Warning to all - Google - Hijack Virus « Giveaway of the Day Forums

Back to Giveaway of the Day

Giveaway of the Day Forums » Software Talks

Warning to all - Google - Hijack Virus

(13 posts) (5 voices)

Started 13 years ago by Anonymous
Latest reply from Anonymous

Anonymous
Unregistered

There's a particularly nasty virus going around at the moment, that seems fairly innocuous in that it redirects Google search links to annoying 'other' search pages. It can be 'got round' by copying and pasting the link, or using Google's cached entries BUT . . .

For it's seeming 'innocence', it actually wreaks havoc behind the scenes on your computer. Anti-virus updates may fail, Anti-Malware programs will either start and crash out partway through, or display a 'you do not have permission to access' the programs, including even for CCleaner. If you reassign permissions they will NOT run properly, even if they open. System restore will be knocked out too. It will also put its own processes and files completely hidden from Windows, and set up 'backdoor' Trojans.

Prevention is better than cure, so make sure your AV and Anti-Malware definitions are kept right up to date and that you keep the AV or Windows Defender resident shield ON. As always do not open unknown .exe programs from unreliable sources (GOTD and GameGOTD are safe and always tested and are always dependably clean.)

If your computer is infected, AS SOON AS YOU CAN . . ie as soon as a Google link brings up unexpected search pages for several different links, try System Restore. If this won't run .... Don't reboot yet, or the virus will cause more damage.

Run a full anti-virus scan. This may not always remove this virus but it's worth a try. Do this in normal windows mode.

If System Restore and an AV scan haven't cured the problem, proceed as below.

To remove this particular nasty until the AV definitions catch up (even then newer versions of this virus may all too easily circumvent AV and anti-malware programs), follow the instructions below carefully.

Firstly download ComboFix HERE

Copy the text script file below exactly as is, into NotePad and save as cfscript (text file) to your desktop.

File::
c:\windows\system32\winupdate.exe
c:\windows\system32\winhelper.dll
c:\windows\system32\AVR09.exe
c:\Program Files\AdvancedVirusRemover\PAVRM.exe

Reboot into Windows Safe Mode (usually hold F8 key just after boot from CD prompt comes up), open the folder with the ComboFix download, and drag the cfscript file onto the ComboFix icon.

This will open a command prompt window and run ComboFix. Let this run. If you have a lot of drives/files, ignore the message, it will take several or many hours to run.

When it has run, reboot normally, and use the CCleaner registry cleaner to repair the Windows registry. Then Run the clean option for CCleaner. Download CCleaner FREE HERE

Reboot and your computer should be ok again. Try a few Google search links and they should be back working again as normal.

Posted 13 years ago #
graylox
Moderator

Thanks, Chazzo for the warning.

I'm not sure about how reliable the ComboFix link is. Please read the WOT reviews
http://www.mywot.com/en/scorecard/combofix.org#comment-list
http://www.mywot.com/en/forum/3883-combofix-org
I don't know anything more about ComboFix and are too tired to research now at 2 AM.
Everyone should look for warnings in the blog or forums of their AV software, to get some more info.
When you google for "ComboFix" you can see, that there are several "bad links" using the good name of ComboFix.
Here are 2 reliable links about how to use and where to get ComboFix:
1. bleepingcomputer.com

...you should download ComboFix from one of the following URLs: BleepingComputer.com InfoSpyware.net

2. majorgeeks.com: http://majorgeeks.com/Combofix_d6402.html

Good luck!

graylox

Posted 13 years ago #
Anonymous
Unregistered

did a lookup looks very old PostPosted: Thu Oct 19, 2006 9:16 am Post subject: Google Hijack virus

http://help.lockergnome.com/security/Google-Hijack-virus--ftopict10008.html

http://www.brighthub.com/internet/google/articles/72871.aspx 2010

http://www.techspot.com/vb/topic119380.html 01-06-2009

do you have a link with the info that is up to date ? most posts 2008 to 2010
Windows Safe Mode best way is > Run ' msconfig ' pick safe Mode <

Posted 13 years ago #
Anonymous
Unregistered

Thanks all, the Google Hijack virus is very prevalent at the moment, and the latest versions (July 2011) of this virus defeat AVG, MalwareBytes Anti-Malware, Super Anti-Spyware and Spybot, even with latest updates for these programs, hence the warning.

The link for ComboFix does indeed direct to Bleeping Computer.com to download the latest version of ComboFix as per Graylox's link, thanks Graylox. (I am partly sceptical about WOT ratings sometimes as they are user led, and can be rated by the virus 'vendors/distributors', though WOT ratings can sometimes be a useful guide!)

Attempting to use MSConfig in Safe mode fails with recent versions of this virus, as processes and files are installed that are not in any way detectable via Windows, and MS/Sysinternals Process Explorer will not find the processes, nor are they detectable using Hijack This. It 'might' work if you reboot directly into Safe Mode and if it isn't the latest variant of this virus. Trying System Restore immediately direct from normal Windows mode is the best option to try first, if the virus hasn't knocked out System Restore.

If System Restore is already damaged, try the noted Anti-Malware programs (with latest updates), but if these don't work download ComboFix and make the new cfscript text file as above. Then reboot into Safe mode. Avoid a reboot to normal mode until you have run ComboFix in safe mode. You may find some of your programs need subsequently re-installing as the virus can also attack programs at random. If you already have ComboFix downloaded, get a new and up-to-date copy before proceeding.

Unfortunately, just rebooting into Safe mode will not disable the new 'hidden' processes nor reveal the virus files and the windows registry will still be heavily damaged.

I spent hours researching a solution on the Internet and can personally vouch that the method given works where System Restore and AV programs fail. Thankfully my PC is now cleared of this wretched and very serious virus.

ComboFix is a very powerful program and should not be used unless it has to be needed. Keep AV definitions right up-to-date and carry out a weekly AV scan. Keep your AV or Windows Defender resident shield on at all times.

Re: Hotdog3, the repair works because ComboFix is kept up-to-date and the fact that the method was posted originally in 2006, is just as relevant for 2011 with the latest version of ComboFix. The only alternative is a HD format and Windows re-install from scratch.

The latest version of the virus is becoming increasingly common indeed, and can be a nightmare to sort out otherwise without a HD Format and Windows re-install, and affects Vista SP2 and Win 7 SP1 with latest updates applied. Tackling it manually outside of Windows is notoriously difficult as it uses random filenames/locations/process names and heavily infests the Windows registry all over the place.

Hopefully in time AV programs and the other very reputable Anti-Malware programs will provide a usable workaround to tackle recent versions of this virus, but it seems to be a virus that is being released updated very regularly to defeat AV definitions and Spyware program definitions.

Posted 13 years ago #
Anonymous
Unregistered

http://www.bleepingcomputer.com/forums/topic214023.html

Let me clarify my original post.

"Google Ads" is a service offered by Google to put ads on your web site.

I was concerned that it might be confusing to us newbies that what appeared
to be a fraudulent website was being promoted on http://www.combofix.org.
so for get .com .net .org

http://download.cnet.com/Combofix/3000-8022_4-75221073.html

Posted 13 years ago #
Anonymous
Unregistered

Thanks hotdog3

The ComboFix program to tackle this virus is a very reputable tool to tackle difficult to remove viruses. Some may prefer to re-format their drive and reinstall their Windows.

ComboFix.org links to download from bleepingcomputer.com and therefore presents no problem that I am aware of!

Posted 13 years ago #
mikiem2
Moderator

Not doubting at all, is there any name(s) for this virus? Plugging "Google Hijack Virus" into Google, Bing, Microsoft's security site, McAfee etc. hasn't been helpful. The Advanced Virus Remover, winupdate.exe, winhelper.dll etc. mentioned in your script are known malware -- is this just a recent packaging or re-use of those maybe older packs, something it adds to infected systems etc.?

Posted 13 years ago #
Anonymous
Unregistered

The text script file is to specifically target these known malwares using ComboFix so is correct as indicated.

The Google hijack virus is also known as the Google redirect virus and tends to infect the driver files in computers and there is no definitive answer to this problem, as new variants happen all too frequently.

As such, and as the major AV companies have yet to find fixes themselves, it is not listed by any specific name. It is possible it might be a conglomerate of viruses that act similarly. We'll know more when the big AV players have resolved this particular little nasty!

My understanding is that the virus may install a TDSS rootkit. My own experience is to avoid using Spyware Doctor at all costs as this has previously caused me far more problems than it solved. If other attempts fail to clean your computer download TDSS KIller from the Kaspersky link (with instructions) HERE.

In my case the virus had planted a hidden locked driver 1224210415.sys which web searched for produced no results, suggesting it is likely to have been randomly generated by the virus and will be deleted on reboot after selecting delete on the drop-down menu (by the word skip) in TDSS Killer.

I would also suggest re-installing web browsers as these can also remain infected after other clean-ups.

Posted 13 years ago #
mikiem2
Moderator

My understanding is that the virus may install a TDSS rootkit.

Thanks!
Found this on their site as well TDL4 – Top Bot
Scary stuff.

I had been watching these 2 from Microsoft Trojan:Win32/Popureb.E http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Popureb.E & Don’t write it, read it instead! , which sounds similar. If you track this stuff, might also be interested in shadowserver.org, FWIW.

---EDIT---
Thanks for your contribution.
I edited the links; please don't post those short links, insert the original links instead, that makes moderation easier and the users see, where the link goes.
graylox

Posted 13 years ago #
Whiterabbit-uk
Games Guru

Thanks guys for this info. Missed it when you first posted three days ago. I'd better warn my son who isn't as safe a browser as me.

Posted 13 years ago #
mikiem2
Moderator

Thought this might interest in the same vein
http://www.neowin.net/news/google-adds-malware-warning-to-search

As chazzo125 was talking about Google searches getting waylaid, & detection requiring maybe a bit of effort, maybe what the article talks about is something easy that those less concerned by this sort of thing would use?

Posted 13 years ago #
Anonymous
Unregistered

Thanks Mikiem 2, I'm very glad to see that Google are now sufficiently concerned about this particular virus or family of viruses to take advisory action themselves to let users know if their Google search result links are being compromised.

Google state that they are themselves aware of 2 million computers being attacked, though I would reckon many millions more computers have been affected that Google themselves do not know of.

I hope this in turn leads to the major Anti-Virus companies now tackling this issue, given that the virus infects Windows drivers, sets up files and processes that are totally hidden from Windows, and sets up illicit root kits. (i.e. it's one of the nastier virus variants around!)

It is very important that everyone has their anti-virus updated regularly (most do this automatically) and that a short scan is carried out at least weekly. It's not a bad idea to carry out a full AV scan monthly too.

Given various issues with AVG, Avira and Avast, include performance hits, I use Microsoft Security Essentials which is freely available from Microsoft to all validated and activated Windows users HERE.

Don't attempt to have more than one full AV program running, but do keep the AV resident shield on.

MalwareBytes AntiMalware is free and the easiest to use of anti-malware programs for non-tech savvy users, though the free version does have to be updated manually. Again a weekly update and scan helps keep your computer clean. You can download this HERE or HERE.

CCleaner, while not directly removing threats helps, used regularly by keeping your computer free from junk files and cleaning Windows temp files that can carry threat viruses and malware. Again it's very easy to use (doesn't remove important settings if you leave the checkboxes as default - though you might wish to uncheck clear browser history boxes!) and can be found HERE - it's free, use the FileHippo or Piriform download links below the version number.

Unfortunately, once a computer is infected by this virus, ordinary folk might need to get someone who is tech-savvy to help or pay to get their computer cleaned professionally, as removing rootkits and such-like does need expertise. I have listed steps that need to be taken in my previous posts in this threat, but if anyone is in any way unsure or hesitant in carrying out these cleaning steps (eg if you don't know how to use Windows Safe mode), find someone who is, or put your computer into your local computer repair shop!

Posted 13 years ago #
Anonymous
Unregistered

http://en.wikipedia.org/wiki/Password_strength

http://www.pctools.com/kb/article/protection-software-how-to-remove-tdss-related-web-search-redirection-threats-266.html

https://secure.wikimedia.org/wikipedia/en/wiki/Intrusion-prevention_system

https://secure.wikimedia.org/wikipedia/en/wiki/Intrusion-detection_system

Free Intrusion Detection Systems

Posted 13 years ago #

RSS feed for this topic

Reply

You must log in to post.