Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am currently infected by a malware that sometimes redirect the internet traffic to another web page. I have run malwarebytes and ms security essentials and was able to clean most of them. However both programs now say my computer is clean, but obviously it's not.

For example, when I go to www.malwarebytes.org via google.com, I am redirected to http://www.stopzilla.com/. I am using Google Chrome as a browser. This behavior only seem to happen with Google Chrome (firefox and IE does not do that)

Here is the list of things I have verified:

  • Removed any web proxy from Internet Options/Connections/LAN settings
  • Cleaned my host file (C:\Windows\System32\Drivers\etc\HOSTS)

I also did a complete verification of the items listed in autoruns. Deleted a few Browser Helper Objects but that should not affect Chrome.

So, the only thing I know could redirect the traffic is a driver, how can I diagnose this issue? Is there other things to check?

share|improve this question
    
Good luck, cleaning up a compromised machine can be painful. If I were you, I'd very much consider just doing a fresh install and then locking it down - I can't really even trust a machine that's been compromised. –  Doc Aug 9 '11 at 17:24

2 Answers 2

up vote 2 down vote accepted

I have seen an increased amount of these sorts of attacks recently - it is infection by a Rootkit.

I was able to remove it once for a client, through Rootkit Revealer, Hijack This, GMER and a bunch of other tools, but, it took over 6 hours of work (whilst doing other tasks! The scans can take ages to complete).

Quite frankly, as every single attack is different, involves several random factors, it is impossible to give a guide that will help you.

Based on my own experiences, it is quicker and more efficient in most scenarios to just reinstall everything from scratch.

What I recommend you do is use a forum such as the Malware Bytes Forum, where they have people willing to look at your logs and help you on an individual basis.

If you have a specific issue and want to paste a log here, I am sure someone will help you in a similar function here!

share|improve this answer
    
Thank you William, I had the TDL4 rootkit on my MBR (detected by GMER). I found a way to remove it, but unfortunately, I still have the redirect issue. I will keep you posted. –  decasteljau Aug 10 '11 at 17:21
    
I also found that uninstalling chrome and re-installing it, fixed the redirect issue I had. It looks like the chrome binary files were modified by the virus. –  decasteljau Aug 15 '11 at 13:24

Another suggest along side with what @WilliamHilsum said would be to use Spybot Search and Destroy, Trojan Remover, and CCleaner.

I know CCleaner isn't a virus removal but it does clean out temp folders which is where some viruses live. You can also use the registry cleaner in CCleaner, BUT BE CAREFUL. I do not usually suggest using them unless you know what you are doing. But I am also the kind of person that will manually go through a registry and clean out (what I like to call) virus scars. If you don't know what something is in the registry, or don't know if it should be deleted, you most likely should not be in the registry.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.