go.google.com

[Legalegl]

This malware will not allow me to install or ran any anti-malware product.
That is to say if I download or try to run from or on a usb key, cd or computer it is blocked. I was able to download and run Clamwin, but it has a short signature list.
Can get into Google and Yahoo and type search, but when an item is clicked, it directs me to it's own sites. I was able to get into Microsoft and download Defender, but it won't run either. I was able to go download avg from other than their site, ran install and it simply wasn't there.
Any ideas ?

[NooNoo]

combofix... here might do the trick. Platypus is qualified to help you with it...but he is off sick at the moment.

Can you look at your host file? Have you tried to run AV in safemode?

[Niclo Iste]

If you can get into safe mode try installing spybot or malwarebytes that way. Most malware won't block you from installing in safe mode. If that fails I have had some success with tricking the malware by making a batch file that starts the install files up. Also try renaming the instal files that can trick the malware too.

[Legalegl]

I'd like to try combofix but have seen a warning about it damaging the o/s.
I tried safe mode but had no luck. I will certainly rename the files and try to install that way. I'll try it tomorrow when I get a chance...this is one virus I have had major problems with ! Thank you both.

[NooNoo]

ermm combofix is being responsible... any antivirus could remove the virus inappropriately and toast the OS. You should start by backing up your important data on to a separate drive before you do anything else.

[slgrieb]

Combofix may cause problems with the OS in about 1% of cases. I use it many times per week, and over the last couple of years, I only had one machine where it might have broken Windows, but frankly, on a really, really infected and screwed up computer, I'm not sure I could blame Combofix. It's generally very safe, but it's always the case in any malware removal that you can end up with a trashed OS no matter what tools you use.

[Legalegl]

Thanks for the message. If I need to I will certainly use combofix.

[Niclo Iste]

Rename combofix to cfix or something. I've had in a few cases the program get corrupted or invalidated because of the infection looking for that file name.

[slgrieb]

Just like HiJackThis, there are some pieces of malware that will interfere with running Combofix. But, the current version seems pretty well immune to this problem. Generally, I'm running Combofix without renaming it. Combofix is updated very frequently, and remains one of the best and easiest to use tools. But it needs to be used in conjunction with Spybot or some equivalent general purpose malware removal tool, because it targets a limited, specific, and undisclosed range of malware.