Thursday 15 October 2009

thefeedyard.com malware removed with stubware

A big thanks to the folk at Stubware.
I have visited a customer complaining of web pages being misdirected.
To say this was a surprise is an understatement. We only rebuilt the machine from new last week end. We installed Panda AV at build time and we copied users' data from the old disk (probably the source of the infection).
We ran Malwarebytes Antimalware which we have found to be pretty good at removing most things not found in normal AV programs. 17 infected items found but problem not solved.
After further inspection of the problem we found that all links in webpages were being hijacked by something called thefeedyard.com. A quick Google of this gave hints to use Malwarebytes so we ran it again and found a few infections ( probably reinfected since the last scan ).
We also found this reference to Stubware. With some concern that this might be software the likes of many registry cleaners we gave it a go. Downloaded, installed and ran it.
True it listed many items which are captured most of which are legitimate, however a click of a button showed only those that were suspect. 4 items in total. Deleted these and rebooted. Problem cleaned up.
So once again many thanks

No comments: