2

I have some malware on my computer at work that I'm having a hard time getting rid of. I'm only interning there over the summer, so I'm guessing that it was downloaded by the previous user because I noticed it as soon as I opened my web browser for the first time. Whenever I'm using a web browser (this occurs on all web browsers that I've used including IE, Firefox, and Chrome), the same ad appears on every website I go to (even on sites where there should not be ads). This ad obstructs either the bottom left or bottom right portion of every page I visit and also installs unwanted cookies. I ended up using adblock to manually block out the ads; however, what troubles me more is that every once in a while when I click on a link I get redirected to a website I never intended to go to. It's quite frustrating when I'm trying to get to an important page and instead I end up at an auto glass website or some advertisement saying I've won a prize.

I have tried remove the adware using multiple antivirus softwares including Windows Defender and Malwarebytes, but none of them seem to be spotting the the virus. Is there something I can do to remove this? I've put up with it for a few weeks now, and it's gotten very frustrating.

| improve this question | |
5

Does your company have an IT team? If so the best thing to do is get them to do it or you could risk losing your internship. If not the next best thing if possible is to do a clean install of the operating system. If that's not possible try this out:

  • From a clean machine download the latest MalwareBytes and AVG and CCleaner and put those installers on a thumbdrive
  • Boot the infected machine into safe mode. This is usually accomplished by pressing F5 while the machine is booting.
  • I usually run CCleaner then MalwareBytes then AVG but I don't think the order matters just run them and get all of the crud off of there.
  • After that boot into windows normally, if there are any definition updates for malwarebytes or avg download them.
  • Run all 3 again.

When you boot into safe mode windows will only load what's necessary to run, more likely than not the malware won't start in safe mode. You may also want to check the below registry keys. If any of the entries have a * next to the name it will start in safe mode. However I would caution you to stay away from the registry if you don't know what you're doing because you could really mess stuff up in there and in 90% of cases I have dealt with the malware doesn't start in safemode.

  • •HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  • •HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • •HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • •HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

If you're STILL getting those ads look at the url and place an entry in your hosts file to send that url to 127.0.0.1. Here are directions on how to edit your hosts file.

Hope this helps and good luck!

| improve this answer | |
  • I have already tried using MalwareBytes, but I will try again using the steps you suggested. Thanks! – Jason Jul 8 '13 at 13:57
  • Interestingly enough, I checked the C:\Windows\System32\drivers\etc\hosts file on my computer to find that it was hidden and set to read only. When I finally got it open, at the bottom it read: pasted file (see the very bottom of the file). I somehow managed to gain control of the file again and removed those lines from it. The ads do not appear, but am I still infected? – Jason Jul 8 '13 at 16:09
  • LMAO nice! You're likely not still infected, just wait and see if that comes back. The only way to be 100% sure you're no longer infected would be to format the drive and do a clean install. – Four_0h_Three Jul 8 '13 at 20:09
  • One of those IP's is hosted in TX the other in Poland. – Four_0h_Three Jul 8 '13 at 20:14
  • Okay cool. I haven't seen any of those ads since yesterday nor have I been redirected when clicking on links. I would have never thought to check the hosts file had you not mentioned it, so thank you very much! – Jason Jul 9 '13 at 14:51
4

As a rule, any remotely sophisticated malware won't show up on any anti-virus, anti-spyware, or other anti-malware scan.

Heaven only knows what else you have on your system beyond just what's showing up sending you ads. Your only truly safe option is to erase everything and start over. Or as you'll often see it stated here: Nuke it from orbit; it's the only way to be sure.

My preferred way to go about this is buy a new removable hard drive the same physical size as your existing one (i.e. laptop size or desktop size). Open up the new enclosure and take out the drive, and swap that disk with the one in your computer. Now format and install a new OS on the drive you just added, and put your old drive into the USB enclosure so you still have access to your old files.

| improve this answer | |
0

As you said it appears on multiple browsers and eludes AntiVirus: this may be caused by packet injection upstream from your device. Essentially, someone (often an ISP) modifies the data sent and received by your computer so that web pages arrive with a bit of code that inserts an ad.

To diagnose, boot from known good media (e.g. A Ubuntu LiveCD) or bring a device from home and browse the web. If the ads appear, it's a good indication of injection.

You can also consider inspecting the pages (in Chrome and Firefox, right click > Inspect Element) to see if you can isolate the code that's causing the ads. The links above go into more detail.

| improve this answer | |
  • 3
    LOL: Bring the computer home and browse the web. What could POSSIBLY go wrong bringing an infected computer onto your home network! – tylerl Jul 4 '13 at 2:14
  • "bring a device from home", not "bring the device home". Booting from good media would be better, but he may not have access to to change the boot order on the work machine. (Edit: Or authority to reinstall/hardware swap) – scuzzy-delta Jul 4 '13 at 2:39
  • Aw well. Not quite as funny, but still... – tylerl Jul 4 '13 at 3:17
  • The behaviour of redirecting users to "you've won" sites is not consistent with corporate or ISP redirection. This smacks of malicious intent, but could still be upstream of his device (malicious proxy?). If it is upstream, others would likely be experiencing the same thing. OP should ask around and certainly ask his IT team. – schroeder♦ Jul 4 '13 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.