Substitution of Google / Yandex pages, how to treat?

Question

Antivirus

Good afternoon!
One of my supervised managers at work got Google/Yandex spoofed in all browsers. The sites look the same as the originals, but ask for a phone number to "unblock access to search".
Cureit found a rootkit, removed it - the substitution was saved. Virus Removal Tool didn't find anything, Trojan Remover finds something every time, deletes it, after reboot everything is the same...

Has anyone come across a specific beast? How to treat it?
Please advise alternative cureit/virus removal tool.

On the computer, by the way, there is the latest AVG internet security ... And there is silence in it.

Answer 1

Well, if avz does not help, then “a powerful weapon that hits right on target” will help - run ComboFix on the patient - www.bleepingcomputer.com/combofix/how-to-use-combofix
if it does not help even after a couple of launches (wait for the output check report in Notepad), then only search with pens (compiling a report in avz and sending it to virus total or the like) or rearrange.
I can also recommend checking your computer with this antivirus - it specializes more in trojans and other nasty things - www.malwarebytes.org/
Download the free version, install and run a check, for example, of the entire C: drive.
Paid differs only in the resident module.

Answer 2

Check the registry key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\DataBasePath

Is the value of this key equal to the next value?

%SystemRoot%\system32\drivers\etc\hosts

Answer 3

Try to go through another AVZ - z-oleg.com/secur/avz/download.php . Helped out a couple of times when cureit didn't find anything. True, the bases there are not the freshest now.

Answer 4

well, it is logical that either crap is written in the hosts file or the addresses of the dns servers have been changed.

Answer 5

Oh, maybe the problem is not on the computer, but, for example, on an infected DNS server in LAN? Or an infected router? Or is the infected neighbor computer spoofing DNS responses? Can you nslookup google.com 8.8.8.8 from the infected computer? This is sending a DNS query directly to Google. It should return something like this:
Server: google-public-dns-a.google.com
Address: 8.8.8.8
Non-authoritative answer:
Name: google.com
Addresses: 173.194.71.100, 173.194.71.102, 173.194.71.113 , 173.194.71.101
173.194.71.139, 173.194.71.138

Answer 6

Treated this the other day with DrWev Cureit

Answer 7

Try the file C:\Windows\system32\rpcss.dll to check for virustotal. If infected, replace with the same system.

Answer 8

HijackThis and smoke logs…

Answer 9

By the way, the IP 74.125.232.225 you received really belongs to Google. Could it be a proxy issue?

Answer 10

support.microsoft.com/kb/972034/en