I'm stumped. I'm up against a virus on a desktop PC that has hijcaked all search results (Google, Yahoo!, Bing, etc.) in both IE and Firefox, and it happens to both accounts that log into the machine, leading me away from being user account based. The links clicked redirect to any number of random sites. Infomash seems to be involved. The Hosts record is fine, DNS servers are fine (have tried multiple, same result), Malwarebytes and AVG and HijcakThis report nothing, putting the exact URL address or searching cached results in Google works fine. LSPfix found no problems, TDSSKiller found nothing, msconfig is fine, and both \Windows and \System32 folders show no obvious baddies based on any recent timestamp. I ran HitMan 3.5 and it reported Explorer and wininit.exe as Trojans, though I'm hesitant to remove these core files (which have original timestamps, btw). Windows 7, and I'm running out of options. Ran IE with no add-ons, same problem. I haven't tried Safe Mode yet, but I'm confident this CAN BE FIXED without reformatting. Any experience or success in fighting this? Any help would be much appreciated, and preferably no random "Automatic Virus Remover!" programs that don't tell me what they found and what they are doing. Frustrated.
If you have checked the DNS, hosts file and its happening in all browsers and the virus/malware scans are coming back clean. I would look into possibly a rootkit, which you should be able to detect using RootkitRevealer from Sysinternals.
Ive also seen some TLD2 Rootkit infections that do exactly what you say, redirect search results and kill malwarebytes. There is a guide and removal tool on the malwarebytes forums.
-- And if it indeed is a Rootkit, the only sure-fire way to know its gone, is to reformat the hard drive.
Well, I never tracked down exactly what the the virus was called, but I did fix it. Hitman 3.5 was instrumental in identifying both Explorer.exe and wininit.exe as problematic, and so for good measure, I replaced those two files, as well as tcpmon.dll, tcpmon.ini, and tcpmonui.dll with originals from a Windows 7 installation DVD. All files were in \system32, except Explorer, which is in \Windows. I used 7-zip to extract the files from within the source folder, as is spelled out here: http://blog.nirsoft.net/2009/09/17/how-to-extract-missing-system-files-from-the-dvd-of-windows-7vista/
After a reboot, I was able to click on search results with no issues, and subsequent scans came up clean.
Thanks for the help anyway, though RootRepealer never worked, and Rootkit Revelear doesn't work on Win 7. This one was a nasty one.....curse you InfoMash!!!