Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

browser, desktop, and possibly other infections

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: browser, desktop, and possibly other infections

Unread postby ktreffin » September 17th, 2008, 9:56 pm

Not a problem....I should have told you that before. How's things running? Any improvement?

If you can, please give me another HijackThis log..
User avatar
ktreffin
Retired Graduate
 
Posts: 1864
Joined: February 28th, 2007, 11:12 pm
Location: USA, Florida
Advertisement
Register to Remove

Re: browser, desktop, and possibly other infections

Unread postby jkramer7 » September 17th, 2008, 10:13 pm

As far as I can tell, the computer is running fine. There is no spam at the moment, but it appears to only send it from about 4-5pm, so we'll see tomorrow. Combofix returned everything to normal, except it disabled the autorun of the avast tray icon. That isn't a big deal, I could always schedule taskmanager to run it on startup if I started to miss it.

here is the hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:06:03 PM, on 9/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Pidgin\pidgin.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)
O2 - BHO: SSVHelper Class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Thunderbird] "C:\Program Files\Mozilla Thunderbird\thunderbird.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O11 - Options group: [java_sun] Java (Sun)
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/rapti ... loader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: AutorunsDisabled - (no CLSID) - (no file)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 7855 bytes
jkramer7
Regular Member
 
Posts: 21
Joined: September 8th, 2008, 8:35 pm

Re: browser, desktop, and possibly other infections

Unread postby ktreffin » September 17th, 2008, 10:43 pm

We can take care of that Avast issue now. We will fix it with a registry script. Please note that this must be done in Safe Mode, or it will fail. Please do the following:

Step #1: Backup the Windows Registry

  • Download Erunt to your desktop from here
  • Double-click on the file to install the program
  • Untick the NTREGOPT desktop shortcut option
  • Click No when you get the option to run Erunt at Windows startup.
  • During the installation, tick Launch Erunt
  • Accept the defaults for running a backup

Erunt will then backup your registry. This is so the registry can be restored to this point if we need it. It may take a minute. Just let it go until it's done

*===============================================*

Step #2: Safe mode boot

Please Boot to Safe Mode.

Please print the instructions below or copy and paste them to Notepad since you will not have internet access while in Safe Mode.
  • Restart your computer
  • After hearing your computer beep once during startup, but before the "Windows" icon appears, continually press the F8 key.
  • instead of Windows loading as normal, a menu should appear.
  • Select the first option, to run Windows in Safe Mode.

*===============================================*

Step #3: Create registry fix

To create the registry fix, please do the following:
  • Copy the contents of the Code Box below to Notepad.
  • Open Notepad by doing the following:
    • Click Start
    • Choose Run
    • in the box that opens type notepad.exe and click OK
    Code: Select all
    REGEDIT4
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
  • Make sure there are NO blank lines before REGEDIT4
  • Name the file as fixavast.reg
  • Change the Save as Type to All Files
  • and Save it on the desktop
Double-click the fixavast.reg file and when it prompts to merge say yes.

*===============================================*

Step #4: Reboot in normal mode

Reboot into Normal Mode by restarting your computer.

*===============================================*

Step #5: Things to put in your next reply

Please post the following in your next reply:
  • Let me know if you have any other troubles / problems.
User avatar
ktreffin
Retired Graduate
 
Posts: 1864
Joined: February 28th, 2007, 11:12 pm
Location: USA, Florida

Re: browser, desktop, and possibly other infections

Unread postby jkramer7 » September 18th, 2008, 5:17 pm

Everything looks good. That problem with avast is sorted out, and there was no outgoing spam today. However, it seems that avast has gone into overdrive, with the standard shield scanning everything, to the point that its slowing down the system by hogging resources (which is why I switched away from Norton).

edit: it has stopped hogging resources now, just after the windows update finished downloading. Perhaps the two are related?
jkramer7
Regular Member
 
Posts: 21
Joined: September 8th, 2008, 8:35 pm

Re: browser, desktop, and possibly other infections

Unread postby ktreffin » September 18th, 2008, 5:39 pm

I am glad to hear everything is good. There is one more thing I would like you to do.... That driver that was giving us all the trouble seems like it might be a new variant. I would like for you to follow the instructions below so that we can get this to some other experts for further analysis....Please do the following:

Open Notepad and copy/paste the contents in the code box below, into Notepad.

Code: Select all
@echo off
for %%g in (
"C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\a3284e2.sys.vir"
) do zip Files_for_submission %%g
del %0


Save this on your desktop as upload.bat. Choose to "Save type as - All Files"
It should look like this: Image

Double click on upload.bat & allow it to run. It will be quick--this is normal. When it is through, a zipped file will be created named Files_for_submission.zip, which should also be located on the desktop. Kindly visit this site and follow the instructions for uploading the Files_for_submission.zip.

Please let me know when you have completed this so I can let them know it is waiting for them.

Thanks,
Ken
User avatar
ktreffin
Retired Graduate
 
Posts: 1864
Joined: February 28th, 2007, 11:12 pm
Location: USA, Florida

Re: browser, desktop, and possibly other infections

Unread postby jkramer7 » September 18th, 2008, 6:11 pm

I would love to submit that, however the batch script yielded no zip file. I looked for the file that it was supposed to zip, and there was nothing in the containing folder. It appears that combofix put it in catchme2008-09-17_183325.54.zip judging by the catchme.log file, but I'm not sure if it is safe to open the zip file to see if it is there.
jkramer7
Regular Member
 
Posts: 21
Joined: September 8th, 2008, 8:35 pm

Re: browser, desktop, and possibly other infections

Unread postby ktreffin » September 18th, 2008, 6:47 pm

No, don't open that.....I will check and get back with you.
User avatar
ktreffin
Retired Graduate
 
Posts: 1864
Joined: February 28th, 2007, 11:12 pm
Location: USA, Florida

Re: browser, desktop, and possibly other infections

Unread postby ktreffin » September 18th, 2008, 8:19 pm

Let's take a look and see exactly what ComboFix took care of.

Click Start>run and copy/paste the following into the Run box:

Code: Select all
C:\Qoobox\ComboFix-quarantined-files.txt


The ComboFix-quarantined-files.txt should open. Please copy and paste the contents of that in your next reply.
User avatar
ktreffin
Retired Graduate
 
Posts: 1864
Joined: February 28th, 2007, 11:12 pm
Location: USA, Florida

Re: browser, desktop, and possibly other infections

Unread postby jkramer7 » September 18th, 2008, 10:50 pm

2004-08-04 10:00:00 15,360 C:\Qoobox\Quarantine\C\WINDOWS\taskman.exe.vir
2005-10-06 00:05:59 1,839,488 C:\Qoobox\Quarantine\C\WINDOWS\system32\_000008_.tmp.dll.vir
2007-02-14 21:30:50 144 C:\Qoobox\Quarantine\C\WINDOWS\Downloaded Program Files\setup.inf.vir
2008-09-16 19:00:14 1,020 C:\Qoobox\Quarantine\Registry_backups\Legacy_6TO4.reg.dat
2008-09-16 19:00:14 1,044 C:\Qoobox\Quarantine\Registry_backups\Legacy_TDSSSERV.reg.dat
2008-09-16 19:00:14 5,476 C:\Qoobox\Quarantine\Registry_backups\Service_6to4.reg.dat
2008-09-16 19:00:14 892 C:\Qoobox\Quarantine\Registry_backups\Legacy_SYSREST.SYS.reg.dat
2008-09-16 19:00:15 1,268 C:\Qoobox\Quarantine\Registry_backups\Service_TDSSserv.reg.dat
2008-09-16 19:11:50 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-CFSServ.exe.reg.dat
2008-09-16 19:11:50 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-NDSTray.exe.reg.dat
2008-09-16 19:11:50 2 C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-TFncKy.reg.dat
2008-09-17 23:33:23 202,395 C:\Qoobox\Quarantine\catchme2008-09-17_183325.54.zip
2008-09-18 01:32:19 6,983 C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2008-09-18 01:32:30 576 C:\Qoobox\Quarantine\Registry_backups\Service_a3284e2.reg.dat
2008-09-18 01:32:43 1,527 C:\Qoobox\Quarantine\catchme.log
jkramer7
Regular Member
 
Posts: 21
Joined: September 8th, 2008, 8:35 pm

Re: browser, desktop, and possibly other infections

Unread postby ktreffin » September 19th, 2008, 8:46 am

Thanks,

Can you please upload that catchme2008-09-17_183325.54.zip file (C:\Qoobox\Quarantine\catchme2008-09-17_183325.54.zip) to this site and follow the instructions for uploading the file?

That way we can get it analyzed and see what is up with it....

Please let me know when you have completed that so I can let them know it is there.
User avatar
ktreffin
Retired Graduate
 
Posts: 1864
Joined: February 28th, 2007, 11:12 pm
Location: USA, Florida

Re: browser, desktop, and possibly other infections

Unread postby jkramer7 » September 19th, 2008, 5:26 pm

done... that was quick and painless
jkramer7
Regular Member
 
Posts: 21
Joined: September 8th, 2008, 8:35 pm

Re: browser, desktop, and possibly other infections

Unread postby ktreffin » September 19th, 2008, 7:11 pm

Excellent! Thanks....

Congratulations jkramer7, Your log appears to be clean! Image

How is your system running? Are you still having problems? Please let me know if any problems still exist before moving on.

Now that you are clean, I got some tips & tricks for you to keep your computer clean and secure. The first few (like removing dangerous tools and Windows Update) have to be done, the others are optional.

It may seem like your system will be too much protected with all these things installed, but a lot of programs aren't running always on the background so don't slow down your computer. Please take a look at the following things:

Remove dangerous tools - Because some tools we used can be dangerous if they're used in the wrong way we have to remove some of them.

Uninstall Combofix
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK.
  • Note the space between the X and the U, it needs to be there.
Image

You can also delete any logs we have produced, and empty your Recycle bin.

Cleanup with OTMoveIt
  • Double click OTMoveIt.exe to launch the program.
  • Click on the CleanUp! button.
  • OTMoveIt will download a list from the Internet, if your firewall or other defensive programmes alerts you, allow it access.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • When finished exit out of OTMoveIt
  • The tool will delete itself once it finishes, if not delete it by yourself.

Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close

Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
Press OK and Yes to confirm

Update your Anti Virus Software - I would highly recommend that you set your Anti-Virus software to update automatically. Most Anti-Virus programs will update at least once a day, and frequently more than once a day. If you notice that it isn't updating itself regularly and frequently, you should check to make sure your anti-virus subscription has not expired (if it's a paid subscription) or that your settings have not spontaneously changed.

Turn on "Automatic Updates" - In order to make sure your system stays up to date, I recommend that you turn on the "Automatic Updates" feature. To turn on the "Automatic Updates" feature please do the following:
  • Click Start and choose Control Panel
  • In the control panel double click "Automatic Updates"
  • Make sure "Automatic (recommended)" is ticked
  • set the time that you would like to check for updates
  • Click "OK"

Visit Microsoft's Update Site Frequently - It is important that you visit http://update.microsoft.com/ regularly. This will ensure your computer has always the latest security updates available installed on your computer including those for Microsoft Office, etc. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install WinPatrol - As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge. You can download it from this website:
WinPatrol
The developer is a well-known man in the MalWare Removal business. If you really like WinPatrol think about upgrading to the PLUS version. It will give you additional features and you will only have to pay once, for your whole malware-free life.

Download and Install a HOSTS File
A HOSTS file is a big list of bad web sites. The list has a specific format, a specific name, (name is just HOSTS with no file extension), and a specific location. Your machine always looks at that file in that location before connecting to a web site to verify the address. So the HOSTS listing can be used to "short circuit" a request to a bad website by giving it the address of your own machine.

Download BlueTack's HOSTS Manager here, using Internet Explorer (Firefox won't work):
http://www.bluetack.co.uk/forums/index. ... ils&f_id=5
A short distance down the page in the center, click on the Download button.
Agree to the license.
On the next page, to the right side of where it says Download Estimates, right click on the underlined word "Hosts Manager" choose "Save Target As" and download the installer Hosts20setup.exe to your desktop.
Double click the Installer on your desktop and let it Install the Hosts Manager

After the installation is complete, click on the Hosts Manager icon on your desktop. (You can right click/delete the other Hosts Switch icon from your desktop).
When the Hosts Manager comes up, click the small down arrows on the Right side of the bar labeled "Options and Tools",
Click Disable DNS Service. This is important
In the Left Pane, click Download.
It will load 80,000 lines or more. When it finishes, also in the left pane, click Replace, and then click Save.
You can use this manager to handle your HOSTS file download, edits, and most any other HOSTS issue.

If you have a separate third party Firewall or Winpatrol, you may have to give permissions at various times to Unlock the present default HOSTS file and install the new one.

Use an alternative Internet Browser - Many of the exploits are directed to users of Internet Explorer. Try using a different browser instead:
Firefox << Most used, I use this one myself.
Opera

Bookmark general cleanup links - It could be that your computer is becoming slower and slower. This is not always the cause of malware. Most of the times it's malware when you're computer is suddenly getting slow or doing strange. When the slowdown increases slowly check (so now bookmark) these links for tips & tricks:
Help! My computer is slow
Slow Computer? Check here first; it may not be malware

Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Stand Up and Be Counted!
Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints called Malware Complaints. Please register there first!

>> Here << you can see how you can help us.

Have a happy computing day!!

Ken
User avatar
ktreffin
Retired Graduate
 
Posts: 1864
Joined: February 28th, 2007, 11:12 pm
Location: USA, Florida

Re: browser, desktop, and possibly other infections

Unread postby NonSuch » September 23rd, 2008, 8:01 pm

As this issue is resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.
User avatar
NonSuch
Administrator
Administrator
 
Posts: 28747
Joined: February 23rd, 2005, 7:08 am
Location: California
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 617 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware