Redirection Malware Infection

Question

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites.

I have had this infection in the past (I used Avast Free during that time). It was resolved by reinstalling Chrome.

I have reinstalled Chrome yesterday as I saw the browser querying adult websites when loading a page. Today it started opening new windows. A system in my lab had been infected by this malware in the past, I had to re-install Windows to fix it. What am I supposed to do?

Answer 1

Looks like during previous infection you had malicious Chrome extension. That is why reinstalling Chrome helped you.

This time it has to be a standalone application, which opens links in your default browser. So reinstalling Chrome doesn't help.

I see two ways to solve this:

1. Install another antivirus, which will be able to handle this malware. Try to install one of the most popular antiviruses and scan your computer. Almost all of them have trials.

2. Find and delete it by yourself.

   a. Look for suspicious processes in Task manager. Or better use Process Monitor from Sysinternals suite.

   b. Run "Autoruns" tool from Sysinternals suit and look for suspicious files.

   c. If located malicious file, stop its process(using Process Monitor) and delete.

Answer 2

What you want is a on-demand scanner that removes already-installed Malware. The most foolproof method would, obviously, be nuking and reinstalling. Assuming this isn't an option though, you can use one or more of several tools specifically targeted towards removing browser hijacks, such as ADWCleaner or Junkware Removal Tool, which has being acquired by Malwarebytes, but should still work. The Chrome Cleanup Tool could work as well.

After that it's a good idea to scan with a normal anti-malware program, such as Malwarebytes Anti-Malware, Spybot Search and Destroy and HitmanPro are good contenders, and they should work alongside normal antivirus fine. HitmanPro uses engines from several other antivirus products and has a 30 day trial if you just want to scan something.

Finally, you can look through the files yourself, by checking some sort of task manager. I use Process Hacker right now, but it has the disadvantage of actually needing to double-click on a process to see DLLs. It's slower work, and you'll only catch the ones that are running, so I'd recommend one or more of the scanners above instead.

Answer 3

I would recommend first using CCleaner to view your startup processes. You can disable and remove it if it starts when your computer starts.(This does happen with some malware, it waits to hook the browser process.)Second, I would also recommend a full scan with Malwarebytes. NOTE: Avast, if you pay for it, offers a browser add-on scan service as well. I have not tried it but its worth a shot!

Answer 4

Infection to your chrome can be remove by Chrome Cleanup Tool. (This work only for windows) follow this link https://www.google.com/chrome/cleanup-tool/ Download and run the file. After using this, it'll ask to reset your browser. I suggest you to do it.