100ksearches.com

Just a warning to people...

I'm not sure how my machine got infected but Google search results (Firefox), once clicked, redirect through 100ksearches.com and go to online pharmacies, porn sites, etc.

SAS and MBAM didn't find anything, and Combofix only caused my computer to bluescreen upon restart (I had to restore a disk image backup to get the dang 'puter to boot again).

Thankfully, the disk backup had been created apparently before the infection, but I'm still not sure how it happened. The infection was localized to my wife's limited user account (which is the account I ran the scans on).

 

I ran into this today on a remote clients machine. Malwarebytes, SuperAntiSpyware, Housecall, and AVG didn't notice it. It hijacked most IE results (eset.eu rerouted to malware site) but didn't affect Firefox.

 

I've got his problem too.

It has affected all my browsers. Chrome, Firefox and Internet Explorer.

I'm getting redirected all over the show, mainly to sites trying to sell stuff.

I got the problem last night when I hastily opened and ran a program from the zip file; Ultra.Iso.Premium.9.3.5.2716.crack.zip, inside was a file named Ultra.Iso.Premium.9.3.5.2716.crack.exe - 221KB when I ran the program it disappeared from the folder.

Tried doing a system restore but that didn't resolve the problem.

PC Tools Spyware Doctor with Antivirus hasn't found the source of the problem.

 

I uploaded the file to virustotal and it came up with these results, it said this too

 

Well I found a solution on this very informative page

TDSSKiller by Kaspersky Labs appears to have solved the problem for me.

tdsskiller.exe

 

How come there's like all tedious like about tdskiller or whatever, its never tskiller in any hidden device manager profile. Its that java stuff they had in the other malware that could mysteriously detect it all in 3minutes. Does anybody have one of those? I can't even download them anymore, all $60!!:-D