Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Despite running the latest Service packed versions of Windows 8 with UAC, Windows defender, Microsoft Security Essentials along with Firefox 6 + updates, my computer became infected with a Trojan from a website which made nearly all the files on the HDD Hidden. Then Ads kept popping up for a fake AV application.

I have a removed the Trojan (I think) but my Firefox browser search has been hijacked. I have disabled all addons, ran Hijack this, Malware Bytes, the USB linux based AVG scanners and several commercial online viruses scanners which find nothing. How can I track down and remove the hijacker which I think was installed by FakeSysDef?

share|improve this question
FAQ: – RedGrittyBrick Nov 9 '11 at 23:13
Thanks Ive tried most of those suggestions on there already. Im fairly sure the malware is gone from my PC but whatever is causing the search re-directs still remains. A re-install of the OS is looking likely. – Canacourse Nov 10 '11 at 11:26
up vote 0 down vote accepted

Try looking in the config screen on firefox by putting about:config in your address bar.

See if any search options there have been hijacked. If searches are still being hijacked even in Windows Safe Mode and running firefox with addons disabled, you may have a rootkit.

Try ComboFix from Bleeping Computer, and TDSSKiller, and ZbotKiller from Kaspersky Virus Removal Tools usually work well for me detecting common rootkits.

share|improve this answer
Got with TDSSKiller in the end althought it took a few attempts to get it to even run. It wewas aroot kit. – Canacourse Dec 5 '11 at 16:56
nice, glad you got it. those mbr rootkits are nasty. – drew010 Dec 5 '11 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .