OK, so I ran the following programs:
TDSSKiller.exe (found nothing)
Norton Power Erase (found three items and deleted them)
SuperAntiSpyware (in addition to Adware, found a trojan, deleted it)
Then I ran the DDS script. The logs are here:
http://mikeandersonlaw.com/DDS.txt
http://mikeandersonlaw.com/Attach.txt
Any help is much appreciated.
Thanks
I read somewhere that those viruses recogize TDDSKiller and the advice given was to rename it, to e.g. abc.com
(the .com has to be added!), and run it again.
Have a look at
How To Easily Remove Google Redirect Virus
But Borg386 has a point. Start from scratch if all else fails.
Another thing. An expert once said to always wait 30 seconds after shutting down the computer before rebooting.
I cannot by any means judge this advice but it's easy to follow without any problems, just don't hit the "restart"
button.
DAMMIT... Still infected... I've tried everything suggested here save for re-installing Windows.
I'm going to give Avast a try -- it seems to have detected a number of files the other programs missed. But if that doesn't work, I guess I've got no choice but to re-install.
This is really depressing. I'd never have thought the virus makers could be so clever as to outwit a dozen different detection/elimination solutions, but it appears that way.
Have a look at
Microsoft Safety Scanner - Free online tool for PC health and safety
You have to download MSERT (about 70MB!) and then run it (full scan). It is not installed but stays in Documents(Downloads) and expires after 10 days.
It may do the trick but..... it seems you've really got a problem. A clean install may be the only option left.
There is also a tutorial on this forum by Brink about this Microsoft Security Scanner.
You may want to read it first.
Do you know what these are?
C:\Users\Mike\AppData\Roaming\Wopo
C:\Users\Mike\AppData\Roaming\Hyyd
Copy and paste these lines in Note pad.
@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0
Save as flush.bat to your desktop.
Double click on the flush.bat file to run it.Vista and Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Updating Java:
- Download the latest version of Java Runtime Environment (JRE) 7[/B].
Java SE Downloads- Scroll down to where it says "Java Runtime Environment (JRE) 7u1 allows end-users to run Java applications".
- Click the "Download" button to the right.
- Check the box that says: "Accept License Agreement".
- The page will refresh.
- Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
- Close any programs you may have running - especially your web browser.
- Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
- Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button.
- Repeat as many times as necessary to remove each Java versions.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on jre-7u1-windows-i586-p.exe to install the newest version.
After doing the above, let me know if you're still being redirected
OKAY....
So I've run Avast scan at boot, and I ran MSERT (took about 10 hours to scan), also the flush.bat file (I did that earlier in the thread, but I just did it again), updated Java, ran Avast scan at boot again, and ran Norton Power Erase one more time (with rootkit scan) for good measure.
All the scans are no longer finding any problem files. Man, I feel like I've done nothing all week except run scans...
I've also switched from Firefox to Chrome.
So we'll see. Will report back.
Quote