Virus/Malware Redirect problem alt-rutor

[Hellfire]

Hi, has anyone come across a redirect virus before.

I currently have a problem, megabytes, AVG and Defender don't pick it up. Basically it's a redirect that sends me to here "http://alt-rutor.org/" (website seems harmless in itself) and tries to forward me to "fenixxgames.com"

AVG doesn't pick anything up,
Defender/Malwarebytes doesn't either.

Only article I can find is this http://blog.mitechmate.com/httpalt-rutor-org/ Which contains bullshit info and no real info on how to remove it.

 

[TheMailMan78]

Check your start-up applications in MSconfig and your browser plugins. Also check your running processes and look for anything suspicious.

AVG has been dropping the ball BIG TIME at my job lately. I suggest trying something else like MSE or Bitdefender.

 

[Mindweaver]

Did you use them in Safe Mode? If not then try that and be sure to run safe mode with networking so you can update them before the scan. Also, try using Kaspersky Rescue Disk 10.

 

[Hellfire]

Nothing in Startup folder, MSconfig or GoogleChrome extentions, Scans run in SM+N already, doing scans just now. taking it's time.

I've seen people have this problem online but all the posts are in Russian as it seems to be a Russian website, God knows how I got this.

Here is a translated reply I saw, I can't understand the last sentence

In Windows 7, the lower sink "Search programs and files" write "regedit" run it, find the registry branch HKEY_local_machine \ software \ wow6432node \ microsoft \ windows \ currentVersion \ run immediately file CMD (in the sense in the end to be alt-rutor) it should be removed.

I can obviously find the folder in Regedit but no idea what "run immediately file cmd" means

 

[TheMailMan78]

Did you use them in Safe Mode? If not then try that and be sure to run safe mode with networking so you can update them before the scan. Also, try using Kaspersky Rescue Disk 10.

Rescue disk is awesome. It was my follow up suggestion after he checked what I suggested. Also TDSKiller is something he should run.

Nothing in Startup folder, MSconfig or GoogleChrome extentions, Scans run in SM+N already, doing scans just now. taking it's time.

I've seen people have this problem online but all the posts are in Russian as it seems to be a Russian website, God knows how I got this.

Here is a translated reply I saw, I can't understand the last sentence


I can obviously find the folder in Regedit but no idea what "run immediately file cmd" means

Does IE get redirected? Also did you zero out temp files, history and cache?

 

[Hellfire]

Its a single pop up on start/boot by the default browser, normal use the website isn't redirected, I should've mentioned that sorry.

TDSSKiller came up clean.

 

[Mussels]

Its a single pop up on start/boot by the default browser, normal use the website isn't redirected, I should've mentioned that sorry.

TDSSKiller came up clean.

my advice: find in the registry anything with the alt-rutor link mentioned, and delete the key. voila!

 

[Hellfire]

my advice: find in the registry anything with the alt-rutor link mentioned, and delete the key. voila!

Just deleted the registry entry, just worried there is something else which will keep inserting the registry in, trying a restart now.

 

[Red_Machine]

The only program I found capable of removing a redirect virus was Lavasoft's Ad-Aware.

 

[Mindweaver]

Rescue disk is awesome.

Yea, I have it on a 4gb USB stick, and it work great. I created a "tool" directory inside the stick with windows base tools I use once I'm back into windows after the rescue disc scan.

 

[TheMailMan78]

The only program I found capable of removing a redirect virus was Lavasoft's Ad-Aware.

There is another one......TheMailman78-freeBeerAware.

I removed them manually all the time at my job.

 

[Ahhzz]

I've had a lot of luck lately using ADW Cleaner. It's done me well, and relatively rapid scan. Because it's technically not a virus, lots of the Anti-Virus companies put a lower priority on that sort of thing, so it doesn't surprise me that your AV's aren't hitting it. I'd go after MalwareBytes and a full safe mode w/Networking scan if the ADW doesn't clear you up.
Last resort, the guys at Bleeping computer are excellent at helping with this sort of thing, and usually can get you a series of rapid replies back and forth helping you out.

 

[Mussels]

gmail is a better antivirus than AVG XD

 

[Hellfire]

No pop up on restart, looking very good, thank you Mussels

ADW Cleaner, I saw some links to it but the posts where in Russian. Will keep an eye on it to see if it is re injected into the computer which would mean an underlying virus.

All clear but thank you.

 

[TheMailMan78]

No pop up on restart, looking very good, thank you Mussels

ADW Cleaner, I saw some links to it but the posts where in Russian. Will keep an eye on it to see if it is re injected into the computer which would mean an underlying virus.

All clear but thank you.

Nice......NOW STAY OFF TORRENTS AND PORN! Also do you have Java installed?

 

[Hellfire]

Found out it's my wife, she has tons of buggy firefox extensions installed, stupid woman, one of them is "toparcadehits" :/

Running ADWCleaner atm.

 

[Hellfire]

Nice......NOW STAY OFF TORRENTS AND PORN! Also do you have Java installed?

Yeah I've always had Java installed, I use it often for work and stuff.

 

[Ahhzz]

Found out it's my wife, she has tons of buggy firefox extensions installed, stupid woman, one of them is "toparcadehits" :/

Running ADWCleaner atm.

Good luck

 

[Mussels]

changed thread title so stop spazzing out gmail.