Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

Hello,

My wife has recently complained about Youtube constantly asking for surveys. Yesterday, I decided to investigate when she mentioned it again. It seems that a website has redirected randomly requests for Youtube to videogewinner.net. It seems like the register of the website lives in Honduras.

When it does happen, it goes straight to videogewinner, seemingly bypassing Youtube entirely.

It doesn't happen every time. She uses Google Chrome. She is running Windows Vista x64 Ultimate. I haven't tried any other browsers.

My next step should probably be to check other browsers to see if it is something infecting Chrome. I would like your advice as to any other places I could check (possibly a virus?).

share|improve this question

marked as duplicate by BloodPhilia, studiohack Mar 13 '11 at 19:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3 Answers 3

Check the hosts file (located in C:\Windows\System32\drivers\etc). There should be entries with an IP address then a space with a domain name. See if you can find anything in there regarding youtube. If there is, remove it. Don't remove any other entries, though!

After that, I would suggest using SpyBot S&D and using their Immunize feature. It can help prevent these kinds of issues. Do a clean as well to clean anything else.

share|improve this answer
    
But if the hosts file is edited, redirection would happen every time (unless the site does some redirections of its own). –  AndrejaKo Mar 13 '11 at 16:54
    
I checked the hosts file anyway, and it is clean. I will try SpyBot today. –  Knossos Mar 13 '11 at 16:57
2  
Also have a look - What to do if my computer is infected by a virus or a malware? –  Sathya Mar 13 '11 at 17:02

Follow the order given below to disinfect your PC

1.) On a PC that is Not infected, Make a boot AV disc then boot from the disc on the Infected PC and scan the hard drive, remove any infections it finds, I prefer the Kaspersky disc myself. The New 2010 Kaspersky disc can update the AV dat files if you are connected to the internet at the time of scan and is suggested to update before the scan.

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

2.) Then: Install free MBAM, run the program and go to the Update tab and update it, then go to the Scanner Tab and do a quick scan, select and remove anything it finds.

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

3.) When MBAM is done install SAS free version, run a quick scan, remove what it automatically selects. http://www.superantispyware.com/download.html

These last 2 are not AV softwares like Norton, they are on demand scanners that only scan for nasties when you run the program and will not interfere with your installed AV, these can be run once a day or week to ensure you are not infected. Be sure you update them before each daily-weekly scan.

.

share|improve this answer
    
Although this is a useful answer, we have a community wiki to describe how to perform a disinfection. Please feel free to add your own method or edit the answers already given to suit your method. Please refer the OP of questions about disinfection to this community wiki and close to vote as a duplicate if you can and if it is appropriate. –  BloodPhilia Mar 13 '11 at 19:20
    
@ BloodPhilia, I already had a post there, I did modify it, thanks. –  Moab Mar 18 '11 at 15:18

Running malware scanners is an obvious leap, but I would be more interested in specifically investing what’s happening. Given the symptoms listed, I would suspect some in-browser JavaScript, or maybe hijacking or possibly DNS cache poisoning. Here are some things to try in order of ease and work and time required.

  1. As you said, check other browsers (IE should already be installed, so give that a test)
  2. Is it happening for other popular sites (eg FaceBook, etc.)?
  3. Restart the browser (open Task Manager and make sure there are no instances of Chrome.exe)
  4. Clear the cache and optionally cookies (Ctrl+Shift+Del) to get rid of any potentially bad items
  5. Open the Extensions page (chrome://extensions) and inspect at what is installed, try disabling each
  6. Open the Plugins page (chrome://plugins) and inspect at what is installed, try disabling each
  7. Check the Search Engines (right-click the OmniBar -> Edit…), see if there is a bad YouTube entry
  8. Test some of the options (Wrench->Under the Hood):
    1. try disabling DNS prefecthing
    2. make sure phising-protection is enabled
    3. try disabling the first two options
  9. Check the proxy (Under the Hood); maybe you’re connecting through a bad server
  10. Check the system network settings: are the settings (especially DNS server) correct?
  11. Stop any DNS cache poisoning: open elevated command-prompt, then run ipconfig /flushdns
  12. Examine what else is running on the system, quit everything you can (check Autoruns)
  13. Test for other hijacking (run HiJackThis) and look for YouTube or DNS related items

You’ll want to make sure to (fully) restart the browser after browser changes (1-9), and restart the system after system-wide changes (10-13).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.