1

I'm stumped. I'm up against a virus on a desktop PC that has hijcaked all search results (Google, Yahoo!, Bing, etc.) in both IE and Firefox, and it happens to both accounts that log into the machine, leading me away from being user account based. The links clicked redirect to any number of random sites. Infomash seems to be involved. The Hosts record is fine, DNS servers are fine (have tried multiple, same result), Malwarebytes and AVG and HijcakThis report nothing, putting the exact URL address or searching cached results in Google works fine. LSPfix found no problems, TDSSKiller found nothing, msconfig is fine, and both \Windows and \System32 folders show no obvious baddies based on any recent timestamp. I ran HitMan 3.5 and it reported Explorer and wininit.exe as Trojans, though I'm hesitant to remove these core files (which have original timestamps, btw). Windows 7, and I'm running out of options. Ran IE with no add-ons, same problem. I haven't tried Safe Mode yet, but I'm confident this CAN BE FIXED without reformatting. Any experience or success in fighting this? Any help would be much appreciated, and preferably no random "Automatic Virus Remover!" programs that don't tell me what they found and what they are doing. Frustrated.

Improve this question

2 Answers 2

Reset to default
1

If you have checked the DNS, hosts file and its happening in all browsers and the virus/malware scans are coming back clean. I would look into possibly a rootkit, which you should be able to detect using RootkitRevealer from Sysinternals.

http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx

Ive also seen some TLD2 Rootkit infections that do exactly what you say, redirect search results and kill malwarebytes. There is a guide and removal tool on the malwarebytes forums.

http://forums.malwarebytes.org/index.php?showtopic=12709

-- And if it indeed is a Rootkit, the only sure-fire way to know its gone, is to reformat the hard drive.

Improve this answer
2
  • 1
    Thanks for the knowledge. I will give it a go and let you know the outcome.
    – Silky
    Oct 15, 2010 at 2:38
  • 1
    Well, RootkitRevealer does not run on Windows 7, and RootRepealer (from the Malwarebytes site) never ran correctly, as it continuously had a FOPS-IODevice error. I tried replacing Explorer.exe and wininit.exe to no avail (actually got BSODs), and Last Known Good Configuration got me to a place where Firefox search results where fine, but as soon as I launched IE and did a search, both browsers had hijacked search results. It seems it was activated once IE was launched, but its too late now. Going to run a Windows Repair with the original disk, and if still no luck, its reformat time.
    – Silky
    Oct 21, 2010 at 14:07
1

Well, I never tracked down exactly what the the virus was called, but I did fix it. Hitman 3.5 was instrumental in identifying both Explorer.exe and wininit.exe as problematic, and so for good measure, I replaced those two files, as well as tcpmon.dll, tcpmon.ini, and tcpmonui.dll with originals from a Windows 7 installation DVD. All files were in \system32, except Explorer, which is in \Windows. I used 7-zip to extract the files from within the source folder, as is spelled out here: http://blog.nirsoft.net/2009/09/17/how-to-extract-missing-system-files-from-the-dvd-of-windows-7vista/

After a reboot, I was able to click on search results with no issues, and subsequent scans came up clean.

Thanks for the help anyway, though RootRepealer never worked, and Rootkit Revelear doesn't work on Win 7. This one was a nasty one.....curse you InfoMash!!!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .