Ads infested my browsers and driving me insane!

[Nesh]

My Labtop is probably infected by some spyware or something that cannot be detected by Microsoft Security Essentials, Spy Bot or by ESET Antivirus!

Almost any page I enter I get ads either on the bottom left or on the bottom right of the screen. Its God damn annoying.

I get this in every Internet Browser I use. Firefox? Chrome? IE? All of them. I could get rid of the problem with AdBlock add on in firefox. But it doesnt really remove the infestation. It just blocks it and I still get them in my other browsers.

Does anyone know how to get rid of this?

 

[Silent_Buddha]

Have you tried Malwarebytes Anti-Malware? I haven't really been keeping up on the anti-malware scene but that used to be a really good tool to use.

Regards,
SB

 

[Grall]

Install a good solid software firewall and block everything. Then start your browser and try to access something, see what triggers the firewall...

 

[Silent_Buddha]

Oh and one more thing. It's adviseable to run the anti-malware programs from safe mode if you aren't getting any hits. There's less chance of malware doing something dodgy to prevent detection then. There's been quite a few pieces of malware that initially could only be detected by doing that.

Regards,
SB

 

[tongue_of_colicab]

Chances are reinstalling windows will save you a lot of time and frustration compared to trying to get rid of whatever it is that infected your system. Besides, this way you can be sure you got rid of it and not have something left in the background that might still be spying on you.

 

[Davros]

also try hijack this post your logfile here
http://www.trendmicro.co.uk/products/free-tools-and-services/index.html

 

[Pete]

Or try a rescue CD (Kaspersky, BitDefender, etc). They boot from the CD / USB stick that you load their ISO onto, so they sidestep Windows entirely. Dunno whether they'll detect your particular malware or even fix it, but they're worth a shot.

 

[AlNom]

You might try this: http://live.vipreantivirus.com/

 

[Nesh]

Install a good solid software firewall and block everything. Then start your browser and try to access something, see what triggers the firewall...

Is there a good one you recommend?
:smile:

Oh and one more thing. It's adviseable to run the anti-malware programs from safe mode if you aren't getting any hits. There's less chance of malware doing something dodgy to prevent detection then. There's been quite a few pieces of malware that initially could only be detected by doing that.

Regards,
SB

Did it in safe mode. Detected two files. Deleted. Still hasnt solved the issue

also try hijack this post your logfile here
http://www.trendmicro.co.uk/products/free-tools-and-services/index.html

I am a little confused as to what I have to do

Or try a rescue CD (Kaspersky, BitDefender, etc). They boot from the CD / USB stick that you load their ISO onto, so they sidestep Windows entirely. Dunno whether they'll detect your particular malware or even fix it, but they're worth a shot.

I dont know why but I get a Boot Error with both Kaspersky and BitDefender.

You might try this: http://live.vipreantivirus.com/

Going to try that too in a few minutes. Hope that works

 

[Grall]

Is there a good one you recommend?
:smile:

Very sorry; that's beyond my area of expertise I'm afraid. I only use the standard windows firewall which most likely is not as capable as most stand-alone stuff I'd think.

Anyway, the issues you're having trying to find whatever's bugging you, sure your time wouldn't be better spent just nuking everything from orbit? After all, it's the only way to be sure.

 

[Pete]

I dont know why but I get a Boot Error with both Kaspersky and BitDefender.

I'm guessing you put the ISO on a flash drive, but did you use Unetbootln (or whatever that program is called) to get it on there in a bootable fashion? Or is your BIOS the culprit?

BTW, dunno the state of wifi (read: WPA2) implementations on those rescue CDs, but if you're near an ethernet cable, they can update themselves to the latest definitions.

Does Opera exhibit the same behavior? Just curious how comprehensive this malware is.

 

[Davros]

I am a little confused as to what I have to do

run hijackthis
better link
http://sourceforge.net/projects/hjt/files/latest/download

click scan
click save logfile
post contents here

 

[Nesh]

Viberrescue detected 4 more files which supposedly removed and/or quarantined
Still I get the ads

I'm guessing you put the ISO on a flash drive, but did you use Unetbootln (or whatever that program is called) to get it on there in a bootable fashion? Or is your BIOS the culprit?

BTW, dunno the state of wifi (read: WPA2) implementations on those rescue CDs, but if you're near an ethernet cable, they can update themselves to the latest definitions.

Does Opera exhibit the same behavior? Just curious how comprehensive this malware is.

I used the Kapersky Rescue2USB to get it into a USB just as suggested from the Kapersky site.
I dont know what is the fault. I went to the Bios and I have set the priority to the USB when trying to boot instead of CD or HDD.

IE, Firefox and Chrome exhibit the issue but I havent installed Opera yet to try it but I am sure it will have the problem

run hijackthis
better link
http://sourceforge.net/projects/hjt/files/latest/download

click scan
click save logfile
post contents here

Ok.

I have run it and I get a warning which you can see in the image attached. I believe there is something wrong with the host


Here is the log
View attachment hijackthis.zip
I suspect the following findings from the log file
O1 - Hosts: 149.5.18.172 www.google-analytics.com.
O1 - Hosts: 149.5.18.172 ad-emea.doubleclick.net.
O1 - Hosts: 149.5.18.172 www.statcounter.com.
O1 - Hosts: 108.163.215.51 www.google-analytics.com.
O1 - Hosts: 108.163.215.51 ad-emea.doubleclick.net.
O1 - Hosts: 108.163.215.51 www.statcounter.com.

Now how do I get rid of them I have no idea and I am not 100% sure its them. ANyways I do as what I am suggested by the warning window,I delete them from the notepad but it saves the log in some location, perhaps other than the one it should have because everytime I run "notepad c:\windows\system32\drivers\etc\hosts" they are still in there (paradoxically it tells me the hosts.txt file was save in that same path so it shouldnt have had these entries after I deleted them)

edit: That thing is crazy. I even deleted the Host.txt file altogether from the directory c:\windows\system32\drivers\etc\hosts and when I still type this path from "start->Run" it opens a hosts.txt file with those contents and I have no idea how on earth does it do that when the file is in the recycle bin

Am I doing something wrong?

 

[Grall]

hosts.txt is a harmless windows system file. From what I've been told, it's basically a way to completely block certain sites from being accessed. If a site is listed there, you shouldn't be able to communicate with it via IP protocol at all, at least if you're using windows' own IP stack. I've never had to use it myself, thankfully.

 

[Nesh]

So what do I do now??

 

[upnorthsox]

hosts.txt is a harmless windows system file. From what I've been told, it's basically a way to completely block certain sites from being accessed. If a site is listed there, you shouldn't be able to communicate with it via IP protocol at all, at least if you're using windows' own IP stack. I've never had to use it myself, thankfully.

No, it's the other way around. It hard codes IP addresses to host names to offset DNS.

It is however an irrelevant file and not needed. You can rename it if something is maliciously writing to it. But it's more important to find what is writing to it because that's not normal. Nothing non-malicious programatically writes to that file.

 

[tongue_of_colicab]

So what do I do now??

Format and reinstall windows.

 

[Davros]

edit your hosts file delete the following lines
O1 - Hosts: 149.5.18.172 www.google-analytics.com.
O1 - Hosts: 149.5.18.172 ad-emea.doubleclick.net.
O1 - Hosts: 149.5.18.172 www.statcounter.com.
O1 - Hosts: 108.163.215.51 www.google-analytics.com.
O1 - Hosts: 108.163.215.51 ad-emea.doubleclick.net.
O1 - Hosts: 108.163.215.51 www.statcounter.com.

go here : do steps 3/4 6 and 7
http://forums.anvisoft.com/viewtopic-45-1183-0.html

ps: how to edit hosts file
http://support.microsoft.com/kb/923947

 

[Florin]

Those entries in your hosts file are wrong, period. They shouldn't be there (but there may be other issues).

In any case, first go to Start->Control Panel->Folder Options
Make sure 'Show hidden files, folders and drives' is selected.
Deselect 'Hide extensions for known file types' and 'Hide protected operating system files (Recommended)'.
Ignore the warning. Now Explorer will actually show your filesystem the way it is.

Follow Davros' link above to get write access to 'hosts' file.

Now go to \Windows\System32\drivers\etc and edit 'hosts' with notepad. Delete those entries (basically, all lines in the file should start with a #, which means they are a harmless comment).

Save the emptied out hosts file. It will create a file called 'hosts.txt' because that is what notepad does. Delete the file called 'hosts' and rename 'hosts.txt' to 'hosts'. That should fix this.

Rerun Hijack This and make sure all the automatically starting programs and browser helper objects are legit.

 

[Davros]

also delete any files in C:\Users\Davros\AppData\Local\Temp
(replace Davros with your username)
its hidden by default