Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

The Website Survey redirect after "Security Tool" Virus Removal


  • This topic is locked This topic is locked
3 replies to this topic

#1 rac309

rac309

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:47 AM

Posted 25 December 2009 - 11:00 PM

I received the security tool virus while randomly browsing the internet about two weeks ago. Upon infection, I followed the removal instructions at http://www.bleepingcomputer.com/virus-remo...e-security-tool. The virus seemed to be removed successfully, however I now have a browser hijacker. Whenever searching google and clicking on a link my browser is typically redirected to a faux antivirus site. This usually occurs successively three times and on the fourth time my browser directs me to the correct link. The redirect seems to occur more often when I'm clicking on links dealing with security/virus removal. I also get random pop-ups of the website survey and local-news-online.com periodically. I observe no other effects other than browser redirection, that I am aware of. I received this virus while using Internet Explorer and since have changed to using Firefox. I have also updated my computer security from Symantec Anti-Virus and Windows default firewall to Avast!, COMODO Firewall, and Malwarebytes Anti-Malware. I have run scans with MBAM, SuperAntiSpyware and Spybot, all were unable to fix the problem. In addition, when trying to download the DDS file, my computer recognizes the .scr file extension as an AutoCad script and opens it in notepad. I no longer have AutoCad on my computer and am not sure how to change this, but therefore I can not run the DDS program. The ARK.txt file from rootrepeal is attached. Thank you for any help.

Attached Files

  • Attached File  ark.txt   34.98KB   1 downloads


BC AdBot (Login to Remove)

 


#2 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:47 AM

Posted 05 January 2010 - 07:40 PM

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.
  • [i]
  • Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Options box to the right of your topic title and selecting Track This Topic.

  • Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

Thanks :(


Please run OTL instead of DDS
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy [b](Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Posted Image
m0le is a proud member of UNITE

#3 rac309

rac309
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:47 AM

Posted 05 January 2010 - 09:28 PM

I actually downloaded Ashampoo anti-spyware between the time I posted this topic and the present. One of the options for Ashampoo is to restore the Window's host file to the default, which after I did, the redirect problem was solved. I assume therefore that my host file was hijacked. As of now, no further problems have been witnessed and I am now running Avast!, MBAM, with a COMODO firewall which seems to be working perfectly. Thanks for your help. All scans thus far have come up negative for any further problems.

#4 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:08:47 AM

Posted 06 January 2010 - 07:40 AM

First thing I was going to suggest was for you to reset the Hosts file.

Anyway, if you're happy I am closing this topic. Cheers.

---------------------------------------------------------------------

Since this issue appears to be resolved ... this topic has been closed. Glad we could help. :(

If you're the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.
Posted Image
m0le is a proud member of UNITE




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users