Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently had malware/virus on my Window7 pro computer. I am pretty sure it has been removed. Malwarebytes Anti-Malware no longer finds anything. And the computer is running pretty stable now. But every once in a while (I would say every couple hours) something is erasing my hosts file. I do a lot of web development. So I routinely set the host file to simulate the actual host.

The original virus was the one making it look like you had viruses and would try to hoax you into "buying" virus scanning software. But this has been removed. After this I was having issues with Internet Explorer periodically just popping up out of no where and displaying ads. I don't even use IE and instead use FireFox. I have since disabled IE. Every once in a while my browser will redirect to certain ad pages. But not often. Thought I had this nixed. But Malwarebytes not showing anything.

Any ideas?

share|improve this question

migrated from serverfault.com Jun 19 '11 at 3:58

This question came from our site for professional system and network administrators.

1  
You have a tendency to post off topic questions here on Server Fault. Several of them have been migrated to Super User, but it appears that you have never directly posted a question there. I recommend you check out SuperUser.com as many of your questions fit that community far better than this community. –  Jason Berg Jun 19 '11 at 1:30
    
Ok - thanks for pointing that out. I will try better to align my questions with the proper venue. –  M Schenkel Jun 19 '11 at 2:15
add comment

3 Answers

up vote 5 down vote accepted

Your computer was compromised. You obviously didn't get rid of it completely as something is still changing settings on your computer. How can you ever be sure that you got rid of it completely? How will you ever trust this computer again? With all of the fun rootkits out there, you really can't. So here's how you fix your computer:

  1. Backup all of your data
  2. Format your hard drive
  3. Reinstall Windows 7 on your computer
  4. Reinstall your software
  5. Restore your data
share|improve this answer
    
+1 for reinstalling. Nuke it from orbit - it's the only way to be sure. See also: serverfault.com/questions/218005 and serverfault.com/questions/107334 –  voretaq7 Jun 19 '11 at 1:31
    
Was afraid of that. It is SO costly to redo this computer with all the development tools. And a lot of them require you to "deactivate" your license so that you can re-activate it the next time around. –  M Schenkel Jun 19 '11 at 2:19
    
We did have to re-install everything. But it was definitely a virus. –  M Schenkel Aug 3 '11 at 17:42
add comment

The "original virus" may still be around or parts of it survived. It sounds like it may have accomplished some of the web "hijacks" possibly through rewriting/injecting entries into your hosts file, which may explain what you are currently describing/experiencing.

share|improve this answer
    
Indeed, I experience a lot of times where browser redirected to pages with lots of adds. One was something to do with Blinkx. –  M Schenkel Jun 19 '11 at 2:18
add comment

Whenever I run into these types of problems, ComboFix always resolves the problem for me. It removes Sypware/Malware. I suggest you give it a shot:

http://combofix.org/

Let me know if it works for you!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.