Malware not showing up in virus scan

Question

I have some malware on my computer at work that I'm having a hard time getting rid of. I'm only interning there over the summer, so I'm guessing that it was downloaded by the previous user because I noticed it as soon as I opened my web browser for the first time. Whenever I'm using a web browser (this occurs on all web browsers that I've used including IE, Firefox, and Chrome), the same ad appears on every website I go to (even on sites where there should not be ads). This ad obstructs either the bottom left or bottom right portion of every page I visit and also installs unwanted cookies. I ended up using adblock to manually block out the ads; however, what troubles me more is that every once in a while when I click on a link I get redirected to a website I never intended to go to. It's quite frustrating when I'm trying to get to an important page and instead I end up at an auto glass website or some advertisement saying I've won a prize.

I have tried remove the adware using multiple antivirus softwares including Windows Defender and Malwarebytes, but none of them seem to be spotting the the virus. Is there something I can do to remove this? I've put up with it for a few weeks now, and it's gotten very frustrating.

Answer 1

Does your company have an IT team? If so the best thing to do is get them to do it or you could risk losing your internship. If not the next best thing if possible is to do a clean install of the operating system. If that's not possible try this out:

• From a clean machine download the latest MalwareBytes and AVG and CCleaner and put those installers on a thumbdrive
• Boot the infected machine into safe mode. This is usually accomplished by pressing F5 while the machine is booting.
• I usually run CCleaner then MalwareBytes then AVG but I don't think the order matters just run them and get all of the crud off of there.
• After that boot into windows normally, if there are any definition updates for malwarebytes or avg download them.
• Run all 3 again.

When you boot into safe mode windows will only load what's necessary to run, more likely than not the malware won't start in safe mode. You may also want to check the below registry keys. If any of the entries have a * next to the name it will start in safe mode. However I would caution you to stay away from the registry if you don't know what you're doing because you could really mess stuff up in there and in 90% of cases I have dealt with the malware doesn't start in safemode.

• •HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
• •HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• •HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
• •HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

If you're STILL getting those ads look at the url and place an entry in your hosts file to send that url to 127.0.0.1. Here are directions on how to edit your hosts file.

Hope this helps and good luck!

Answer 2

As a rule, any remotely sophisticated malware won't show up on any anti-virus, anti-spyware, or other anti-malware scan.

Heaven only knows what else you have on your system beyond just what's showing up sending you ads. Your only truly safe option is to erase everything and start over. Or as you'll often see it stated here: Nuke it from orbit; it's the only way to be sure.

My preferred way to go about this is buy a new removable hard drive the same physical size as your existing one (i.e. laptop size or desktop size). Open up the new enclosure and take out the drive, and swap that disk with the one in your computer. Now format and install a new OS on the drive you just added, and put your old drive into the USB enclosure so you still have access to your old files.

Answer 3

As you said it appears on multiple browsers and eludes AntiVirus: this may be caused by packet injection upstream from your device. Essentially, someone (often an ISP) modifies the data sent and received by your computer so that web pages arrive with a bit of code that inserts an ad.

To diagnose, boot from known good media (e.g. A Ubuntu LiveCD) or bring a device from home and browse the web. If the ads appear, it's a good indication of injection.

You can also consider inspecting the pages (in Chrome and Firefox, right click > Inspect Element) to see if you can isolate the code that's causing the ads. The links above go into more detail.