Your browser has been hijacked. Malwarebytes or any of the malware removal
programs will not undo your browser settings, so the problem will most
likely remain, and the infections will probably return next time you use
your browser (which is accessing your internet via malicious or spyware
sites).
There are 3 steps you need to take to do a proper job of malware removal:
1. Run a scan with Malwarebytes (it's pretty much the industry standard
these days) or whatever alternative malware protection you might have.
Make sure it's fully updated first, as some of these malware may prevent
updating and thus protect themselves from removal. Note that none of the
antivirus programs that I'm aware of will give you much protection against
this type of malware---this despite their advertised "internet
safety/security"!
2. Make a note of the results, and run Regedit to search for and remove
whatever malicious entries may be left behind. Although Malwarebytes is
pretty good at removing these things, it's not always perfect, and you have
to remember that the bad guys are always going to be a jump ahead. Be very
careful here---removing wrong registry entries could result in a corrupted
Windows. Also, Apple unfortunately uses the name "Conduit", so there's
often no easy way of telling whether the numerous Conduit registry entries
are legitimate or not. Leaving bad registry entries my result in the
malware re-constituting themselves.
3. Go into your browser settings (I'll use Google chrome browser as an
example, as it's the simplest and safest---if you're using an old browser
like Internet Explorer, you may not be able to do this).
Open Extensions, and delete all unwanted items. Personally, I like to
remove ALL extensions, even the legitimate Google ones such as Google
docs--unless you actually use them.
This is the place where the hijackers will first show themselves, often
under disguised names---common ones are TV Fanatic, various Downloaders and
Speedups,Conduit---there are thousands of them.
When you open your browser, you will usually get an idea of what's causing
the damage by seeing what comes up in the address line at the time.
eg. If you've been hijacked by the very common Ask.com, you will see an Ask
logo, and the address line of the website you are in will be preceded by
Ask.com or Sweetim.com---Ask.com/Youtube for example. That's then an open
invitation to the fraud and spyware criminals to enter your computer.
4. Finally, delete all desktop shortcuts to your browser and don't create
new ones until you're sure the infections are gone.
An aside:
Relating to (4) above, I was tearing my hair out a while back while
cleaning out a badly infected computer. The browser had been hijacked by
the SweetIM family. After numerous attempts at 1-3 above and reboots, every
time I opened Chrome, there was SweetIM back in the address line. Finally I
figured out that it must be something to do with the shortcut, as all
other possibilities had been eliminated. When I opened the shortcut
properties, I saw that the target was set at "SweetIM.com/....". Simple,
but VERY effective! Using the old shortcut simply started the cycle again.
Some computer shops will just do a simple Malwarebytes scan and clean. It's
cheap, but may result in the malware returning unless all the above steps
are followed. The registry searching can be very time-consuming, as you can
only search one name at a time, so don't expect a good computer repairer to
do it cheaply.
If the computer has been running for too long in an infected state, it may
get so bad that a complete clean becomes impossible, in which case Jacob's
suggestion of a reformat and new Windows installation is the best way to go
in the end.
The worst I've seen recently was over 4200 trojan entries (That doesn't
necessarily mean 4200 different trojans, as one trojan might have say 100
different files/registry locations). And that particular computer was
running one of the biggest brand-names antivirus/internet suite for which
the owner had recently taken out a 3-year subscription at some exorbitant
price. She was not very happy, and even less happy when I told her that she
was effectively only paying for something already built into Chrome and
Windows 10. By the time she'd decided to get some professional advice,
this computer had practically ground to a stand-still and was virtually
unusable.
DonPenlington
On Sat, Jul 16, 2016 at 4:15 AM, Jacob Smith <[log in to unmask]> wrote:
> Two options with all malware problems: try to remove it, which can be
> tedious and leave a damaged system, or reinstall Windows. If you prefer the
> former, as most do, I recommend using Panda free, SuperAntiSpyware, Avira,
> Malwarebytes, and Spybot serach and destroy (NOT 2). Try any or all of
> these to remove the malware.
>
> On Thu, Jul 14, 2016 at 3:18 PM, Wanda Borup <[log in to unmask]> wrote:
>
> > I have an HP desktop computer and have a huge problem. I have malware or
> > something on my computer that is taking me to sites I didn't want to go
> to.
> > If I'm on a site, say Amazon, and I click on something on Amazon it takes
> > me
> > to some random site. What should I be doing to fix this??? Any help
> will
> > be greatly appreciated.
> >
> >
> >
> > Sincerely,
> >
> >
> >
> > Wanda B.
> >
> >
> >
> > ---
> > This email has been checked for viruses by Avast antivirus software.
> > https://www.avast.com/antivirus
> >
> > PCSOFT's List Owners:
> > Bob Wright<[log in to unmask]>
> > Mark Rode<[log in to unmask]>
> >
>
>
>
> --
> Blessings,
> Jacob Smith
>
> PCSOFT's List Owners:
> Bob Wright<[log in to unmask]>
> Mark Rode<[log in to unmask]>
>
>
PCSOFT's List Owners:
Bob Wright<[log in to unmask]>
Mark Rode<[log in to unmask]>
|
