asked on PC certificate store malware problem
A user has brought his home PC into the office for us to look at. It has a malware problem unlike anything I have seen before.
The user starts up the Chrome browser and is taken to his normal homepage of https://google.co.uk - but the "https" is crossed out in red, like it was an unknown SSL certificate. When I click on the SSL cert and drill down to the details, I see it was issued to *.173.194.255.255. The same thing happens in IE as well. The user is running Vista Home Premium.
I've run Malwarebytes which cleaned a number of items (including some trojans) but the problem persists. I have run Kasepersky TDS KIller but that didn't find anything.
I would be grateful for some help.
The user starts up the Chrome browser and is taken to his normal homepage of https://google.co.uk - but the "https" is crossed out in red, like it was an unknown SSL certificate. When I click on the SSL cert and drill down to the details, I see it was issued to *.173.194.255.255. The same thing happens in IE as well. The user is running Vista Home Premium.
I've run Malwarebytes which cleaned a number of items (including some trojans) but the problem persists. I have run Kasepersky TDS KIller but that didn't find anything.
I would be grateful for some help.
Anti-Virus AppsAnti-Spyware
Last Comment
actionco
Evaluate the %windir%\System32\drivers\
ASKER
The hosts files look normal - I have attached a screen print of the SSL
example.png
example.png
hi
this is a very good post from younghv:
https://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/A_1940-BASIC-MALWARE-TROUBLESHOOTING.html
this is a very good post from younghv:
https://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/A_1940-BASIC-MALWARE-TROUBLESHOOTING.html
ASKER
I've already run Malwarebytes which cleaned a number of items but did not fix the problem. Kasepersky TDS KIller did not fnd anything at all. I'll work my way through the post you gave me.
Excellent, let us know how it worked out
COuld you post the logs from MBAM?
What AV are you running on the system?
What AV are you running on the system?
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
This was the solution, not a malware infecion at all.