIX · 09 Aug 2011

The "use a proxy server" is unchecked. The contents of my hosts file is:

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

Thanks.

brady · 09 Aug 2011

hosts is fine, most likely registry injection at this point.