01-10-2012 05:46 PM
Yesterday I was hit with the Win 7 2012 virus. I was able to run a scan with Norton and Kapersky in normal mode to eliminate the virus and then re-ran them in safe mode to eliminate anything that had been hiding within a normal boot. I had taken a look through my registry to see if anything there looked amiss. I didn't see anything that could be causing a problem but I am still plagued by something that is causing search engines to redirect to random websites. I was wondering if anyone has any ideas/tips to deal with this. Through research I think it's a rootkit....TDSS I've read is sometimes hand in hand with the win 7 2012 virus. I've tried running TDSSkiller through Kapersky as well and am at a loss of what to do next.
I'm not tech savvy on my own but can be walked through anything!
01-15-2012 05:44 PM - edited 01-15-2012 05:47 PM
Sorry for the late reply. The Redirect happens with what browser?
Can try other browsers like chrome/firefox? http://www.whatbrowser.org/en/browser/
Some malware camouflage themselves as cdrom.sys, particularly if they are located in c:\windows or c:\windows\system32 folder, Because the legit File cdrom.sys is located in the folder C:\Windows\System32\drivers.
So in the NPE results click on the filename and click Locate file location, If the location is C:\Windows\System32\drivers -> leave that file and try with anoter browser and let us know. If the location is c:\windows or c:\windows\system32 ->Fix it and do a restart and let us know the outcome.
01-15-2012 09:49 PM
There is a Rootkit that has Websearch as it's redirect at the momnent and chooses one of 3 drivers to patch, one being cdrom.sys. Which is a Windows file but has been infected.
But only for 32 bit (x86) systems
Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
NPE (Norton Power Eraser) does not have the ability to deal with disinfecting this infection, but can generically detect the change in the file.
With System Restore turned on the patched driver also gets backed up in the restore points.