Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser Redirect / Connection issues - Virus?


  • Please log in to reply
2 replies to this topic

#1 heidrek

heidrek

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:42 PM

Posted 16 September 2010 - 07:46 PM

Hi All,

I have noticed a few strange things with my Firefox and Internet Explorer recently.



It started off about a couple of weeks back, but only with one or two sites. for some reason I couldn't get access to parked.com from Firefox, but I could with internet explorer. Likewise with Yola.com.

About a week ago or so I noticed a problem in Google searches. I'd click a link and instead of going to the site I'd get redirected to iSearchpile or Asklots or a similar sort of site. i also noticed that every now and again when I'd click a link in a forum or similar a new window would open at Google.

I activated noscript on Firefox and this seemed to identify the problem. When I'd click on a search, I'd go to a blank page first with a redirect message that noscript had blocked. after a while the search would open normally. Still copudln't get to some sites though and figured there must be a virus at work.

Ran symantec and it quarantined a couple of files which I thought would fix the probelm but it didn't. Ran Adaware and that also picked a few things up but again didn't fix the problem.

I've started to notice problem connecting and downloading from the internet now as well. I've tried to install Spybot Search and Destroy but it won't install properly, likewise Adaware says there's a connection error when I try to run the update feature. Symantec updated fine this morning but it seems that some software can't update poroperly. I also tried to download new copies if Internet Explorer and Firefox figuring that if the problem was linked to the browsers then perhaps I should just unistall them and reinstall again. Initally i couldn't download the software, but eventually I managed to.

uninstalled firefox, then reinstalled it completely fresh - no bookmarks or add ons. Tried to get the noscript add-on but now I get an error saying it can't connect and download the add-on. Upgraded to IE8 which is what I'm using now. i've also downloaded ComboFix but haven't tried to use it yet.

I'm now running a complete, comprehensive scan of the system with AdAware, which has apparently found 1 thing so far but I can't see what.

IE8 seems to be preforming OK, but I'm concerned about the inability to connect to the net properly, and the fact that there's obviously an underlying propblem.

I don't know if this is just a Browser redirect virus like I've seen others write about, something more insidious, or perhaps even more than one virus is at work? In any case I'd be glad of any help.

oh yeah, while I think of it, here's one of the viruses picked up by Adaware intially:

trojan.win32.generic!BT does that mean anything to you?

one more thing, the last time Symantec antivirus picked up an infection was 10 September (other scans since have been clean) and here's the names of what got found then:

Risk Action Filename
Hacktool.Rootkit Restart Required - Cleaned i5qG5.sys
Trojan Horse Quarantined jar_cache21496.tmp
Trojan Horse Quarantined AppleT.class

here's more in the log but I figure that stuff might be the most helpful?

Thanks,

Edited by heidrek, 16 September 2010 - 07:56 PM.


BC AdBot (Login to Remove)

 


#2 rockmilk

rockmilk

  • Banned
  • 202 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:42 PM

Posted 17 September 2010 - 01:23 AM

removed by BC Moderator

Edited by quietman7, 17 September 2010 - 07:34 AM.


#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,734 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:42 PM

Posted 17 September 2010 - 07:12 AM

rockmilk we have our own Guide here at Bleeping Cmputer. There is no need to refer our members to another site.

How do I get help? Who is helping me?

heidrek, please follow these instructions: How to remove Google Redirects or the TDSS, TDL3, Alureon rootkit using TDSSKiller
  • Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • When the program opens, click the Start Scan button.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  • Ensure Cure is selected, then click Continue > Reboot now to finish the cleaning process. <- Important!!
    Note: If 'Suspicious' objects are detected, you will be given the option to Skip or Quarantine. Skip will be the default selection.
  • A log file named TDSSKiller_version_date_time_log.txt will be created and saved to the root directory (usually Local Disk C:).
  • Copy and paste the contents of that file in your next reply.
-- For any files detected as 'Suspicious' (except those identified as Forged to be cured after reboot) get a second opinion by submitting to Jotti's virusscan or VirusTotal. In the "File to upload & scan" box, browse to the location of the suspicious file and submit (upload) it for scanning/analysis.i]
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users