Possible Duplicate:
How do I get rid of malicious spyware, malware, viruses or rootkits from my PC?

In both IE and Chrome, large ads appear in the lower right corner of the browser window. Sometime they look reputable like for Microsoft, but sometimes they are big flashing boxes that say "You have won". Right now I am looking at "Need to lose 30 lbs?" I ran Microsofot Security Essentials and it didn't find anything. I then ran Windows Defender Offline (boot from CD). WDO found five things lincluding browser hijack that caused the wrong page to appear after clicking a link. It reported that it cleaned successfully, after which I ran a quick scan to confirm. After rebooting I still see the ads. Do I still have an infection? Any other tools to try? What about ComboFix? Thanks

Update: Here's a screenshot - on superuser

I'm a winner!


I had the same problem with all of my browsers: IE, Firefox, and Chrome. Ads would rise up in the lower left and lower right hand corners of my browser window (box or cellphone shape) on random sites. I scanned my computer unsuccessfully with malwarebytes (free), microsoft malicious software removal tool (free), and mcafee (enterprise). nothing was detected and it was maddening. I also recently scanned with Microsoft Security essentials (free).

For online resolutions: I read that combofix.exe works in a malwarebytes forum, however this program requires you to disable security scanners before running, and I am unable to do that on my laptop. I also read several scans to try on bleepingcomputer; I tried several already (listed in first paragraph) so I jumped to RogueKiller (which worked for the user posting there). This scanner notified me that my host file was redirecting google-analytics. it attempted to resolve, but it didn't maintain its fix after a reboot (ie. ads kept rising up; another scan shows host file still corrupted**).

For an interim work around: I blocked access to google-analytics.com on my router and the ads went away. I originally found this by trial and error using chrome's inspect element. Other sites I am still blocking but only removed the internal ad and not the ad box/cellphone itself are: bluekai.com, edgesuite.net, find-allyouneed.com, fwmrm.net, xtendmedia.com, yieldmanager.com; because of the RougueKiller scan**, I have also added statcounter.com and doubleclick.net

My ultimate solution: I found another resource on an independent website: jaysonjc.com that had the identical problem as I describe. Exactly as he describes his symptoms, it turns out that my host file was hidden and read only with the dns redirects listed below (additional detail in the website I reference). Although he resolved with a login as administrator and an edit of his host file (which would work), I did the following as a user with admin privileges:

  1. In the parent directory C:\Windows\System32\drivers\ I renamed .\etc to .\etc2
  2. I created a new .\etc directory in the parent
  3. I copied the visible contents from .\etc2 to the new .\etc (i.e. don't copy the hidden host file!)
  4. I created a new hosts file (in my case, I used the stranded hosts.txt that was sitting in there; be sure to remove the .txt file extension).

I then rebooted and scanned using RogueKiller. End result: no more dns redirects detected. Please note: you may have this symptom as well, however this is somehow caused by something that resides on your system (simda, adware, etc; see the jaysonjc.com website I reference above). I just don't recall ever seeing any detection. Regardless, I would suggest some of the scans I list in the first paragraph... get whatever it is off of your pc, then remove the entries from your hidden host file.

Seems simple now, but it took a while. I hope this helps. good luck.

** for additional reference, here are the entries in my host file that would not go away according to RougueKiller (FYI: I do not see these when editing the hosts file in notepad): www.google-analytics.com. ad-emea.doubleclick.net. www.statcounter.com. www.google-analytics.com. ad-emea.doubleclick.net. www.statcounter.com.
  • I ran ComboFix and found some entries in startup that I hadn't seen before: c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\ezSharedSvcHost.exe ezSharedSvcHost.exe does not have a company or verified signature in process explorer. I renamed ezSharedSvcHost.exe to ezSharedSvcHost.exe.hide and then created a dummy ezSharedSvcHost.exe and marked it read only This seems to get rid of the popup in the lower right hand corder of the browser and he browser redirect. – BrianK Oct 6 '12 at 13:20

It is usually advisable to run a number of on -demand malware scanners as they seem to pick up different items from each other. MalwareBytes and Spybot Search And Destroy are the ones I usually run. Run full scans with them both to see if they can collectively delete whateveris on the PC.

Additionally, do you have access to another PC that you can attach your hardrive to? It might be useful to be able to scan this drive from another machine that is treating it as just a USB drive rather than actually running the software on that disk. It should stop any potential root-kits from being active and able to hide their files.

  • I haven't tried taking the drive out and accessing it externally. Thanks for the idea. – BrianK May 31 '12 at 13:26

Since you seem to have done basic malware checks which have come out clean, are you sure its not javascript injection by your ISP?

Can you try on a different computer connected to your internet connection, OR your computer connected to a different internet connection

  • Other machines on the same connection are fine. The fact that sometimes links were getting hijacked, pluss the adds makes me think its the Alureon trojan or something along those lines – BrianK May 31 '12 at 13:27

Give MalwareBytes a try: http://www.malwarebytes.org/
the free version should be fine

I assume you may have mistagged this, it is likely just malware(not a rootkit)
also which version of Windows are you on?

  • Windows 7. I have run Malware Bytes and Microsoft security esssentials and they come out clean. – BrianK May 31 '12 at 13:26

Just run Combofix, you can download it from: http://www.bleepingcomputer.com/download/combofix/

When you run it, it will temporarily disable your antivirus (if one is running) and a 50 step process to clean up the computer. Simple, fast and works almost all the time.

Not the answer you're looking for? Browse other questions tagged or ask your own question.