Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Despite running the latest Service packed versions of Windows 8 with UAC, Windows defender, Microsoft Security Essentials along with Firefox 6 + updates, my computer became infected with a Trojan from a website which made nearly all the files on the HDD Hidden. Then Ads kept popping up for a fake AV application.

I have a removed the Trojan (I think) but my Firefox browser search has been hijacked. I have disabled all addons, ran Hijack this, Malware Bytes, the USB linux based AVG scanners and several commercial online viruses scanners which find nothing. How can I track down and remove the hijacker which I think was installed by FakeSysDef?

share|improve this question
    
FAQ: superuser.com/q/100360/52492. –  RedGrittyBrick Nov 9 '11 at 23:13
    
Thanks Ive tried most of those suggestions on there already. Im fairly sure the malware is gone from my PC but whatever is causing the search re-directs still remains. A re-install of the OS is looking likely. –  Canacourse Nov 10 '11 at 11:26
add comment

1 Answer 1

up vote 0 down vote accepted

Try looking in the config screen on firefox by putting about:config in your address bar.

See if any search options there have been hijacked. If searches are still being hijacked even in Windows Safe Mode and running firefox with addons disabled, you may have a rootkit.

Try ComboFix from Bleeping Computer, and TDSSKiller, and ZbotKiller from Kaspersky Virus Removal Tools usually work well for me detecting common rootkits.

share|improve this answer
    
Got with TDSSKiller in the end althought it took a few attempts to get it to even run. It wewas aroot kit. –  Canacourse Dec 5 '11 at 16:56
    
nice, glad you got it. those mbr rootkits are nasty. –  drew010 Dec 5 '11 at 17:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.