• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 473
  • Last Modified:

virus infection www_getwindowinfo.com

I have a severe virus infection, www_getwindowinfo/  It redirects and takes over browser.

I have cleaned with Avast Boot scan,  Malwarebytes, Combofix, JRT. ADWcleaner.  And thought I had removed it.  The next day is was back.  Those tools took out significant infection files, but still have the problem.

Appreciate help.
0
DwEckert
Asked:
DwEckert
  • 8
  • 7
  • 5
  • +2
2 Solutions
 
Scott ThomsonCommented:
go to start > run
Type msconfig
make sure there is nothing botting up in the startup

Also make sure that if you run a scan you turn off system restore. viruses tend to hide themselves in there.
0
 
Scott ThomsonCommented:
0
 
JohnBusiness Consultant (Owner)Commented:
Download Process Explorer from Microsoft, install it and run it. Do you have an alphanumeric process under "explorer" (left hand side of process explorer)?  

If so, kill it, do not restart the computer and run Malwarebytes again. When it is finished, try restarting and see if the computer will start properly.
0
Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

 
DwEckertAuthor Commented:
Scott:  Found a few things in MS Config that does not look like it belongs there,  Turned off and rebooted, the virus came back immediately.

John: now running a full Malwarebytes scan with the Recovery turned off.  (And looking for rootkits)  Downloaed Process Explorer and did not see any process under explorer that could be turned off.

Hope this finds something.
0
 
Scott ThomsonCommented:
Check out the guide DwEckert

that will remove it perfectly. :)
0
 
DwEckertAuthor Commented:
Scott, the guide is confusing to me.  They show two lists, one is a bunch of files in
%AllUsersProfiles%, and the other is some registry settings.

I'm not sure what to do with those.  They just list them but don't explain what to do.  Should I assume they are a list to be deleted?

Dan
0
 
nobusCommented:
just above the lists it says clearly "to be removed" or "to be deleted"
0
 
Tony GiangrecoCommented:
Here is a comprehensive list of items to check:

1. Go to All programs, Administrative Tools, Event Viewer. Check the System and Application sections for errors that may be causing your problems.

2. Install Process Explorer to find out what runs at startup
http://technet.microsoft.com/en-us/sysinternals/bb896653

3. If you haven't also ready checked for Viruses, update your virus definitions and run a Full Scan, deleting all virus and spyware detected

4. If you don’t have any Anti Virus installed, here are a few free ones to try:
http://www.avg.com
http://www.avast.com/en-us/index
http://windows.microsoft.com/en-us/windows/security-essentials-download
http://www.bitdefender.com/solutions/free.html

5. If spyware is found, download and run these free anti spyware apps
www.malwarebytes.org
www.superantispyware.com
www.hitmanpro.com

6. Run a Disk Cleanup: Start, All Programs, Accessories, System Tools, Disk Cleanup.
Include Temporary Internet Files and Temp files

7. Run Error Checking: Start, Computer, right click  on C:\, Tools, Error Checking.
Select "Automatically fix file system errors" and click start

8. Check for all programs that start at Boot: Start, Run, type MSCONFIG, on the startup tab, review the programs listed. Uncheck anything that should not run on startup

9. Defrag all hard drives: Click My Computer, right click the C drive, click Tools, Disk Defragmenter, Click Analyze to check the amount of fragmentation or Defrag to run the process. You repeat this per drive.

General Maintenance to keep your pc up to date
1. Run Windows Update and select all Microsoft updates and security patches

2. Update your Pc's System Bios

3. Update your drivers: Motherboard Chipset, Network Adaptor, Video, Audio & Printers
0
 
DwEckertAuthor Commented:
Scott, I've traced and searched for all the files and keys listed in the Tee Support Blog you have referenced.  I only found one of those listed in this pc:
"HKey_current_user_\software\Microsoft\windows\currentversion\explorer\advanced\hidden=0.

I deleted that key but the problem came back immediately.

I have done a full system rescan with Malwarebytes and It found 0 issues.

Internet Explorer has responded immediately with http:/www_getwindowinfo/

Avast is showing the following pop up warning:  "infected Block"  "h_domainsa_com_landing_?affld

A second Avast warning:  Object: http/..../?affld=ICIN9jAdomainname=www
Infestion URL:Mal
Process C:\Program Files (x86).... \explorer.exe

I feel like I'm stuck here.  Please help.

Dan
0
 
JohnBusiness Consultant (Owner)Commented:
I left you steps for Microsoft Process Explorer. Did you try those steps?
0
 
nobusCommented:
0
 
JohnBusiness Consultant (Owner)Commented:
If nothing works, then try a Windows 7 Repair Install. That might work. The best repair for "nothing works" is to back up your data, delete all partitions on the hard drive, format and reinstall Windows. Then add applications and restore data.

Tutorial for Repair Install:  http://www.sevenforums.com/tutorials/3413-repair-install.html
0
 
Tony GiangrecoCommented:
It sounds like you have a rootkit virus which is very imbedded into windows. The best resolution is to back up your data, reformat the drives, do a clean install, install multiple spyware scanners and scan your data before restoring it.  Rootkits can be virtually impossible to delete
0
 
nobusCommented:
echo ?
0
 
DwEckertAuthor Commented:
Trying a couple anti rootkits that I haven't used yet.   I'll report back.

Currently running Malwarebytes Rootkit tool.
0
 
DwEckertAuthor Commented:
I've run Sophos Anti Rootkit, Kapersky TDSSKiller, Avast awsMBR,  GMER, & Bootdefender Anti Rootkit.

Sophos found one rootkit infection, but it did not stop the browser problem.  All the others came up clean.  Absolutely noting found.

Internet Explorer ver. 11 still opens automatically every 5 to 6 seconds with
http://www_getwindowinfo/  and a large page of advertising for Luxury Cruises, Lifelock Series & High School Yearbooks. in  5 to 6 seconds.   Close The browser page and 6 seconds later it's back.

Firefox browser works fine.

Where do we go from here?

Dan
0
 
JohnBusiness Consultant (Owner)Commented:
Time to try the Repair Install as I outlined above.
0
 
nobusCommented:
as long as there are infections, i would not repair the OS
imo - make it clean somehow - - or do a fresh install (= backup data first).
you can also use the factory restore option!
0
 
JohnBusiness Consultant (Owner)Commented:
Yes I suggested a fresh clean install earlier but it may be worth repairing first to see.
0
 
DwEckertAuthor Commented:
Starting a full clean install.  Using the HP Factory Restore.  Will report back when completed.
0
 
nobusCommented:
that is surely the wisest decision
0
 
Tony GiangrecoCommented:
Good to hear you took my advise and performed a clean install. How is it working now?
0
 
DwEckertAuthor Commented:
In the middle of updates past sp1, a reinstall of Office and 6 gig of data plus numerous tools and AV.  Scanned three flash drives of b/u for bugs.  So far no reoccurrence of the rootkit.

Will report back when done.
0
 
Tony GiangrecoCommented:
It sounds like your already doing better!
0
 
nobusCommented:
it would be a wonder if he was not now..:-))
0
 
DwEckertAuthor Commented:
Good job.  Thanks for the help.
0
 
nobusCommented:
tx for feedback
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

  • 8
  • 7
  • 5
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now