0

I recently had malware/virus on my Window7 pro computer. I am pretty sure it has been removed. Malwarebytes Anti-Malware no longer finds anything. And the computer is running pretty stable now. But every once in a while (I would say every couple hours) something is erasing my hosts file. I do a lot of web development. So I routinely set the host file to simulate the actual host.

The original virus was the one making it look like you had viruses and would try to hoax you into "buying" virus scanning software. But this has been removed. After this I was having issues with Internet Explorer periodically just popping up out of no where and displaying ads. I don't even use IE and instead use FireFox. I have since disabled IE. Every once in a while my browser will redirect to certain ad pages. But not often. Thought I had this nixed. But Malwarebytes not showing anything.

Any ideas?

0

2 Answers 2

6

Your computer was compromised. You obviously didn't get rid of it completely as something is still changing settings on your computer. How can you ever be sure that you got rid of it completely? How will you ever trust this computer again? With all of the fun rootkits out there, you really can't. So here's how you fix your computer:

  1. Backup all of your data
  2. Format your hard drive
  3. Reinstall Windows 7 on your computer
  4. Reinstall your software
  5. Restore your data
3
  • +1 for reinstalling. Nuke it from orbit - it's the only way to be sure. See also: serverfault.com/questions/218005 and serverfault.com/questions/107334
    – voretaq7
    Jun 19, 2011 at 1:31
  • Was afraid of that. It is SO costly to redo this computer with all the development tools. And a lot of them require you to "deactivate" your license so that you can re-activate it the next time around.
    – M Schenkel
    Jun 19, 2011 at 2:19
  • We did have to re-install everything. But it was definitely a virus.
    – M Schenkel
    Aug 3, 2011 at 17:42
0

The "original virus" may still be around or parts of it survived. It sounds like it may have accomplished some of the web "hijacks" possibly through rewriting/injecting entries into your hosts file, which may explain what you are currently describing/experiencing.

1
  • Indeed, I experience a lot of times where browser redirected to pages with lots of adds. One was something to do with Blinkx.
    – M Schenkel
    Jun 19, 2011 at 2:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .