urgent help with trojans and worms on Google search

sexysam

About 2 weeks ago,mylaptop became very slow. I carried out full scan using avg antivirus and Spybot. However since doing this I am getting load of popup adverts,and when using google search, the page always go some other advertising sites, not the ones that I am looking for.Its doing it more and more. I have used various spyware software, but problemis still there.

I am inclined to do a full format,but this is time consuming. One of the trojans that is reappearing again and agian is the DNSZlob changer,
Any suggestion would be grately appreciated.

Reluctant_spender

Malware Bytes

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

Reluctant_spender

follow this up with a free online scan with Nod 32

Please go to Eset Onlinescan (NOD32)
(You need to use InternetExplorer or enable IEView in Firefox)

• You will then see the Terms of Use, tick the check-box infront of YES, I accept the Terms of Use
• Now click Start
• Should you face a Security Warning that asks if you want to install and run a file called "OnlineScanner.cab", click Yes
• Click Start (the Onlinescanner will now prepare itself for running on your pc)
• To do a full-scan, tick: "Remove found threats" and "Scan potentially unwanted applications"
• Press Scan
  The Onlinescan will now start and scan your pc (please let it run to completion)
• When the scan has finished, it will show a screen with two tabs "overview" and "details" and the option to get information or buy software, just close the window
• Click Start >> Run... >> type: C:\Program Files\EsetOnlineScanner\log.txt
  The Scan results will now open in Notepad
• Click into the text area, right-click and chose "select all"
• Right-click again and chose "copy"
• Close Notepad

Note for Vista Users: Eset is compatible but Internet Explorer must be run as Administrator. To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select "Run as Administrator" from the context menu.)

Include this log in your reply by right-clicking and "paste" in the text area of the reply post you just created.

Browntoa

2nd the above post !!

sexysam

Tried 1st post,detected 6 trojans, problem still exist. Going to try 2nd post now

Airwolf1

The following has helped me out several times where others have failed -
http://support.f-secure.com/enu/home/ols.shtml

sexysam

Sorry folks, I have tried all above, but problem is still there. Both Firefox and IE8 that I use for Google search are doing it.When I go to the sites in my bookmark, thye work fine, its only when I use Google search all of them are directed at web marketing sites.If I do a complete reinstall will problem be still there?. Tried restoring to previous restoration point, but still no joy. The Zobla DNS changer is the trojan that keeps reappearing again and again even after using 4 different viruses as mentioned in above posts.

Thanks

aliEnRIK

Id recommend uninstalling AVG and giving AVIRA anti virus a go. Seems to be that bit more thorough than most anti virus programs (Including Malwarebytes)

http://www.download.com/Avira-AntiVir-Personal-Free-Antivirus/3000-2239_4-10322935.html

UPDATE and scan

If that doesnt work then change the 'heuristic scan' to HIGH and try again

Best of luck

GeorgeUK

If you aren't having any luck getting rid of this, i suggest you post a hijacjthis log on the castlecops forum (there is a section expecially for hijackthis). They are quite good at getting rid of viruses, but it may take a few days.

Have you used CCleaner to remove all your temp and internet files?

milkybars

Sexysam... I'm also having this problem. I did the same... I followed the sticky guide to the letter to try to remove it. Worked for a bit but seems to be back again. Only thing left to try is Hijack This for me. I'll keep my eyes peeled so do post if you find a fix for this problem.

aliEnRIK

milkybars wrote: »

Sexysam... I'm also having this problem. I did the same... I followed the sticky guide to the letter to try to remove it. Worked for a bit but seems to be back again. Only thing left to try is Hijack This for me. I'll keep my eyes peeled so do post if you find a fix for this problem.

By all means download HIJACK and post the log here ~

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html