Computer is infected with spyware, cannot even uninstall Internet Explorer

Question

Whenever I try a Google search, I am redirected to this site or something similar:

http://www.allthebrands.com/search-results.aspx?q=remover+spyware

In the past, I have been able to install spywareblaster and other tools to solve the problem. In dire situations I have used Hijack This and been able to solve the problem and move on.

Today, having spent over 8 hours trying to solve this problem, I feel clueless. It opens up Internet Explorer. I went to my Program/Features to Uninstall Internet Explorer but it doesn't appear in my list of programs. Then I went ahead and installed IE 8. Still no luck or solution.

What can I do for a clean bill of Windows PC health?

Answer 1

Install Ubuntu or some other Linux distro.

What? Downvoted? This solution works, I've tried it...

But OK. Some spyware tips:

• Prevention is better than cure.
  • Don't use IE; since it's the most common browser it's the most likely to be targeted by spyware trying to exploit security vulnerabilities. My browser of choice is Opera but Firefox is good too.
  • Be careful where you browse. If you're browsing "dubious" sites, turn up your browser security. (Many people use a different browser altogether for such browsing.)
• Check that your DNS servers haven't been overridden. This is a sneaky way to make strange things happen to your web browsing. (Some spyware changes your DNS servers to some dodgy ones.)
• Check your C:\WINDOWS\system32\drivers\etc\hosts file too.
• HijackThis will find all the "run on startup" crap in your registry, I believe. But I stumbled upon a trojan that hid itself in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs and so wormed its way into heaps of places.
• Sometimes "System Restore" can help. I don't find it very useful but it's worth a try.
• Many Windows admins have a practice of re-installing Windows (or rather, restore from a backup made just after installation) every few months or so. This helps keep them clean and fast. Maybe it's time you back up your stuff and reinstall.

Answer 2

a few things i'd suggest, aside from the good old nuke and pave

In this order 1) an offline virus scan - Avira has one i've used before 2) follow that up with malwarebytes http://www.malwarebytes.org/ 3) get a windows install disk and run sfc /scannow to replace any system files that might have needed to be removed

Answer 3

You'd better spend 8 hours trying to figure out how your computer gets infected, so you could take some steps to deal with that directly. Waiting to get infected and trying to fix it then is a bad strategy.

Answer 4

Another alternative is to install Firefox and use NoScript to help the malware out.

Answer 5

I'd recommend you back up your data (if you haven't already) and reformat. After that, download and install Firefox and never use Internet Explorer again. For additional security, install Microsoft Security Essentials; it's a good antivirus that won't slow down your computer.

Answer 6

Should you want to use your computer for online banking or shopping, you really should consider holding off until you get another operating system. I'm forced to agree with Artelius.

Until then, Firefox for browsing & possibly Thunderbird for mail might keep you safer. Consider two copies of Firefox, one with Java, JavaScript, popups, plugins, &c turned off, and running the Finjan extension: this is the one for general browsing. Then you can have one with all turned on & running Flash, &c for safe sites in your bookmarks. Safe sites have safe hyperlinks. I would start with

http://www.en.Wikipedia.org/

and use their hyperlinks, not typing in your own.

Keep all frills turned off in Thunderbird, automatically set letters from anyone you haven't mailed as Junk, and have these moved automatically to a Junk folder. You can examine this with Java, JavaScript, & even images turned off; certainly refuse to connect to hyperlinks, visible or not (web bugs). You can mark a letter as not Junk, move it back, & turn on features to read it. Ask friends to create mailing lists properly, without your name on it. (Whoever cracks one machine gets all addresses.)

When I first install Linux or MacOSX, I turn off features I'm not using, turn on a firewall, & wait until all security mechanisms are running before connecting to the internet. This is for everyone: www.debian.org/doc/manuals/securing-debian-howto/index.en.html.

Then I immediately installed 'snort' to protect me while browsing the web, and 'clamav' to instantly check my mail as it plops into my mailboxes. Each program updates its database daily, and I disconnect the network when not using the computer, and shut it down at night. I made each secirity program throw instant warnings on the monitor & speaker. It's better to keep malware out than remove it after it's done its damage. It can sometimes be difficult to get instant warnings, for you'll be using only a regular (not administrator's) account, unless installing applications for all.

Only when these are working well would I connect an internet bank to a local account in which I keep little, for shopping. Mac laptops have extra security features, for network & physical theft.

Answer 7

Some thoughts, in no particular order:

If your PC isn't beyond the point of no return, try at least one virus scan. Here's a few:

• AVG
• HouseCall *(Online)
• Avira

Depending on the severity of the infection, backing up your media - or moving it to a secondary hard drive if you have one - and formatting with a fresh install of Windows may be prudent.

As others have said, use Firefox instead of Internet Explorer. Besides the security, Firefox is just better. If you absolutely have to put yourself in danger on a malignant website, apply NoScript to your browser.

Good luck on recovering your PC.

Answer 8

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

I used this for the same problem and it fixed it.

Answer 9

One point: you probably would not have this problem if you had used either Firefox 3.x or Internet Explorer v8. Both have the ability to look up known malware sites in an online database and warn you before going there.

Answer 10

Just want to remark that my answer above was medium- and long-term, and that others have stressed the importance of a good backup strategy. Here are some immediate suggestions, though I don't use Windows.

Geek's point is very well taken, though CodingJoy is using Windows. :-) From USCERT:

'Microsoft Releases Advance Notification for November Security Bulletin added November 5, 2009 at 04:17 pm

'Microsoft has issued a Security Bulletin Advance Notification indicating that its November release cycle will contain six bulletins, three of which will have a severity rating of Critical. The notification states that these Critical bulletins are for Microsoft Windows. There will also be three important bulletins for Microsoft Windows and Microsoft Office. Release of these bulletins is scheduled for Tuesday, November 10.

'US-CERT will provide additional information as it becomes available.'

My immediate advice is always to change one's important passwords (bank, PayPal, Amazon) by way of a secure computer, then take yours to a consultant. They charge about $30 to use three or four of the best malware programs. You are likely to find more adware, spyware, & other malware than you think.

This problem sounds like a relatively innocuous variant of the old ZLOB trojan horse, usually propogated by clicking on a site's hyperlink to install a movie codec. (Always go to the site, such as Adobe, yourself.) However, always plan on the worst: the original stole passwords.

http://en.wikipedia.org/wiki/Zlob

If Firefox still points you to 'allthebrands', manually edit your DNS (domain name server) ip address during your session. (Sometimes a running program will change it back.)

CarlF's suggestion has been implemented. Judging by SpamCop's ever-changing list, one needs to identify the site, report the site (which Google has implemented), and a search engine can, well, do something. It's not as easy as SPAM. Legitimate sites can be compromised with web bugs. Finjan has a 'bot' run through the site before you do. Suspect sites that prohibit this.

Here's a popular site for malware specialists, with instructions. www.geekstogo.com/forum/Virus-Spyware-Trojan-Removal-f37.html