9

For the second time in a month, my work PC has been infected with malware that is hijacking my Google search results in Firefox. A search for the URL hijacked searches end up at turns up nothing on any sites I would deem reputable.

The first time it happened our IT vendor installed Malwarebytes Anti-malware and that seemed to remove it, but now it's back. I don't like reactionary fixes, I want to keep my system clean and secure.

Questions:

  1. What are the security risks of this hijack?
  2. How do I remove it completely?
  3. How does it get on my computer? (drive-by download,embedded in email attachment, etc)
  4. How can I prevent it from happening again?

Thanks.

Paul

update May 12, 2011: 1. PC has been scanned by Malwarebytes, Spybot and Ad-aware. Ad-aware found 5 tracking cookies, nothing more. The other two scanners reported a clean bill of health.

  1. In addition to the 3 antimalware packages above, my PC runs Symantec Client Security/ Symantec AV.

  2. A previous scan in April by Malwarebytes logged the presence of Heuristics.Shuriken, and noted it was successfully quarantined.

  3. Only Firefox is showing any symptoms of infection at this point.


UPDATE May 20, 2011:

  1. Since my original post, NoScript has been installed into Firefox. When I do a Google search, NoScript displays its warning bar and in the list of script sources is a domain that a WHOIS lookup shows as registered in Hong Kong.

  2. I have continued to scan daily with multiple antimalware packages and all report no suspicious files.

  3. My system continues to degrade. Speed is suffering, programs crash, Outlook can't search my emails. It's time for the "nuke from orbit" suggested earlier.

7
  • 1
    @Graham Lee - I'm new here; what is the reason for removing from my post the URL that the hijacker directs to? I thought that may be an important clue as to which malware I am fighting.
    – Paul S.
    May 11, 2011 at 14:27
  • @Paul-S - We need more details about the infection to answer. What was the malware detected by Malwarebytes? Do you have another AV solution in use, and if so what risk alerts have come from that? What exactly are the symptoms of the infection? With only the information given so far, I'd suggest a "nuke from orbit" - re-format and re-install. Then, make sure your OS and all applications are up to date, and you have appropriate protections in place and updated before wandering out on the web again. Also, reset all passwords ever used from the infected system.
    – Iszi
    May 11, 2011 at 14:28
  • 1
    @Iszi - would an intentionally broken URL, or partial URL, be acceptable? (Malwarebytes is running now, can't access logs. Will post when it unlocks)
    – Paul S.
    May 11, 2011 at 14:31
  • 2
    @Paul S. I'm not sure the URL itself is valuable: scam promotors will buy into various different adware and spam schemes from different groups so there's no 1:1 correlation guaranteed between the URL and the malware being used. I removed it to avoid people browsing to it and potentially being infected.
    – user185
    May 11, 2011 at 14:33
  • 1
    Also, on this site we prefer not to deal with the specifics of a given virus, as these are constantly changing, and the answers would be out of date very quickly. Instead, we prefer to focus on the principles and strategies of how to deal with these classes of virii, in general.
    – AviD
    May 12, 2011 at 21:57

5 Answers 5

6

1. What are the security risks of this hijack?

If it is a simple browser redirect the risks maybe limited. Their business model may simply be to infect widely and make money from directing you to advertising sites. Not to unnecessarily alarm you but the danger is that the standard modus operandi these days is to compromise a machine and then download a cocktail of malware (Trojans, key-loggers etc) as well as using the machine in a bot-net

2. How do I remove it completely?

Only way to be absolutely sure is to do a complete format your drive and restore from backup (use the OS re-install media to format the drive). Update all patches and install updated AV from another computer prior to re-connecting to the Internet. Still may not save you if there is a hidden root-kit that is making a part of the drive unwritable which may need a new hard drive or BIOS update at worst case. As @Rory-Alsop said contact the AV vendors for your particular strain to determine optimal removal procedures. I have found Hijack this particularly good in the past (http://free.antivirus.com/hijackthis/). It is not an automated program but lets you manually go through and examine things like browser hooks which is usually how redirect type malware works.

3. How does it get on my computer? (drive-by download,embedded in email attachment, etc)

No way to know for sure. Could have been a website even a legitimate one, email as you say, even infected USB drive.

4. How can I prevent it from happening again?

Take care. Key steps:

  • Use and keep an Anti-virus uptodate. Free ones are Clam AV, Microsoft security essentials
  • Patch everything regularly - use software that has auto update
  • Minimize software with big attack surfaces like Adobe Flash, Acrobat, MS Office, Java. There are good open source alternatives like Open Office, PDF Creator. Millions of people have iOS devices without Flash - you don't need it.
  • Use simple browser extensions like HTTPS Everywhere and No Script
  • Install and maintain a personal firewall. Windows has one and so do most AV packages
  • Do not use vendor-supplied or simple passwords. Use a password manager. Consider changing at least your important passwords
  • Most importantly: practice good Internet hygiene; not clicking on any links from senders you do not recognize, not opening email from senders you do not recognize. Avoid sites that maybe bad for your computers health and your marriage!
4
  • Did you really mean "in a bonnet", or in a "bot-net"? If the former, I must say it's the first time I've heard that one. And, "low-level format"? Are we back in the early '90s now?
    – Iszi
    May 11, 2011 at 15:16
  • @Iszi Meant Bot-net typo fixed thanks. Low level format I meant doing it outside the OS as less chance for the malware to hide / hijack process. What's a better way to describe that?
    – Rakkhi
    May 11, 2011 at 15:20
  • Good question, there. "Format via LiveCD" maybe? Usually, when I'm nuking a system I do the format via the OS install CD since I'm going to be re-building the OS anyway.
    – Iszi
    May 11, 2011 at 16:48
  • @Iszi makes sense. Updated.
    – Rakkhi
    May 12, 2011 at 12:06
2

The answers so far have been spot on but I don't think a full reformat is in order yet. It honestly sounds like you have a TDSS variant. Try running the Kaspersky TDSS removal tool. You can find it here: http://support.kaspersky.com/downloads/utils/tdsskiller.zip Let us know what that turns up.

Also some basic checks should be performed. Have you checked the proxy settings in your browser? Have you checked the DNS settings on your NIC? Have you checked your HOSTS file for unknown entries? These are all common targets for redirectors.

I haven't seen a virus that cannot be removed with enough time and patience. Usually reformatting and reconfiguring everything ends up being faster, but it shouldn't be required in every situation.

1

This question isn't really on topic for this site, however bits of it are so:

Some answers =

1 What are the security risks of this hijack?

Your entire computer could be compromised, as very few browsers are patched up to date. You could have a botnet client or keylogger installed. Odds are that the exploit may not have gone that far and is just a spam server, but it is worth thinking worst case so you can decide what remediation may be required, from a straightforward clean to a full lift-off and nuke from orbit.

2 How do I remove it completely?

That is a question you'd really want to ask at one of the big antivirus vendor's sites - it isn't on-topic here.

3 How does it get on my computer? (drive-by download, embedded in email attachment, etc)

Could be any of the above - most payloads are deliverable by a large number of routes.

4 How can I prevent it from happening again?

The key here is patching - if you have your patches up to date you remove a high percentage of exploit routes. But remember nothing will protect you 100% unless you unplug your computer and turn it off. Security improvements come from technical controls, processes, behaviours etc.

Remember that your computer may have been compromised in such a way that a surface clean may not be enough. A rootkit can hide very effectively, and patching over a rooted box is not going to protect you.

You could make sure you run with security options in your browser, and some browsers are considered safer than others. At least make sure you are on the most up to date version.

2
  • I tried to vote up your answer, but I guess I am too new to have that privilege. Since I am new, can you explain how my question is not on-topic for this security community so I can phrase my future questions better?
    – Paul S.
    May 12, 2011 at 14:31
  • @PaulS - details on how to remove a specific virus etc are far better served by the databases the antivirus vendors have. There are so many new ones daily - we could never do the topic justice. The rest of your question is on topic though. If you look in the FAQ link at the top of the page you will see the scope of this site.
    – Rory Alsop
    May 12, 2011 at 15:21
0

In addition to the other excellent answers:

I recommend Secunia PSI. It periodically scans your machine to check whether you have any versions of software with known security flaws, and makes it easy for you to update software and keep all of the software on your machine fully patched. This may help prevent you from getting infected in the future.

I also recommend turning on automatic update on all software that you can.

Here is a web page I have used with resources for removing malware from Windows. But -- if it is your work machine, maybe you can leave all of this to your IT staff?

0

Here's a nicely maintained howto for browser security with programs and principles and links: https://gist.github.com/atcuno/3425484ac5cce5298932

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .