Microsoft Security Essentials may be my savior. A few days ago I too began having problems with redirection of my three browsers to websites I didn't want. My McAfee AntiVirus Plus failed to prevent entry of the Redirect virus and did not find it after entry. I then tried XDellBox and after it hung up once part way through the scan, I retried it and it completed. However, all it did was identify three low priority suspicious files, two of which were related to HP digital imaging and the third a Windows Installyer file. I reluctantly deleted them as recommended and then rebooted. The rebooting process would not complete because suddently the TrayApp.msi file was missing. Luckily, I was able to do a System Restore to the hours before I used XDellBox.
At the recommendation of a computer-savvy friend, I downloaded Microsoft Security Essentials, a free program. On its initial scan, it found the Win32/Alureon.A virus. The detail said Rootkit: Alureon-:\windows\system32\drivers\atapi.sys. It removed the virus. A subsequent full scan found it again. I had read that these Redirect viruses can replicate themselves and I assumed that is what it had done. After removing the virus again and rebooting, I then downloaded the Windows Malicious Software Removal Tool and ran another full scan. It found no viruses. At this moment, my browsers are no longer redirecting me so I hope the problem is solved.
Interestingly, about a month ago, I was having a problem with my browsers unable to locate certain safe websites, such as McAfee's own site. It's as though they no longer existed.
After a long phone conversation with a McAfee technician, he figured out that the DNS address was being forced rather than found automatically. Apparently, a Redirect virus (either this same
one or a different one) had unchecked the "Obtain DNS Server Address Automatically" box. Once the correct box was checked, that problem went away; but it's possible the virus than lay dormant
until recently. It remains to be seen if it's truly out of my computer or waiting to reappear. Nevertheless, the browsers are working fine at the moment.
