Git of a Virus

[Andy Clap]

A mate asked me to clean up his laptop for him as it was full of virus's and spyware.


It's tonnes better now, but there is one git of a virus that redirects links on search engine results and sends you to seemingly random web sites.  It does it on Google and Yahoo, haven't tried any other.


I've used all of my favorite tools (MalwareBytes, SuperAntiSpyware, AVG, eUsing) with the latest definitions and nothing has touched it.


I'm a good-amateur at this sort of stuff, but this has got me beaten.


Anyone seen similar?  There's quite a bit on the web, but too techy for me!

[b3tarev3]

Save the good stuff and then format the laptop.

[Phil TK]

That's spooky, I was going to start a thread this afternoon regarding the very same problem. It's called a 'Google Hijacker and as you say it directs you from search results to crappy search engines and sometimes it takes you to legit but unwanted websites trying to sell stuff that's related to your search.
 I regret to say that like yourself I've tried everything to get rid of it including so called 'fixes' and nothing works to date. Sometimes , if you hit your toolbar link to Google twice in succession before using, it somehow stops it redirecting but not always.

 Here's a typical 'fix' that doesn't work for me but might for you...

http://www.2-viruses.com/how-to-fix-google-results-hijacker-google-redirect-virus-problem

[Andy Clap]

Here's a typical 'fix' that doesn't work for me but might for you...

http://www.2-viruses.com/how-to-fix-google-results-hijacker-google-redirect-virus-problem

Thanks.  I was about to return his laptop but will try that first.
I would just format the drive, but he doesn't have an install disk for the OS!  XP Pro, about £35 off eBay, that's what I'll be suggesting!

[AdieR]

There was an anti-virus program available on the net ("Avast" rings a bell, I'll see if I can find a link), reputed to be better than many commercial a/v, and if memory serves it is (or was) available with (IIRC) a month free trial.
Whether it would work in your case I don't know, but maybe worth a try?

Shall have a look and see if I can find it.

[AdieR]

found it 

http://www.avast.com/free-antivirus-download

[Phil TK]

found it 

http://www.avast.com/free-antivirus-download

LOL, that's the one I've got. It didn't find anything on full scan. Neither did Spybot.

[mcyoungy]

Here's a typical 'fix' that doesn't work for me but might for you...

http://www.2-viruses.com/how-to-fix-google-results-hijacker-google-redirect-virus-problem

Thanks.  I was about to return his laptop but will try that first.
I would just format the drive, but he doesn't have an install disk for the OS!  XP Pro, about £35 off eBay, that's what I'll be suggesting!

 
XP Pro? I may have one of them............

[bmseven]

Download Hijack run it and copy and paste the result on majorgeeks. theyll sort it out

http://majorgeeks.com/download3155.html

[Andy Clap]

XP Pro? I may have one of them............

You have mail mate.


HiJack This....  I've never got on with that, too many false-negatives.  May submit a log to the user group though, so thanks.

[Fazer Jake]

Give spybot a go mate, malwarebyes should have found it mind

[Major Rant]

The following has never failed* .... and this PC has been to more dodgy sites than a Scoutmaster's Ipad  .
 
Ensure your copy of XP or whaterver is fully patched with the latest updates.
Install Microsoft Security Essentials (its free).
AND
Malwarebytes (also free).
 
Load each in turn with the latest definitions.
 
Fully scan all drives with each product - start with Security Essentials.
I have tried using AVG but it was hopeless and sucked CPU resources endlessly.
 
 
* I tell a lie ... the most recent scare-ware (the one that pretends to be from the police and asks £100 for an unlock code) required a registry edit to prevent it stopping the task manager from starting.
 
 

[Grahamm]

Try going to this page on the Symantec Site (the people who make Norton AV) and it should offer you a free remote scan of your system.

The idea is that, by doing it remotely, it stops any infection from interfering with the process.

[bmseven]

XP Pro? I may have one of them............

You have mail mate.Hijack will identify it as it is exactly that a browser Hihack

There will be a file in the registry run section  that  should not be there. If you can identify the file and then boot in safe mode and try deleting it then remove from the registry, but no doubt will try and spawn itself again!


HiJack This....  I've never got on with that, too many false-negatives.  May submit a log to the user group though, so thanks.

[YamFazMan]

Hi
Combo fix is the one I use, when nowt else works.
ATB YFM

[pointer2null]

Best and only 100% guarenteed option is to format and reinstall if you can. There may well be root kits that can't be detected or removed it if was in as bad a state as you say it was.
Otherwise, I'd go with the microsoft security essentials.

[Andy Clap]

Thanks for all the help.  I've convinced him to reformat and reinstall.


Cheers,
Andy