Right, Seem to Be Infected, Computer-Wise

[Rutskarn]

Best as I can figure, I've got a computer virus. Don't know where I got it from, since I'm not exactly surfing for black market bootlegs of chicken dancing and I haven't downloaded anything recently, but the signs are unmistakable.

Whenever I run a search (google, yahoo), I get a list of results, as usual. Clicking on one will redirect me to some sort of commercial directory, where it will plug my search terms into a listing of commercial websites. The redirect is marked in my history by a series of click.phps. Keep in mind that I actually have automatic redirects turned off, so I don't know what the problem is.

Anyone got any ideas? I'm not keen to search for solutions, since that would be playing into the hands of whoever designed this asinine virus.

[Flickerdart]

Download Avast (http://www.avast.com/en-ca/index). Set it to do a boot-time scan. Go see a movie with friends or something because this will take a long time. When you get back, you should be clean.

[Rutskarn]

Download Avast (http://www.avast.com/en-ca/index). Set it to do a boot-time scan. Go see a movie with friends or something because this will take a long time. When you get back, you should be clean.

Can't use Avast. UCI mandates use of McAfee, the bastards.

[blackfox]

Can't use Avast. UCI mandates use of McAfee, the bastards.Run McAfee, then. Or run Avast off a USB drive, I *think* you can do that. How exactly is Irvine keeping you from using Avast...?

FWIW I've got Win7 running the second?-latest version of Norton Antivirus and it would appear to work...

[lesser_minion]

If you're lucky, this could be something minor, but yeah... being roped into McAffee is going to make this really difficult.

In any event, which browser are you using?

[Arakune]

It could be an spyware too, those bastards!

[RS14]

Can't use Avast. UCI mandates use of McAfee, the bastards.

Wait, your college tells you what software you can run?

If it's there computer, it's their problem. Let them fix it. If it's not their computer, I don't see why they have any say in the matter.

Edit: Because they control network access. Hm.

[lesser_minion]

Avira make a bootable live CD - I don't see how your college can really object to you using something like that.

[Rutskarn]

If you're lucky, this could be something minor, but yeah... being roped into McAffee is going to make this really difficult.

In any event, which browser are you using?

Firefox, but of course. Browser of Browsers, King of Kings, Doesn't Do Those Things Google Chrome Does That I'm Not Sure I Care Abut of Doesn't Do Those Things Google Chrome Does That I'm Not Sure I Care About.

Hm. Haven't yet tried using Internet Explorer...

[AstralFire]

Why can't you use Avast? I don't understand. Generally colleges mandate use of a specific anti-virus, but they don't ban usage of the others.

Spybot S&D as well, btw.

[lesser_minion]

Have you tried searching using the pages directly, or are you using the search/awesome bar?

It's possible that something's messing with Firefox, but it's also possible that your network settings are being screwed with (btw, I'm pretty sure disabling automatic redirection only works on headers - it doesn't stop every method of redirecting a page).

It's probably worth grabbing malwarebytes' anti-malware (http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol) (which you can use alongside McAffee), and possibly grabbing HijackThis! (http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html?tag=mncol) as well.

Bear in mind with HijackThis! that it looks for absolutely everything that could be an issue - however, a log could be useful, since I know there are forumites who know how to read them.


Why can't you use Avast? I don't understand. Generally colleges mandate use of a specific anti-virus, but they don't ban usage of the others.

Installing more than one antivirus program can cause conflicts - using McAffee alongside Malwarebytes' wouldn't be an issue, but using Avast would.

[Rutskarn]

Have you tried searching using the pages directly, or are you using the search/awesome bar?


...interesting. I'll have to run a few tests, but it appears that searches run directly off Google's homepage are universally clean. It's only the use of the searchbar that screws me over.

I'll look into that software. A premature thanks for the help--anything I can do to lock this down would be helpful. I do have somebody who's generally good with these things coming in tomorrow, so fingers crossed and all that.

[lesser_minion]

That sounds like Firefox has been modified in some way then - try going to about:config and searching for browser.search. If anything comes up listed in bold, you should be able to reset it to default.

Also have a look through your search plugins (https://developer.mozilla.org/en/Creating_OpenSearch_plugins_for_Firefox) - it's possible that they've been modified, in which case you should be able to get replacements from addons.mozilla.org

[Rutskarn]

Alternately, what if I just tried nuking the whole goddamned thing from orbit? As in, trashing Firefox and reinstalling?

[lesser_minion]

Alternately, what if I just tried nuking the whole goddamned thing from orbit? As in, trashing Firefox and reinstalling?

It would fix the tampering, if there's nothing you mind losing - however, quite a bit of your profile data would be left behind, so you'd have to hunt that down (or simply install to a different location, in which case it will use a totally separate profile).

The biggest issue is that that's utterly useless until we know what actually caused the problems in the first place - all we know at the moment is that it looks like you've picked up a piece of adware somewhere down the line, and until that's gone, it will just undo anything you try to do to fix the tampering.

In theory, adware is just annoying, but we need to be sure you've caught it, and we also need to make sure that the payload that included it didn't install anything else that could be troublesome.


Is there any sign that IE's been tampered with as well?

[Rutskarn]

Problem is solved by the arrival of the cavalry--tech support relative arrived with an armory of antivirus hitmen. We actually uncovered a nest of filth, which we (to their surprise) managed to clean off in one go, with no little surprises left behind.

Couple weeks I'll be back home and back in the safe, snug arms of Avast! Antivirus.

Thanks again for the help, everyone!

[ericgrau]

FWIW my favorite solution to problems like these is to save the hard-drive from my old computer. On this second hard drive I have installed windows and all the programs I like to use. I also keep CDs and manuals for my software in a single bag, and all small downloadable software on a thumb drive along with all my documents. I back up this thumb drive regularly. Also a great way to run an antivirus from a clean drive to inspect any problems on the main drive... b/c retarded Windows usually won't let you delete it otherwise.

A few months ago I misclicked a popup in my browser and my computer went kaput (flaw in Chrome I guess). I booted off my second drive and I was back up and running in under 2 minutes. My main hard drive is still functional so I redirected some shortcuts and run most of my programs off of it still. My antivirus didn't find anything on the main drive. Eventually I'll need a new, bigger hard drive at which point I'll rinse and repeat. Still don't know what's keeping my main drive from booting and I don't really care.

[chiasaur11]

FWIW my favorite solution to problems like these is to save the hard-drive from my old computer. On this second hard drive I have installed windows and all the programs I like to use. I also keep CDs and manuals for my software in a single bag, and all small downloadable software on a thumb drive along with all my documents. I back up this thumb drive regularly. Also a great way to run an antivirus from a clean drive to inspect any problems on the main drive... b/c retarded Windows usually won't let you delete it otherwise.

A few months ago I misclicked a popup in my browser and my computer went kaput (flaw in Chrome I guess). I booted off my second drive and I was back up and running in under 2 minutes. My main hard drive is still functional so I redirected some shortcuts and run most of my programs off of it still. My antivirus didn't find anything on the main drive. Eventually I'll need a new, bigger hard drive at which point I'll rinse and repeat. Still don't know what's keeping my main drive from booting and I don't really care.

Sounds like a fair deal of effort, really.

Not sure if it'd be worth it.

[Starbuck_II]

I might have a similar problem: a virus.

My hotmail email has been emailing people without my premission as in when I'm not online it emails stuff. Since I haven't been online in last few days...it can't be from me.

It sent me, my mom, and other in my address an email using me as the From line some spam mail about buying phones with an email and a website to go to.
What kind of virus uses you to send spam?

[blackfox]

I might have a similar problem: a virus.

My hotmail email has been emailing people without my premission as in when I'm not online it emails stuff. Since I haven't been online in last few days...it can't be from me.

It sent me, my mom, and other in my address an email using me as the From line some spam mail about buying phones with an email and a website to go to.
What kind of virus uses you to send spam?Not necessarily a virus, more likely a hack. Try changing your hotmail password and see if it keeps happening.