Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected by some sort of redirect virus (eminentsearchsystem.com?)


  • Please log in to reply
5 replies to this topic

#1 autonomist

autonomist

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:18 AM

Posted 15 October 2011 - 09:25 AM

I have a Dell 1501 laptop running Windows Vista that has recently become infected. It redirects everything and pops up random new tabs to weird websites and in the bottom left where it usually displays the website I'm navigating to it says "eminentsearchsystem.com". I've tried running my malwarebytes as adminstrator and running it in safemode but this virus or whatever it is seems to have disabled it. I'm not tech savvy enough to know what else to do so that's really the only step I have taken thus far. Kind of freaking out. I don't know what other information you might need from me in order to help but any help would be sooooo much appreciated!

BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:11:18 AM

Posted 15 October 2011 - 11:03 AM

Welcome aboard Posted Image

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 autonomist

autonomist
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:18 AM

Posted 15 October 2011 - 06:54 PM

Me again. So...I downloaded GMER, saved to desktop, disabled everything, disconnected internet and double clicked the icon and it wouldn't even open no matter what I did, not even in Safe Mode. Every single time I get the pop-up: "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access this item." It also gave me another pop-up message that said: "Microsoft Office Client Virtualization Service stopped working and was closed."

I want to get my personal stuff off the computer should it decide to explode or die...if I try to transfer to an external can that hard-drive become compromised by this rootkit devil too? I know, I know I should have all my stuff backed up already but I don't.

Is there any hope for me?

#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:11:18 AM

Posted 15 October 2011 - 07:45 PM

That message means we're dealing with a serious infection.

With the information you have provided I believe you will need help from the malware removal team.
Please make sure that you read the information about getting started first.
Then start a new thread HERE and include or required logs.
Including a link to this thread will be helpful.

Good luck and be patient. Help is on the way!

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#5 autonomist

autonomist
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:18 AM

Posted 18 October 2011 - 10:17 AM

Thank you very much for your time and effort, I really appreciate it.

#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:11:18 AM

Posted 18 October 2011 - 10:40 AM

You're very welcome Posted Image

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users