"Search Assist" Virus - Help?

[Alvin Flummux]

Lately, on all of my computer's web browsers, I've been seeing chunks of normal text turn into double underlined hyperlinks. When I hover my mouse cursor over them, a small pop-up ad appears (yes, I am using AdBlock), and it identifies itself as "Search Assist." I googled the name, and it seems to me that there are several viruses with similar names and symptoms to this. I've run scans with AVG, Spybot, AdAware, Microsoft Security Essentials, CCleaner, TDSSKiller, AdwCleaner and Junkware Removal Tool, and it's still kicking about my browsers. I've even upgraded my router, which I thought may help as one thread I found said to reboot the router to factory settings, and I reckon setting up a whole new router is probably as good a strategy as that.

How do I go about getting shot of it?

Edit: Here's a look at it on this very page:

[Victor Mildew]

Don't let a woman use your pc next time.

[Lagamorph]

Try Malware Bytes.

[Alvin Flummux]

No luck with MalwareBytes' quick scan, it did detect some stuff and restart the machine but the Search Assist thing is still here. Performing a full scan now.

[TheWay]

Nothing unexpected running in your processes or msconfig? (assuming you're running Windows) Sounds more like an add-on to your browser than anything malicious.

[KingK]

Is it a BHO?

I had one years ago and it was a pain to remove but Google eventually showed me how. Sorry I cant remember details though

[Alvin Flummux]

MalwareBytes couldn't find anything amiss.

What's a BHO?

There doesn't seem to be anything out of the ordinary in the running processes list, not sure what to do with msconfig though...

I only have 3 active extensions to Chrome; AdBlock, Lazarus Form Recovery and Last.fm Scrobbler. I have a fourth extension, Gamers Unite! 1-Click Gifts my wife used to use with Farmville et al, but it's not turned on. All of these have been installed for over a year, so I doubt they're to blame.

[TheWay]

If you use another browser, does the problem persist?

Also, type chrome://plugins into your address bar and see what it lists.

[Alvin Flummux]

If you use another browser, does the problem persist?

Yes, in both FireFox and Internet Explorer.

Also, type chrome://plugins into your address bar and see what it lists.

Nothing too unusual...

Adobe Flash Player (2 files) - Version: 11.9.900.117
Shockwave Flash 11.9 r900
Name: Shockwave

AmazonMP3DownloaderPlugin - Version: 1.0.15

Windows Media Player - Version: 1.0.0.8
np-mswmp

Chrome Remote Desktop Viewer
This plugin allows you to securely access other computers that have been shared with you. To use this plugin you must first install the Chrome Remote Desktop webapp.

Microsoft Office (2 files) - Version: 14.0.4730.1010
Office Authorization plug-in for NPAPI browsers

QuickTime Player (5 files) - Version: 7.7.4 (1680.86)
The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.

Native Client

Chrome PDF Viewer (Disabled)

Adobe Reader - Version: 10.1.8.24
Adobe PDF Plug-In For Firefox and Netscape 10.1.8

CANON iMAGE GATEWAY Album Plugin Utility - Version: 3.0.5.0
CANON iMAGE GATEWAY Album Plugin Utility Module

DivX Plus Web Player - Version: 3, 0, 0, 155
DivX Web Player version 3.0.0.155

NPCIG.dll - Version: 1, 0, 0, 5
CANON iMAGE GATEWAY Mycamera Plugin

DivX VOD Helper Plug-in - Version: 1.1.0.6

Silverlight - Version: 5.1.20913.0

Google Earth Plugin - Version: 7.1.1.1888
GEPlugin

Google Update - Version: 1.3.21.165

Java(TM) (2 files) - Version: 10.45.2.18
NPRuntime Script Plug-in Library for Java(TM) Deploy

OnLive Game Client Detector - Version: 1.0.0
Detector for the Onlive Game Client

VLC Web Plugin - Version: 2.0.0-rc
VLC media player Web Plugin 2.0.0-rc

Windows Live™ Photo Gallery - Version: 15.4.3555.0308_ship.wlx.w4m4 (ship)
NPWLPG

iTunes Application Detector - Version: 1.0.1.1
iTunes Detector Plug-in

Unity Player - Version: 4.1.2.67171
Unity Player 4.1.2f1

Adobe Shockwave Player - Version: 12.0.2r122
Adobe Shockwave for Director Netscape plug-in, version 12.0.2.122

[TheWay]

A quick googling says it is a virus, unfortunately. Probably brought a few chums with it too.

I recommend bleepingcomputer.com, since I've used 'em before.

EDIT: In fact, they answered several similar queries. Latest one seems to be http://www.bleepingcomputer.com/forums/t/496730/infected-with-google-redirect-ads-all-over-browser-random-words-become-links/

You might want to open your own thread though, rather than follow someone else's solution.

[Alvin Flummux]

I'm not sure which application has done it, but I think one of the couple that I ran last night killed it!

I'd used most of the programs on that BleepingComputer link, but not RevoUninstaller (which I got rid of Sendori with) or... hell, what was that other one? It brought up a couple of registry entries and I deleted them and I haven't seen any double-lined hyperlinks since.

GINGERS CROSSED it's actually gone!