Strange FireFox issue, probably virus/spyware related

[SPARTAN VI]

So I'm looking at my coworker's computer which was infested with adware/spyware and a few trojans. Managed to fix most of the issues: task manager was disabled, random IE pop-ups (often lewd), wallpaper changing, DNS redirects, key logger, hijacked everything, etc...

Running into an issue now with Firefox, I cannot start it... well generally. I figured, I'd try renaming the Firefox.exe to "firefo.exe" and for some reason it works now. Guessing whatever's still lingering is specifically targeting firefox.exe.

Also having an issue getting Kaspersky to update, cannot connect to the server. Hoping the two issues are related.

Using SuperAntispyware, spybot, XP TCprep (for tcp/winsock repair), winpatrol, and Kaspersky Internet Security 6 (with outdated definitions).

 

[SPARTAN VI]

Well, I tried manually connecting to Kaspersky.com from Firefox and cannot. So I tried it in IE 7 and voila, still getting dns redirects. Something's still in there.. dammit.

 

[Oneos]

For the continued DNS redirects (and this may sound stupid), but did you check the HOSTS file?

 

[Nenu]

I had a problem machine that was similarly infested.
I managed to get rid of most of the problems but a few would not go.
As the machine was using AVG, I installed Avast.
Subsequently Avast found well over 100 files containing malware and restored Firefox back to its normal self.
I would get the definitions for Kaspersky updated or try another updated AV on there.

Also try CrapCleaner, it can help you find nasties that are dug in deep.
If you cannot get normal network function, try a Winsock or LSPfix tool.

 

[SPARTAN VI]

For the continued DNS redirects (and this may sound stupid), but did you check the HOSTS file?

Not stupid, but yes, that was the first place I looked.

I had a problem machine that was similarly infested.
I managed to get rid of most of the problems but a few would not go.
As the machine was using AVG, I installed Avast.
Subsequently Avast found well over 100 files containing malware and restored Firefox back to its normal self.
I would get the definitions for Kaspersky updated or try another updated AV on there.

Also try CrapCleaner, it can help you find nasties that are dug in deep.
If you cannot get normal network function, try a Winsock or LSPfix tool.

I'll try that. I'm having issues even doing the manual update with Kaspersky 6. Downloaded the cumulative defintions to a thumb drive, then dump it on the PC, and select that folder as the distribution and it just wont update. I'll try Avast though, maybe switch back to Kaspersky once everything's clean.

Last night I loaded SDfix and used its tools to clean out a few more trojan infections.

 

[Fark_Maniac]

take a look in the system32 directory for obviously new .dll files. When windows boots, it will load them. This way, they still muck with your machine, but won't show up in the taskmanager processes, startup folder(s), or the registry.

 

[SPARTAN VI]

take a look in the system32 directory for obviously new .dll files. When windows boots, it will load them. This way, they still muck with your machine, but won't show up in the taskmanager processes, startup folder(s), or the registry.

I'm guessing those will be protected system files then. I'll likely have to boot to safe mode to delete them? Already disabled system restore if that's anyone else's next suggestion.

Thanks Fark, and everyone.

 

[Fark_Maniac]

I'm guessing those will be protected system files then. I'll likely have to boot to safe mode to delete them? Already disabled system restore if that's anyone else's next suggestion.

Thanks Fark, and everyone.

yeah, you should boot to safe mode to delete