For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on any sites I would deem reputable.
The first time it happened our IT vendor installed Malwarebytes Anti-malware and that seemed to remove it, but now it's back. I don't like reactionary fixes, I want to keep my system clean and secure.
- What are the security risks of this hijack?
- How do I remove it completely?
- How does it get on my computer? (drive-by download,embedded in email attachment, etc)
- How can I prevent it from happening again?
update May 12, 2011: 1. PC has been scanned by Malwarebytes, Spybot and Ad-aware. Ad-aware found 5 tracking cookies, nothing more. The other two scanners reported a clean bill of health.
In addition to the 3 antimalware packages above, my PC runs Symantec Client Security/ Symantec AV.
A previous scan in April by Malwarebytes logged the presence of Heuristics.Shuriken, and noted it was successfully quarantined.
Only Firefox is showing any symptoms of infection at this point.
UPDATE May 20, 2011:
Since my original post, NoScript has been installed into Firefox. When I do a Google search, NoScript displays its warning bar and in the list of script sources is a domain that a WHOIS lookup shows as registered in Hong Kong.
I have continued to scan daily with multiple antimalware packages and all report no suspicious files.
My system continues to degrade. Speed is suffering, programs crash, Outlook can't search my emails. It's time for the "nuke from orbit" suggested earlier.