[Vonatar]

2 days ago I got infected with the Your Protection and Antimalware Doctor malware from browsing the net using IE. I followed some instructions online for removing it which involved using Malwarebytes and CC Cleaner. It seems to be gone but I have a couple of lingering issues.

First off, I've started using Firefox now and just noticed that it redirects my Google searches. It was largely redirecting me to Ask Jeeves or to other supposed search sites that I didn't recognise. I did some searching for fixes and used Hitman Pro 3.5 as suggested by some. This has almost solved the problem - most Google searches are not redirected, but I noticed that the occasional one still is, again to some unknown search site. I am now concerned that I still have some infection. Malwarebytes, Adaware, AVG and Spybot have all come up clean.

Also, even though I am using Firefox, a couple of times last night I got a window saying that IE needed to install something (first time it was a Skype plug-in and 2nd time something else, a .dll file). The window gave the options of "View Message" or "Ask me later". If I clicked View Message my screen went black and then it showed IE in the background with a random page displayed and asked me to install something. I was able to exit and get back to desktop without installing anything (knowingly), but this seemed strange to me.

Secondly, I ran a performance check from control panel and one of the items it picked up was that I was running more than 1 anti-virus program. It listed AVG 9 (the one I use) but also Your Protection (though without showing a file path, as it did for AVG). I wondered if this means I still have some lingering registry entry for Your Protection?

Any help much appreciated.

Edited by Vonatar, 09 April 2010 - 04:22 AM.

[Advertisements]

Please go to the malware forum and follow the instructions at the top....Especially the CLICK HERE.

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post an OTListIt log in THAT forum.

[Rorschach112]

Please go to the malware forum and follow the instructions at the top....Especially the CLICK HERE.

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post an OTListIt log in THAT forum.

[Vonatar]

Thanks, I will go through the steps when I get home tonight and post an OTListit log.

[Vonatar]

Thank you thank you! You guys are the best!

I followed your steps for removing the Google redirect and the TDSS killer found a instance that had been left behind by Malwarebytes' removal of the Your Protection virus. Now all seems to be working fine - google no longer redirects and my system doesn't think I have anti-virus installed besides AVG. It's made my weekend

[Vonatar]

[bleep], I spoke too soon. Just noticed Firefox starting redirecting again, and running the TDSS killer showed the same file as infected...again. So I rebooted and ran TDSS and it still showed that file as infected, so it's not cleaning it. I'm back where I started

[rshaffer61]

You need to go to the next step in the malware forum and post all new logs in a new topic in that forum. This will allo the malware techs to look deeper in your system as it seems the infection is hidden.