Redirect Virus (...sad face)

[Megg81]

Im stuck with this one!

A couple of months ago I (stupidly) downloaded a Youtube Downloader and wound up with a pile of other programmes too which must have been bundled in there. Youtube Downloader wouldn't uninstall - simply reinstalling its self again right after. Eventually I decided to roll back the system to an earlier restore point before the installation.

Chrome then started redirecting to Yahoo search on every new tab opened. Something which I managed to fix in settings and that was the end of it. Yesterday it started all over again, but now affecting Chrome, IE & Firefox.

I've learned its a virus and I've followed instructions which seems to have gotten rid of it for most ppl... but still there for me (****)

Have checked the DNS settings, nothing is changed.
Have found an additional line in Localhost and deleted it, but problem still happens.
Have run full virus scan with McAfee, nothing found.
Have changed default settings in Chrome, doesn't stop the redirect.
Have downloaded and run Kerpasky TDSS Killer, didnt find anything.
Am currently running Windows Defender
Have searched for Spigot, folder not found.
Didn't install any new software yesterday or any updates manually

Any suggestions on what to try next ??!

I've no idea if this is a recurrence of the earlier problem linked to Youtube Downloader or whether it's something that appears similar and is unrelated

[Albacore]

Why not go to Norton's site and download one of their malware and virus deep scans to get rid of this crap. Try the Power eraser first and you can download here: https://security.symantec.com/nbrt/o...aspx?lcid=1033 here:https://security.symantec.com/nbrt/o...aspx?lcid=1033

[zaphodeist]

Try running TDSS killer then MBAM [ FREE version - https://www.malwarebytes.org/ ] in Safe Mode then in Chrome settings look under 'On Start-up' and 'Manage Search Engines'

Further to that if needed [some bits the same]

from here :- http://botcrawl.com/how-to-remove-th...edirect-virus/

Uninstall browser attachments - Use the correct procedures to uninstall unwanted add-ons, extensions, and Toolbars responsible for the Google redirect (2 options)
Scan computer for malware - Scan for and remove additional malware infecting your computer, causing unwanted redirections
Automatically repair browser settings - Automatically remove hijacked browser settings and automatically uninstall unwanted software and browser attachments
Manually remove unwanted homepage
Manually remove unwanted search engine
Repair Windows hosts file
Repair Domain Name Server (DNS)
Repair proxy settings

[masque]

In internet explorer go to Internet Options > Advanced Tab and RESET. Got rid of some prat's crap for me a little while ago.
Derek

[gwpriester]

These things are insidious. You can remove the extension from your browser but they embed themselves in the registry and all over the place.

I have stopped downloading anything that is free because stuff like this is happening more and more.

It happened when I downloaded a free trial copy of Serif Page Plus!

[zaphodeist]

With a friend's laptop I did a restore to factory defaults. Quick and effective Mind you, he had nothing to keep except a few photos and didn't have loads of programs to re-install.

[mhjgkane]

First port of call is MalwareBytes anti-malware free.

If it finds anything in the registry it will request to reboot the PC so that it can deal with them before they can load.

Failing this and providing you have one, you could restore to a point before you downloaded the software, then run MalwareBytes anti-malware as a follow up.

Good luck.

[gwpriester]

MalwareBytes is good but not enough. It will get rid of a lot of the redirects but not all.

[handrawn]

These things are insidious.
It happened when I downloaded a free trial copy of Serif Page Plus!

if you install xara designer pro x you get 'simpelcheck' installed unasked for - now I would hesitate to call that insidious in a harmful way, but I would call it bad practice because you are not told - you can if you think of it choose custom install and untick, but again it should not be ticked by default: bad practice - can't remember if it is still the case in ver 9, but the point is that is still 'insidious' in a sneaky way

the harmful stuff should usually be picked up by a first-class security suite [you need the full thing, not just the basic anti-virus] when you start to install if not when you actually download, and of course once you have downloaded it you should still run a scan on it before you install it just in case, preferably with a different security product

I make full images to go back to [with acronis true image] - I have only once in well over ten years found windows restore to be at all useful

[Megg81]

Thanks all for your replies.

McAfee is up to date, but this one still managed to get past... twice.

I've changed the default tab settings in chrome - and it's remained as Google instead of Yahoo. But I know this damn thing is still installed somewhere. I've just changed a setting to prevent the redirect showing, but I've not managed to find the programme or get rid of it.

The mouse has started acting funny too - not every click works, or it works but does the wrong thing. Can't help but think the two are connected.

I had further problems on my old laptop once I started downloading free antivirus to get rid of a virus I had. Ironic. So I'm cautious of downloading more free scanning software because last time I did this I ended up with even more stuff bundled in with that. Tomorrow I may look at doing system restore, but I'll have to check what the last save point was