Solved Need help removing redirect virus

[karlsnooks]

LenovoJon,

WIN | type MSCONFIG | ENTER | STARTUP tab |
Uncheck ALL except for:

    MSC    REG_SZ    "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
    SynTPEnh    REG_EXPAND_SZ    %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
    Sidebar    REG_SZ    C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    SUPERAntiSpyware    REG_SZ    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

REBOOT!

You have just told Win 7 to not run unchecked programs at start up time.

You have not disabled the programs. They will be run when needed.

WIN = key with the Microsoft logo on top

 

[karlsnooks]

CCLEANER | TOOLS icon | STARTUP tab | SCHEDULED TASKS tab |
Use DISABLE button to disable ALL except for:

the three Google-related taske

Close CCleaner.


REBOOT!

You have not disabled any programs. You have disabled the scheduled running.
Later, after your system is running smoothly, you may reenable desired programs.

 

[lenovojon]

It is a crack for an older version of Adobe software (long story short I'm a student and I have a legal version of Adobe but my school runs an older version so for compatibility this makes it easier) I have had that file on my computer for 6+ months with no problem, do you think it could be the problem now?

 

[karlsnooks]

UNINSTALL

Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7            1.00                                      
Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 1.00                                      
Lenovo ThinkVantage Toolbox                                                  6.0.5849.23           PC-Doctor, Inc.     
                                                                             6.0.93.2              Conexant Systems    
RapidBoot                                                                    1.12                  Lenovo              
Bonjour                                                                      3.0.0.10              Apple Inc.          
SUPERAntiSpyware                                                             5.5.1012              SUPERAntiSpyware.com

REBOOT

Leave those programs uninstalled while your system is being diagnosed.

After you have a solid system, then you may want to try to reinstall programs, one program at a time.

 

[karlsnooks]

Golden,

Good advice because somehow he is reinfecting himself.

karl

 

[karlsnooks]

It is a crack for an older version of Adobe software (long story short I'm a student and I have a legal version of Adobe but my school runs an older version so for compatibility this makes it easier) I have had that file on my computer for 6+ months with no problem, do you think it could be the problem now?

YES! Remove that crack and any other cracked software you have.

We do not assist people in using cracked, illegal, non-purchased, non-licensed software.

 

[lenovojon]

Karlsnooks,

I followed all the steps you listed then followed Golden's advise and flushed the DNS cache and restored host file. I then ran ESET and everything came back clean! It seems to be running better now, is there anything else I need to do to complete the diagnostic?

Thanks guys so much for your help!!

 

[karlsnooks]

If all is running well, then our work is done!

 

[Golden]

Don't forget to keep Java updated if you plan to reinstall it:

Java Technology Help - Installing Java

Regards,
Golden

 

[lenovojon]

Awesome, thanks again guys!!

 

[PatrickGSR94]

Same issue is happening on my home XP Pro machine, and my dad's Win7 laptop. Both of ours started exhibiting this redirect behavior after we both had that "Security Shield" fake AV software pop up. We both removed it with MBAM run in safe mode, but this redirect behavior on Google searches still exists. Have scanned with MBAM, Spybot S&D, Symantec AV Corporate, all in safe mode, and none of them find any problems.

May have to just break down and reformat the darn thing. It's probably about time to do it again anyway.

 

[lenovojon]

Well that was short lived, I ran another Malwarebytes scan today to make sure I was clear and Rootkit.Necurs popped up, will malwarebytes remove it sufficiently or will other steps need to be taken?

 

[spikey2k9]

if you can get in too windows normally open malwarebytes again update it restart boot in to safe mode and rerun the scan make sure you do the full scan and not the quick i would also recomend trying spybot search and destroy

 

[Golden]

Rootkit.Necurs

Hi,

Time for a cleam install I think - this is often the best technique to clean rootkits.

Regards,
Golden

 

[PatrickGSR94]

What about running TDSSKiller? Supposedly it can clean out root kits.

 

[lenovojon]

I was affraid of that, ok thanks.

 

[lenovojon]

When doing the clean install should I be worried about any of my backup files reinfecting my system?

 

[Golden]

Hi,

No, I don't think so - best to check though by backing up your files to an external device, and then scanning that.

Regards,
Golden