Google redirecting me to wrong sites

jrossjord

thanks, will try that, (have already uninstalled sonic thing, came with autoruns, obviously didn't uncheck a box somewhere on installation...grrr)

closed

I've never known autoruns come with a toolbar

http://live.sysinternals.com/autoruns.exe

jrossjord

I probably downloaded it from a different site...anyway I sorted that. Now going through Kaspersky tech help, which is pretty quick butI'm noticing that the files Kaspersky is bringing up as infected are all in system32 directory and often have similar names. I looked through the files, while waiting for a response from Kaspersky, and there are loads of files, supposedly created today, 0 bytes, all .exe files and 5/6 letter names, e.g. hteryh hteryw hteryx...then iproti, iprotx and many many more. These are the files that the virus checkers are finding but the problem with redirection in IE just continues. Am I saving myself any time if I go through system32 and manually delete these .exe files which are obviously not 'genuine' files (if I hover mouse over them they give no descriptions unlike genuine files, just creation date/time and 0 bytes)...if I was able to delete them all do i solve the problem? (I suspect there must be something creating all these files each time I log on or search or something, making it near impossible to get rid of this virus?)...oh and my 'helper' on Kaspersky seems to have left the building!

Any advice appreciated!

jrossjord

oh - and when I try and download avast it just does nothing when I click the link, like no pop-up blocker or anything, just nothing - at least it won't do anything when i click the free version, seem to be able to get the paid for ones if i want them though?!

GunJack

if you've already tried mbam and combofix, then give the good Doctor a try (Dr Web, that is ) It'll start off on a quick scan, stop this and start a full scan, then go to bed 'c oz it takes many hours normally, but will often pick up things that others miss

http://www.freedrweb.com/cureit/?lng=en

you may have to try to download it a couple of times, but persevere, it's very often worth it. When downloading, choose Save, and save to desktop before running it.

oh, and download avast frm here:-

http://www.filehippo.com/download_avast_antivirus/

jrossjord

thanks for that, am downloading now.

Got bored, deleted all rogue files in system32...then did Kaspersky scan and it found one (that I had supposedly deleted), deleted it again and watched as another file magically appeared in the system32 folder, deleted it, guess what...so the virus checkers are finding these files but not what's producing them...bed sounds good I'm going bananas!

jrossjord

honestly, I am going to bed soon...but looking at autoruns again I notice that a rogue file appears that wasn't there before (like one of the .exe files in system32) so I figure this is linked to the virus, so then I think, what other files/applications are in the same section of autoruns...and there are a few google files, some which have 'google inc.' after them and 2 which just say 'google' but with almost copycat descriptions of the google inc. ones...am I on to something here? So am unchecking these, restarting, rescanning (with my newly installed avast, thank you again)...and let's see what happens!

jrossjord

well nothing has made any difference yet...avast ran a boot scan and found lots in the java cache which was infected, deleted those, then decided I'd unistall Java and reinstall later...no difference problem persists. Also found hiberfil was infected so have disabled hibernation and restarted, which is meant to delete file. Files still replicating in system32 folder and still getting redirected when I click on any links in IE (e.g. when logging into Kaspersky support it opens up two windows, one the right one and another via google-analytics).

Couldn't download Dr Web will try again later...not sure what else I can do...whoever wrote this virus should be locked up!

aliEnRIK

Please open malwarebytes and post the last log

Also post the combofix log

jrossjord

apologies if I should have done this and haven't realised - but should I disable system restore?