0

I've been asked to fix a laptop, which has had at least some malware (I think it's called Andromeda or similar) and at least 1 trojan.

Please note this is a home used laptop, it's not used for work and I'm fixing it at my home.

I have removed their trial of McAfee and replaced it with BitDefender Internet Security 2015 on their W8.1 machine.

BitDefender realized there were issues and informs me it has fixed then.

I also removed the Andromenda from the preferred search engines in IE and Chrome.

However, the issue is now that if I load a site which isn't SSL it works. So, www.bing.com works fine. However if I then click from the bing search results to a page with SSL, it renders the page without the CSS (and images). This means I can't use Google, which is their preferred search engine.

When loading an SSL site using Chrome, I get a very scarey message that it's not safe or secure and that attackers could do something nasty! According to the Chrome site, this means:

The site uses SSL, but Google Chrome has detected either high-risk insecure content on the page or problems with the site's certificate. Do not enter sensitive information on this page. Invalid certificate or other serious https issues could indicate that someone is attempting to tamper with your connection to the site.

The computers time and date are correct.

There is no option to re-install the OS sadly. They have a cat which has clawed the cert on the underside of the computer!

I'm not sure what I can do to fix this SSL issue in all the main browsers...

1 Answer 1

1

Hard to say with just this few details, but they might have changed the DNS servers on the system or even on the router so that it sends you to the wrong hosts when you enter the correct name. See also http://www.pcworld.com/article/2602040/attack-hijacks-dns-settings-on-home-routers-in-brazil.html.

Because the router might be affected I would suggest to check the network first with a clean system (Linux Live system or another computer).

There is no option to re-install the OS sadly. They have a cat which has clawed the cert on the underside of the computer!

There are ways to extract the windows serial number and other licences from a running system (just google). I would definitely recommend to re-install the system (after you've checked that the network is not affected).

3
  • Hmmm... Good point about the DNS, I will check when I'm home, thank you. Although I don't think the router has anything to do with this, other PC's at home work fine. Is there any other detail you think I need to include? Nov 5, 2014 at 10:26
  • If the other hosts on the network work fine the router is probably not the issue. Another issue where certificate checking can go wrong is when the systems time is too much in the future or past. Nov 5, 2014 at 10:34
  • My post explains the time and date are correct. However, I've asked my wife to do an IPCONFIG - the default gateway is fine, the DNS is 'media disconnected' ?! So , I'm a little lost as I'd expect it to show the same number as the router but, at least I can work on it when I get home... Nov 5, 2014 at 10:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .