Hijacked links?

RussJK

mrbadexample wrote: »

That seems to have got it.

Thanks all for the help. :T

You found and removed a rootkit? Try another quick scan with Malwarebytes to see if anything was being hidden by the rootkit. I'll leave closed to advise further on removal of this current instance.

Might be an idea to find a way to prevent this happening in the future. Most people get infected through their browser. My suggestions if you want them:

• Use "Adblock Plus" for Firefox, and use both Easylist subscription along with the Malware Domain subscription list (http://adblockplus.org/en/subscriptions). Easylist blocks ads which prevents malware infected ads from doing anything. The Malware Domain subscription prevents loading content from known malware sites. You can use "Simple Adblock" for Internet Explorer if you don't want to switch browsers (http://simple-adblock.com/).

• Another method is to use a webfilter like ClearCloudDNS (http://clearclouddns.com/). Fast for me, but test it on a site like Youtube to see if it works well for you - if not, it's easy to disable. The advantage is that it stays up to date by itself. No need to have the Clear Cloud utility load at startup, unless you are worried that your DNS settings will be hijacked again by malware (the clearcloud utility will act as an early warning if this happens).

• Yet another method is a hosts file like MVPS (http://www.mvps.org/winhelp2002/hosts.htm) or MalwareDomainList (http://www.malwaredomainlist.com/hostslist/hosts.txt). I use Hostsman (http://www.abelhadigital.com/hostsman) on occasion which automates the process of combining the two. You just have to remember to update it.

mrbadexample

RussJK wrote: »

You found and removed a rootkit? Try another quick scan with Malwarebytes to see if anything was being hidden by the rootkit.

Yes. Nothing else found by MWB. Think it's sorted now.