Antivirus Plus and Google Searches

Danno

Hi folks, this is a quare one. I got that malware Antivirus Plus. I managed to get rid of the rundll32.exe from the c:\windows\system folder. However, everytime I search for anything in google.ie, the results all fire me off to a malware site - for example if I search google for RTE, the search results seem fine for the RTE website but when I click the link I get re-directed.

Windows Update is blocked, whatever antivirus program I install will not update, be it AVG, aVast, Spybot S+D, HiJackThis, etc...

There seems to be constant contact with http://127.0.0.1 I have checked the TCP/IP settings and they *appear* fine. I have ran the winsock repair tool also to no avail.

My router is fine as another PC accesses the net, Windows Update, AVG Updates etc... with no issuses.

Please Help! I am perplexed as to what is going on.

_CreeD_

You might just be better off with a wipe/reinstall but if you still want to be surgical it sounds like your hosts file has been modified to blackhole the AV updates sites (by manually redirecting them to your own Loopback address (127.0.0.1)). Edit C:\WINDOWS\system32\drivers\etc\hosts and remove pretty much everything after the initial blurb (comments at the start that begin with # ), then add 2 lines after the comments:
127.0.0.1 localhost
127.0.0.1 your pcs hostname
thats all that should be there (If you run a tool like Spybot S&D later and choose to innoculate your system it will add 1000s of entries here to blackhole malware sites, but at this stage you just want a clean hosts file so just the one pointer to your own PC name and the generic name localhost)
See if you can update your AV after that and get things moving again but really a format would be my choice at this stage.

samhail

also if there is contact with your computer (127.0.0.1) then you would most likely have a server of some sort running - which i would look at first before cleaning the HOSTS file as this program may automatically reinfect that file.

AV: could check out http://housecall.trendmicro.com/ which will scan from online.

First place i would look would be in the registry,
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

read: http://support.microsoft.com/kb/179365 first and dont delete anything from the registry unless you are confident to do so </disclaimer >

check the statup folder in the start menu, and any autoexec.bat type programs in c:\

Danno

Hi guys, thanks for the replys. Funnily enough MalwareBytes AntiMalware was unblocked and ran, cleaned 9 infections and everything is back right. Wierd one indeed.