Pesky search engine hijack

kiwi · 26 Oct 2011 at 11:57

Hi all,

I'm a linux user by day but I've managed to get a virus that hijacks my links from google now and again. Even though I'm not completely up with Windows 7, I've done all the usual, including running loads of anti-virus, loads of rootkit tools blah blah but it's still around. Any ideas?

On a side note, I'm getting an error installing SP1, any help on that would be nice but I'm not that worried as it doesn't get booted that much.

Thanks

edscdk · 26 Oct 2011 at 12:01

get combofix from bleeping computers
get tdskiller from kaspersky
get malwarebytes free

boot safe mode
run combofix
if it will not run try tdskiller
if it does run fine run tdskiller anyway jsut to be safe
once done run malware bytes

if combofix will not run and tdskiller does not find anything id reinstall or wait few weeks (and dont use the system) to see if combofix will pick it up

saracen9 · 26 Oct 2011 at 12:02

Might be a bit obvious, but have you checked whether it has installed itself as an add-on to your browser?

kiwi · 26 Oct 2011 at 12:04

I've run all of those but maybe not all in safe mode so I'll try that, thanks. I would have reinstalled already but I've moved since I installed Windows 7 so I can't find the disk (or a blank one...) to reinstall.

KIA · 26 Oct 2011 at 12:06

Is it sending the traffic to different domains or the same domain?

kiwi · 26 Oct 2011 at 12:06

saracen9 said:
Might be a bit obvious, but have you checked whether it has installed itself as an add-on to your browser?

It's affecting all browsers unfortunately. It's not really that annoying, I just don't feel 100% using it not knowing where/what is happening to my data entered in a browser.

kiwi · 26 Oct 2011 at 12:07

fluff said:
Is it sending the traffic to different domains or the same domain?

Different domains. I've tried googling the domains but they don't seem to come up as hits for anything.

saracen9 · 26 Oct 2011 at 12:31

kiwi said:
It's affecting all browsers unfortunately. It's not really that annoying, I just don't feel 100% using it not knowing where/what is happening to my data entered in a browser.

For peace of mind you could use something like Fiddler to check what is happening to the traffic. Might also highlight anything funny with the initial requests when you click on a google link.