Advanced Infections
Advanced Automatic Removal
The purpose of a virus is to self-replicate, thus it will leave your computer in a mostly-operational form, as it uses it to spread itself.
Spyware and Adware need the computer mostly working, because if you're not using it, then spying on your habits and displaying advertisements is useless.
That said, there are a few, horribly, horribly nasty types of infection, that render your computer almost useless, can redirect your web browser to it's own pages, restore themselves from a half-removed state, and refuse to let you do anything useful until you pay them. They're holding your computer ransom with a nuculear bomb, so to speak, and require special tools (SWAT TEAM!) to take care of.
They can be called many names, but a main classification of them can be called Smitfraud, Virtumonde, and Vundo.
http://urlcut.com/fixer_of_rogues
That is an updated tool that will attempt to remove all known deep infections. Follow all the instructions exactly (remember safe mode when it says to!) and give it time to do it's job.
After downloading it, open a folder, any folder. Go to "Tools" at the top menu, and click "Folder options". When a new window comes up, go to the the "view" section. Find and
UNcheck "hide file extensions for known types", save the changes. Then rename the text file you got from roguefix from .txt to .bat, that way you can run it. Feel free to recheck the box afterwards, it's only needed to be off so that you can run roguefix.
If you cannot run that one, try these backups.
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
http://siri.geekstogo.com/SmitfraudFix.php
Fixing Redirections
DNS is "Domain Name Server". A DNS server keeps information which web address relates to which IP address on the internet (like how google.com is 74.125.45.100). It's sort of like how "Jack's house" means "123 Oak Tree Lane" in the real world.
A - Cleaning Your Hosts File
The HOSTS file is a file on windows that holds information about DNS entries on your own computer, it's usually used to bypass a normal DNS server for whatever reeason. Usually it's only used to block things (by making the browser try to go to a non-internet IP address when you try to visit a specific site), like to block bad sites, or your parents might use it to block myspace or something. Unfortunately infections will add entries that make real sites redirect to fake sites... so this might need to be undone.
If you're on XP...
In your start menu, go to "run".
Type in the below code,
without spaces.
% Windir % /System32/drivers/etc/
Press enter, a window show open. In there, find a "hosts" file. Right-click it, "open with", and open it in notepad.
If you're on Vista...
1) Browse to Start -> All Programs -> Accessories
2) Right click "Notepad" and select "Run as administrator"
3) Click "Continue" on the UAC prompt
4) Click File -> Open
5) Browse to "C:WindowsSystem32Driversetc"
6) Change the file filter drop down box from "Text Documents (*.txt)" to "All Files (*.*)"
7) Select "hosts" and click "Open"
If you see any mention of sites you KNOW are safe (if it mentions safer-networking.org or ebay.com other sites you know of, especially ones you'd download security software from or that the infections is blocking you from visiting), then you'll want to remove them.
Start by erasing all of those bad lines. Go to save it, and when you do,
make sure you click the "save as type" box when saving, and select "all files", then save the file as "hosts"
without the ".txt" ending. If that fails for some reason, and you know you don't need any of the redirects in the hosts file, just delete it. See if you can get to the websites again after you're done with that. If not, restart back into safe mode and try again.
B - Changing DNS server.
If your HOSTS file is clean and you're still getting redirected, then your computer has been set to use a different DNS server, instead of the clean one run by your internet company. These other DNS servers are usually bad, directing you to fake sites instead of real ones (like telling you that Jack's house is in the middle of a highway, instead of giving you the real address).
To get around that, here's instructions on using a clean DNS server.
Link to thread is here!
Rootkit Removal
If both those special programs and a normal virus and spyware scanner all failed, you may have a rootkit, which hides files from other scanners. If that's the case, read on.
Download and run this rootkit detector. Do not just "run" it, but actually save it somewhere you can get it, and then run it.
hftp://ftp.f-secure.com/anti-virus/tools/fsbl.exe
Run it, and it will scan for things that are hidden to windows and normal programs. When it's done, it'll have a list of results. Look at a result, and look for it with a search engine like google or yahoo (search for the file/folder name along with the word "rootkit" ), and if the results involve a type of infection (spyware, adware, rogue software, malware, virus, trojan), you should see a removal guide.
Not everything it finds is bad! Some are involved with programs you know are safe (like firefox) or part of windows itself. When it's done, you'll find a log file where you saved the program. It will be named something like "fsbl-20090124034050.log". If some things were found, open it and show us what it says.
