List of ways a malware can proxy the web traffic

Question

I am currently infected by a malware that sometimes redirect the internet traffic to another web page. I have run malwarebytes and ms security essentials and was able to clean most of them. However both programs now say my computer is clean, but obviously it's not.

For example, when I go to www.malwarebytes.org via google.com, I am redirected to http://www.stopzilla.com/. I am using Google Chrome as a browser. This behavior only seem to happen with Google Chrome (firefox and IE does not do that)

Here is the list of things I have verified:

• Removed any web proxy from Internet Options/Connections/LAN settings
• Cleaned my host file (C:\Windows\System32\Drivers\etc\HOSTS)

I also did a complete verification of the items listed in autoruns. Deleted a few Browser Helper Objects but that should not affect Chrome.

So, the only thing I know could redirect the traffic is a driver, how can I diagnose this issue? Is there other things to check?

Answer 1

I have seen an increased amount of these sorts of attacks recently - it is infection by a Rootkit.

I was able to remove it once for a client, through Rootkit Revealer, Hijack This, GMER and a bunch of other tools, but, it took over 6 hours of work (whilst doing other tasks! The scans can take ages to complete).

Quite frankly, as every single attack is different, involves several random factors, it is impossible to give a guide that will help you.

Based on my own experiences, it is quicker and more efficient in most scenarios to just reinstall everything from scratch.

What I recommend you do is use a forum such as the Malware Bytes Forum, where they have people willing to look at your logs and help you on an individual basis.

If you have a specific issue and want to paste a log here, I am sure someone will help you in a similar function here!

Answer 2

Another suggest along side with what @WilliamHilsum said would be to use Spybot Search and Destroy, Trojan Remover, and CCleaner.

I know CCleaner isn't a virus removal but it does clean out temp folders which is where some viruses live. You can also use the registry cleaner in CCleaner, BUT BE CAREFUL. I do not usually suggest using them unless you know what you are doing. But I am also the kind of person that will manually go through a registry and clean out (what I like to call) virus scars. If you don't know what something is in the registry, or don't know if it should be deleted, you most likely should not be in the registry.