I Think I Have a Virus

[esophagus]

Anytime I go to google.ca it redirects me to a yahoo search for google. When I click the link, it tells me the website is down. For a while it was doing this to everything, but now it's just google.

My virus protection (AVG) isn't doing anything to help, and can't find it in a scan.

Have you guys heard of this, or have any ideas on what else it might be?

[tehboris]

Enter this IP address in your browse 64.233.161.104.

Then trace route it.

[-mk-]

Tried clearing out your history, cache, temporary internet files, etc.? Which browser are you using?

[esophagus]

Tried clearing out your history, cache, temporary internet files, etc.? Which browser are you using?I'm using IE.

It was acting extremely weird before, so I completely reset the browser. Now it's just doing it to Google, and some of my settings are messed up.

Do you think reinstalling the browser might take care of this? It doesn't really sound likea virus, that's jsut all I could think of.

[ipwn]

Try running the program HijackThis by Trendmicro.

[md2389]

Check you hosts file?

c:\windows\system32\drivers\etc\

You can open it in notepad.

Hijack THIS! (http://www.spywareinfo.com/~merijn/files/HijackThis.exe) (which btw is written by Merjin and NOT by Trend Micro)

[tehboris]

Boot the Ubuntu and see if the results are the same.

[ipwn]

Check you hosts file?

c:\windows\system32\drivers\etc\

You can open it in notepad.

Hijack THIS! (http://www.spywareinfo.com/~merijn/files/HijackThis.exe) (which btw is written by Merjin and NOT by Trend Micro)

orly

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

[tehboris]

orly

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

ye, rly.

HijackThis, sometimes abbreviated HJT, is freeware spyware-removal tool for Microsoft Windows originally created by Merijn Bellekom, and later sold to Trend Micro.
http://en.wikipedia.org/wiki/Hijackthis

[slonkak]

First, stop using IE. No matter how safe of a web user you are, some malware can install itself without your interaction because of IE's tight integration with the OS. I recommend Firefox.

Second, get rid of AVG. There was a rather intensive study of a lot of antivirus programs and AVG came in close to last in the amount of viruses it was able to detect and repair. I recommend Blink from Eeye. It is a completely hueristic antivirus program. It is free for a year, and the subscription to continue use is very reasonable. I had to do a lot of digging to find this link, so don't lose it ;) Eeye hides their free-for-1-year version, but here it is: http://www.eeye.com/html/consumer/products/blink/download/index.html

As for fixing your current problem, there are a lot of things to try. Try everyone elses suggestions about your hosts file, Hijack This, etc. Download the latest free version of Ad-Aware, run the updater, then boot into safe mode and run it, deleting anything bad it finds. Chances are, with the problem description you gave, your problem is malware and not specifically a virus.

[blackbird1]

How about "ClamAV"? I kow MIT uses that one.

[slonkak]

How about "ClamAV"? I kow MIT uses that one.

From http://w32.clamav.net/:

Please note that ClamAV is NOT a desktop AV system, it is aimed to the server market.


ClamAV is really aimed at *nix machines. I was surprised to see a Windows port. While I'm usually all for FOSS, there is a reason you pay for Antivirus programs. You pay for continual updates and support. Protecting your machine from viruses and malware is not something you want to be a cheepskate with, especially if you're using Windows.

Does this mean Clam is bad? No. But unless you are willing to have your machine compromised, I'd stick with products that are tried and true.

[blackbird1]

From http://w32.clamav.net/:


ClamAV is really aimed at *nix machines. I was surprised to see a Windows port. While I'm usually all for FOSS, there is a reason you pay for Antivirus programs. You pay for continual updates and support. Protecting your machine from viruses and malware is not something you want to be a cheepskate with, especially if you're using Windows.

Does this mean Clam is bad? No. But unless you are willing to have your machine compromised, I'd stick with products that are tried and true.

I know some of the security guys at MIT use Clam al over the place, mostly cause they use so many OS'es and Clam ports to most of them. Personally, at home I use Norton, though there are parts of “360” I am learning to loath.

[slonkak]

I know some of the security guys at MIT use Clam al over the place, mostly cause they use so many OS'es and Clam ports to most of them. Personally, at home I use Norton, though there are parts of “360” I am learning to loath.

Yes. If you prefer the Norton look and feel, just buy the Antivirus, not any of the suites. The other stuff is just junk and will slow down your computer. As long as you have an AV program that you keep updated, do weekly scans, browse the net with Firefox, and do monthly scans with AdAware (just in case) you will be fine.

But I can't stress enough, don't use any suites. Not Symantec, Trend, or any other. You don't need those other applications. Antivirus is enough.

[blackbird1]

I would have to agree, most hardily. I don't know what I was thinking when I upgraded to 360. “A momentary lapse of reason”

Also I use both Adaware and Spybot, I find that they both catch stuff the other misses.

[slonkak]

“A momentary lapse of reason”

Haha. It happens to the best of us. You just have to wonder why those lapses can't happen with something that won't harm your computer and make you spend countless hours reloading everything.

[kronos6948]

Second, get rid of AVG. There was a rather intensive study of a lot of antivirus programs and AVG came in close to last in the amount of viruses it was able to detect and repair. I recommend Blink from Eeye. It is a completely hueristic antivirus program. It is free for a year, and the subscription to continue use is very reasonable. I had to do a lot of digging to find this link, so don't lose it ;) Eeye hides their free-for-1-year version, but here it is: http://www.eeye.com/html/consumer/products/blink/download/index.html



threadjack

Being monetarily challenged as I am, I went with Avast! AV. What are your thoughts?


/threadjack

[slonkak]

threadjack

Being monetarily challenged as I am, I went with Avast! AV. What are your thoughts?


/threadjack

These are just my personal opinions...

I have not used Avast before. From the little Googling I just did, Avast seems to be in most top 10 lists for personal AV products.

Here is one big difference to give some thought to. Traditional AV programs are signature based. That means, if you didn't get the latest update, there is a chance that your AV will not detect a virus on your machine because you don't have it's signature. That is _the_ critical flaw in AV products.

If you look at a product like Eeye's Blink, it is 100% heuristic. There are no signatures. It simply detects malicious activity and stops it. This means that it will never miss a virus because you missed a definition update. It succeeds where all other AV products fail.

One problem for us consumers is that when a company does an AV comparison, they leave heuristic AVs out, and just compare signature based AVs. Personally, I haven't seen a comparison where Blink has been put to the test against Symantec or Trend, probably because the success criteria are strictly for signature based systems.

Now, let me get this out of the way. I do not work for Eeye, I do not have stock in them, I simply believe that the heuristic model is leaps and bounds above the signature model. That, and Eeye makes many other great products for network administrators. I have no problem trusting them.

If you ever listen to Security Now from the TWiT network, Steve Gibson (more notable than lil ol' me) is constantly recommending Blink.

But back to your question about Avast. It seems to be a fairly strong personal AV. Just make sure you keep those definitions updated!

[tehboris]

Have we still not tried connecting to google via it's IP address?

boris@dwarf:~$ nslookup google.ca
Server: 192.168.1.2
Address: 192.168.1.2#53

Non-authoritative answer:
Name: google.ca
Address: 72.14.207.104
Name: google.ca
Address: 64.233.187.104
Name: google.ca
Address: 64.233.161.104