Clicksor/Vimax malware

[mikey287]

Hey guys,

Normally I'm in the position to be offering malware/virus advice to people, I have a lot of tools at my disposal and at least an intermediate knowledge of how to get rid of this stuff...but this one has me stumped...

Source: Uncharacteristically took a chance on downloading a program from a BitTorrent site (Microsoft Frontpage).

What the problem is: Google redirection upon normal clicking on links in Internet Explorer. When right-clicking and trying to open a new window on such links, IE crashes. Regular ads on each site are replaced with Vimax ads or Clicksor sponsored ads for "spam free e-mail." Firefox (not my normal browser) runs slower, succumbed by the same ads. Slower browsing.

What I've tried: Everything really. After I notice an attack, I immediately go to Search and look for all files created or modified in that time frame and delete them. Ones that can't be deleted I use a tool called Unlocker which allows you to delete these files by "unhooking" them from their host program (i.e. a .TMP file from iexplore.exe). Hijack This looks pretty clean. MalWare Anti-Bytes came up pretty much empty-handed. ATFCleaner wiped all Windows Temp/Internet Temp files. Went to the heavier artillery, Dr. Web CureIt found 11 issues and promptly deleted them and prompted a restart -- still not solved. Now I have GMER log, it seems there's some issues there, but I'm not entirely sure how to fix them. I can post that log upon request (which I think it will ultimately boil down to)...I think ComboFix is an option I need, but I think the CFScript file needs to be specific per case (maybe?) so I steered clear of that.

I need some expert help here please. Thanks a lot!

[tetonbob]

Hello and Welcome.

We want all our members to perform the steps outlined in the link I'll give you below, before posting for assistance. There's a sticky at the top of this forum, and a

Having problems with spyware and pop-ups? First Steps

link at the top of each page.

---------------------------------------------------------------------------------------------

Please follow our pre-posting process outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

A Reminder....

As seen in Post #2 of our sticky topic 'NEW INSTRUCTIONS Read this Before Posting For Malware Removal Help'

Why we don't ask you to run ComboFix from the onset

As stated by the author of ComboFix:

ComboFix is a very powerful tool which when improperly used may render your machine to a doorstop.

We first need to verify if there's any rootkits present and how they could affect our tools. DDS & GMER are preliminary scans. We use their logs to map our strategy for attack.

With these logs we can determine the infections present & decide whether to deploy ComboFix