Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Malware - AGAIN!

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Malware - AGAIN!

Unread postby ej1948 » August 23rd, 2009, 2:09 pm

O.K. so do I copy/paste the backup info first or do I follow the instructions to install the hosts file first? Also, go ahead and give me instructions to disable TeaTimer.

As I write this I see my modem (WebStar) from my local cable company flashing regularly for the PC but the Data light barely comes on and the computer is moving extremely SLOW. So frustrating!

:cry:
ej1948
Regular Member
 
Posts: 50
Joined: April 25th, 2009, 10:45 pm
Advertisement
Register to Remove

Re: Malware - AGAIN!

Unread postby Odd dude » August 23rd, 2009, 4:36 pm

ej1948 wrote:O.K. so do I copy/paste the backup info first or do I follow the instructions to install the hosts file first? Also, go ahead and give me instructions to disable TeaTimer.
First you backup, then you install - the whole point of the backup is to be able to revert the installation should you not be happy with it. ;)

To disable TeaTimer:

  • Right-click on the Tea Timer icon in your system tray. It looks like this: Image
  • If you have the new version 1.5: click once on Resident Protection, then right click the Spybot icon again and make sure Resident Protection is now unchecked. The Spybot icon in the System tray should now be now colourless.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident

This is not enough, there is a second step attached:

  • Open Spybot S&D
  • Click Mode, choose Advanced Mode
  • Go to the bottom of the vertical panel on the left and click Tools
  • Now, also in left panel, click Resident - the pictogram shows a red/white shield.
  • In the Resident protection status frame, uncheck the box labelled Resident "Tea-Timer"(Protection of over-all system settings) active
  • OK any prompts.
  • Use File > Exit to close Spybot
  • Reboot your machine for the changes to take effect.

As I write this I see my modem (WebStar) from my local cable company flashing regularly for the PC but the Data light barely comes on and the computer is moving extremely SLOW. So frustrating!
May just be a fluke - if the problem persists I recommend contacting your ISP (Internet Service Provider). If you think it may be a malware issue, feel free to post one more HijackThis log. :)
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Malware - AGAIN!

Unread postby ej1948 » August 24th, 2009, 9:40 pm

I think I'm in over my head!!! :(

I copied and pasted the backup file. The MS DOS screen appeared for a nano-second. I tried it a second time and it did the same thing. Did I do it right?

I then went to the hosts info you gave me, copied and pasted the info and then clicked on the location where you said hosts could be downloaded. After I read everything I downloaded the hosts file which is in zip form. However, when I tried to run it all I could get was a dialogue box saying the files are password protected and to enter the password. I have no idea what it is so I cancelled the installation. What now???

After this is resolved I will post another HiJack This log because the data light on the modem is still barely flashing and my Task Manager Performance screen shows CPU usage of 2%.

I hate this computer! :cry:
ej1948
Regular Member
 
Posts: 50
Joined: April 25th, 2009, 10:45 pm

Re: Malware - AGAIN!

Unread postby Odd dude » August 25th, 2009, 5:27 am

ej1948 wrote:I copied and pasted the backup file. The MS DOS screen appeared for a nano-second. I tried it a second time and it did the same thing. Did I do it right?
Yes.

I then went to the hosts info you gave me, copied and pasted the info and then clicked on the location where you said hosts could be downloaded. After I read everything I downloaded the hosts file which is in zip form. However, when I tried to run it all I could get was a dialogue box saying the files are password protected and to enter the password. I have no idea what it is so I cancelled the installation. What now???
The file is not password-protected.

Right-click HERE and choose Save Target As. Save it to your desktop. Right-click the zip-file you downloaded and choose Extract All. Accept all the default options (just keep clicking Next). At the last screen, put a check next to 'Show extracted files'. Once you click Finish, the folder containing the hosts file opens. Double-click mvps.bat (the .bat-part of the filename usually isn't there, that's perfectly normal) and you're done.

After this is resolved I will post another HiJack This log because the data light on the modem is still barely flashing and my Task Manager Performance screen shows CPU usage of 2%.
Just so you know - the data light on the modem should only flash when you're downloading something from the internet, and the CPU usage should only rise when your computer is executing instructions - the CPU usage does not rise by just having some programs open, it will only rise when those programs are requesting a CPU-intensive instruction set to be executed.
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Malware - AGAIN!

Unread postby ej1948 » August 25th, 2009, 9:34 pm

Please walk me through removing everything that I did last night. It took my computer over 5 minutes to load the MalWare Removal page with your post! I couldn't get my home page (MSN.com) to load at all so I was only able to get on the Internet thru AOL.
ej1948
Regular Member
 
Posts: 50
Joined: April 25th, 2009, 10:45 pm

Re: Malware - AGAIN!

Unread postby Odd dude » August 26th, 2009, 4:34 am

Oh dear - that's not exactly what I had in mind!

This is very easy to undo - please copy and paste this to Notepad:

Code: Select all
@echo off
setlocal
set here=%cd%
cd c:\windows\system32\drivers\etc
chdir /d %systemroot%\system32\drivers\etc
attrib -r -s -a -h hosts
del /f /a hosts
copy hosts.backup hosts
if not exist hosts copy hosts.mvp hosts
if not exist hosts echo 127.0.0.1  localhost>hosts
attrib +r +s +h hosts
sc config dnscache start= demand
cd /d %here%
endlocal
shutdown -r
del %0


Save it to your desktop as "undo.cmd" and include the quotation marks when saving. Close all open windows (it will reboot your computer). Then double click the file undo.cmd on your desktop (the .cmd part may not show) and it'll undo everything we did.
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Malware - AGAIN!

Unread postby ej1948 » August 27th, 2009, 5:32 am

OK I followed your instructions and it rebooted like you said. I have two items on my desktop that I'm not sure of: Hosts (contains several files) and gmer.zip. Should I leave them?

Interestingly, I closed all windows including this one but after reboot I came back to the site and was still logged in and on this page.

Should I do a defrag?
ej1948
Regular Member
 
Posts: 50
Joined: April 25th, 2009, 10:45 pm

Re: Malware - AGAIN!

Unread postby Odd dude » August 27th, 2009, 5:50 am

ej1948 wrote:OK I followed your instructions and it rebooted like you said. I have two items on my desktop that I'm not sure of: Hosts (contains several files) and gmer.zip. Should I leave them?
'Hosts' is the folder that contains the MVPs hosts file - you can delete it. 'gmer.zip' is from a tool we used, feel free to delete that as well.

Interestingly, I closed all windows including this one but after reboot I came back to the site and was still logged in and on this page.
That's normal, the website uses some sort of temporary cookie that keeps you logged in for a certain period of time (I never timed it, but it's something like 15 minutes, I believe). If you'd like to change this behaviour, all you need to do is explicitly logout by clicking 'Logout [ ej1948 ]' in the top-left part of the website. :)

Should I do a defrag?
A defrag rearranges the file on your hard disk to put bits of the same file closer together, so that access to that file is speeded up. It is never a bad thing to defrag! :)
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Malware - AGAIN!

Unread postby ej1948 » August 27th, 2009, 8:29 pm

Once I defrag I think I should be o.k. again (for the 3rd time!). Thank you so much for your time and patience with me. It is much appreciated!

:cheers:
ej1948
Regular Member
 
Posts: 50
Joined: April 25th, 2009, 10:45 pm

Re: Malware - AGAIN!

Unread postby Odd dude » August 28th, 2009, 3:21 am

You're very welcome :D

Is it OK to close and archive this thread now?
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Malware - AGAIN!

Unread postby ej1948 » August 31st, 2009, 10:45 pm

Yes, and thank you again so much. I appreciate all you've done for me.
ej1948
Regular Member
 
Posts: 50
Joined: April 25th, 2009, 10:45 pm

Re: Malware - AGAIN!

Unread postby chryssi2001 » September 1st, 2009, 6:56 am

As your problems appear to have been resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.
User avatar
chryssi2001
MRU Teacher Emeritus
 
Posts: 14395
Joined: September 24th, 2006, 2:11 am
Location: far away
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 48 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware