Solved

virus infection www_getwindowinfo.com

Posted on 2014-04-01
27
448 Views
Last Modified: 2014-05-05
I have a severe virus infection, www_getwindowinfo/  It redirects and takes over browser.

I have cleaned with Avast Boot scan,  Malwarebytes, Combofix, JRT. ADWcleaner.  And thought I had removed it.  The next day is was back.  Those tools took out significant infection files, but still have the problem.

Appreciate help.
0
Comment
Question by:DwEckert
  • 8
  • 7
  • 5
  • +2
27 Comments
 
LVL 10

Expert Comment

by:Scott Thomson
ID: 39971101
go to start > run
Type msconfig
make sure there is nothing botting up in the startup

Also make sure that if you run a scan you turn off system restore. viruses tend to hide themselves in there.
0
 
LVL 10

Expert Comment

by:Scott Thomson
ID: 39971108
0
 
LVL 90

Expert Comment

by:John Hurst
ID: 39971147
Download Process Explorer from Microsoft, install it and run it. Do you have an alphanumeric process under "explorer" (left hand side of process explorer)?  

If so, kill it, do not restart the computer and run Malwarebytes again. When it is finished, try restarting and see if the computer will start properly.
0
 

Author Comment

by:DwEckert
ID: 39971181
Scott:  Found a few things in MS Config that does not look like it belongs there,  Turned off and rebooted, the virus came back immediately.

John: now running a full Malwarebytes scan with the Recovery turned off.  (And looking for rootkits)  Downloaed Process Explorer and did not see any process under explorer that could be turned off.

Hope this finds something.
0
 
LVL 10

Expert Comment

by:Scott Thomson
ID: 39971197
Check out the guide DwEckert

that will remove it perfectly. :)
0
 

Author Comment

by:DwEckert
ID: 39971230
Scott, the guide is confusing to me.  They show two lists, one is a bunch of files in
%AllUsersProfiles%, and the other is some registry settings.

I'm not sure what to do with those.  They just list them but don't explain what to do.  Should I assume they are a list to be deleted?

Dan
0
 
LVL 91

Expert Comment

by:nobus
ID: 39971509
just above the lists it says clearly "to be removed" or "to be deleted"
0
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39971774
Here is a comprehensive list of items to check:

1. Go to All programs, Administrative Tools, Event Viewer. Check the System and Application sections for errors that may be causing your problems.

2. Install Process Explorer to find out what runs at startup
http://technet.microsoft.com/en-us/sysinternals/bb896653

3. If you haven't also ready checked for Viruses, update your virus definitions and run a Full Scan, deleting all virus and spyware detected

4. If you don’t have any Anti Virus installed, here are a few free ones to try:
http://www.avg.com
http://www.avast.com/en-us/index
http://windows.microsoft.com/en-us/windows/security-essentials-download
http://www.bitdefender.com/solutions/free.html

5. If spyware is found, download and run these free anti spyware apps
www.malwarebytes.org
www.superantispyware.com
www.hitmanpro.com

6. Run a Disk Cleanup: Start, All Programs, Accessories, System Tools, Disk Cleanup.
Include Temporary Internet Files and Temp files

7. Run Error Checking: Start, Computer, right click  on C:\, Tools, Error Checking.
Select "Automatically fix file system errors" and click start

8. Check for all programs that start at Boot: Start, Run, type MSCONFIG, on the startup tab, review the programs listed. Uncheck anything that should not run on startup

9. Defrag all hard drives: Click My Computer, right click the C drive, click Tools, Disk Defragmenter, Click Analyze to check the amount of fragmentation or Defrag to run the process. You repeat this per drive.

General Maintenance to keep your pc up to date
1. Run Windows Update and select all Microsoft updates and security patches

2. Update your Pc's System Bios

3. Update your drivers: Motherboard Chipset, Network Adaptor, Video, Audio & Printers
0
 

Author Comment

by:DwEckert
ID: 39974979
Scott, I've traced and searched for all the files and keys listed in the Tee Support Blog you have referenced.  I only found one of those listed in this pc:
"HKey_current_user_\software\Microsoft\windows\currentversion\explorer\advanced\hidden=0.

I deleted that key but the problem came back immediately.

I have done a full system rescan with Malwarebytes and It found 0 issues.

Internet Explorer has responded immediately with http:/www_getwindowinfo/

Avast is showing the following pop up warning:  "infected Block"  "h_domainsa_com_landing_?affld

A second Avast warning:  Object: http/..../?affld=ICIN9jAdomainname=www
Infestion URL:Mal
Process C:\Program Files (x86).... \explorer.exe

I feel like I'm stuck here.  Please help.

Dan
0
 
LVL 90

Expert Comment

by:John Hurst
ID: 39975055
I left you steps for Microsoft Process Explorer. Did you try those steps?
0
 
LVL 91

Expert Comment

by:nobus
ID: 39975188
0
 
LVL 90

Expert Comment

by:John Hurst
ID: 39975196
If nothing works, then try a Windows 7 Repair Install. That might work. The best repair for "nothing works" is to back up your data, delete all partitions on the hard drive, format and reinstall Windows. Then add applications and restore data.

Tutorial for Repair Install:  http://www.sevenforums.com/tutorials/3413-repair-install.html
0
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39975286
It sounds like you have a rootkit virus which is very imbedded into windows. The best resolution is to back up your data, reformat the drives, do a clean install, install multiple spyware scanners and scan your data before restoring it.  Rootkits can be virtually impossible to delete
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 91

Expert Comment

by:nobus
ID: 39975590
echo ?
0
 

Author Comment

by:DwEckert
ID: 39975609
Trying a couple anti rootkits that I haven't used yet.   I'll report back.

Currently running Malwarebytes Rootkit tool.
0
 

Author Comment

by:DwEckert
ID: 39977050
I've run Sophos Anti Rootkit, Kapersky TDSSKiller, Avast awsMBR,  GMER, & Bootdefender Anti Rootkit.

Sophos found one rootkit infection, but it did not stop the browser problem.  All the others came up clean.  Absolutely noting found.

Internet Explorer ver. 11 still opens automatically every 5 to 6 seconds with
http://www_getwindowinfo/  and a large page of advertising for Luxury Cruises, Lifelock Series & High School Yearbooks. in  5 to 6 seconds.   Close The browser page and 6 seconds later it's back.

Firefox browser works fine.

Where do we go from here?

Dan
0
 
LVL 90

Expert Comment

by:John Hurst
ID: 39977788
Time to try the Repair Install as I outlined above.
0
 
LVL 91

Accepted Solution

by:
nobus earned 250 total points
ID: 39977838
as long as there are infections, i would not repair the OS
imo - make it clean somehow - - or do a fresh install (= backup data first).
you can also use the factory restore option!
0
 
LVL 90

Assisted Solution

by:John Hurst
John Hurst earned 250 total points
ID: 39977896
Yes I suggested a fresh clean install earlier but it may be worth repairing first to see.
0
 

Author Comment

by:DwEckert
ID: 39979553
Starting a full clean install.  Using the HP Factory Restore.  Will report back when completed.
0
 
LVL 91

Expert Comment

by:nobus
ID: 39979705
that is surely the wisest decision
0
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39980065
Good to hear you took my advise and performed a clean install. How is it working now?
0
 

Author Comment

by:DwEckert
ID: 39980081
In the middle of updates past sp1, a reinstall of Office and 6 gig of data plus numerous tools and AV.  Scanned three flash drives of b/u for bugs.  So far no reoccurrence of the rootkit.

Will report back when done.
0
 
LVL 25

Expert Comment

by:Tony Giangreco
ID: 39980083
It sounds like your already doing better!
0
 
LVL 91

Expert Comment

by:nobus
ID: 39980130
it would be a wonder if he was not now..:-))
0
 

Author Closing Comment

by:DwEckert
ID: 40043237
Good job.  Thanks for the help.
0
 
LVL 91

Expert Comment

by:nobus
ID: 40043709
tx for feedback
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

My purpose is to describe the basic concepts of virtual memory as implemented in a modern Windows-based operating system. I will also describe the problems inherent in older systems and how virtual memory solves them. The dark ages - before virtu…
The password reset disk is often mentioned as the best solution to deal with the lost Windows password problem. In Windows 2008, 7, Vista and XP, a password reset disk can be easily created. But besides Windows 7/Vista/XP, Windows Server 2008 and ot…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now