Despite running the latest Service packed versions of Windows 8 with UAC, Windows defender, Microsoft Security Essentials along with Firefox 6 + updates, my computer became infected with a Trojan from a website which made nearly all the files on the HDD Hidden. Then Ads kept popping up for a fake AV application.

I have a removed the Trojan (I think) but my Firefox browser search has been hijacked. I have disabled all addons, ran Hijack this, Malware Bytes, the USB linux based AVG scanners and several commercial online viruses scanners which find nothing. How can I track down and remove the hijacker which I think was installed by FakeSysDef?

  • FAQ: superuser.com/q/100360/52492. – RedGrittyBrick Nov 9 '11 at 23:13
  • Thanks Ive tried most of those suggestions on there already. Im fairly sure the malware is gone from my PC but whatever is causing the search re-directs still remains. A re-install of the OS is looking likely. – Canacourse Nov 10 '11 at 11:26

Try looking in the config screen on firefox by putting about:config in your address bar.

See if any search options there have been hijacked. If searches are still being hijacked even in Windows Safe Mode and running firefox with addons disabled, you may have a rootkit.

Try ComboFix from Bleeping Computer, and TDSSKiller, and ZbotKiller from Kaspersky Virus Removal Tools usually work well for me detecting common rootkits.

  • Got with TDSSKiller in the end althought it took a few attempts to get it to even run. It wewas aroot kit. – Canacourse Dec 5 '11 at 16:56
  • nice, glad you got it. those mbr rootkits are nasty. – drew010 Dec 5 '11 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.