False Trojan Detection Looking At Post?

[askey127]

jacu,
We will take care of cleanup. We are not quite finished, but we don't have any disinfecting tasks left.

You had an intermediary site sending you to google for your homepage. The us10.hpwis site is blocked by HOSTS files for introducing deceptive items. Your AV may have picked up on that. It was likely something picked up by heuristics, i.e., the pattern in the file was similar to that used by malicious files.
Be sure you actually TYPE http://www.google.com into your browser before you choose it as your homepage.
-----------------------------------------------------------
Set Your Computer to Hide System Files Again

1. Click Start.
2. Click My Computer.
3. Select the Tools menu and click Folder Options.
4. Select the View Tab.
5. Under the Hidden files and folders heading, select Show hidden files and folders.
6. CHECK Hide protected operating system files (recommended).
7. Click Yes to confirm.
8. CHECK Hide file extensions for known file types.
9. Click OK.

In addition, go to Start, Search. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders' and 'Search hidden files and folders' are UNCHECKED.
-----------------------------------------------------------
Reset Options in CCleaner for Regular Use.
Open CCleaner if it's not already running.

• Select Cleaner Settings.
  Check Internet Explorer, Windows Explorer, and System so that all items are checked. Then under Internet Explorer, Uncheck "History". In the Advanced section, have a check only on Old PreFetch Data.
• Click on the Options block on the left. Select Advanced.
  Check Only delete files in Windows Temp folders older than 48 hours.
• Set CCleaner to Run When Computer Starts. Click on the Options block on the left, then choose Settings. Check Run Ccleaner when computer starts.

Exit CCleaner by clicking on the X button in the upper right of the CCleaner window.

Be sure to turn ON your ZoneAlarm, and regularly update your Windows.
askey127

[jacu]

Set You Computer to Hide System Files Again - Done, but on #7, nothing required me to click OK. Hope this is normal.

Did your instructions on CCleaner. Want to be sure I did it right.
Under Options>Advanced, there was already a check in "Show prompt to backup registry issues." Should I leave it?
Under Options>Settings, now all four things are checked. (Three of the four were already checked.)

Regarding the homepage issue, when I first selected google, I went to Tools>Internet Options and typed in http://www.google.com. Is that not a good way to do it? One should type it into their browser, go to the page, then do something from there? Just want to be sure.

Thanks,
jacu

[askey127]

All the things you did are correct.
The check on asking about registry backups is moot, since you should probably not normally use the registry tab in CCleaner. If you did use the registry cleaner, you should do the requested backup first. So leaving that check is OK.

That is exactly the correct way to set up Google as home page. When it was done originally, evidently another search engine got into the act, which search engine then inserted itself in front of everything thereafter.

Winpatrol would tell you about any unauthorized helpers under the "Display IE Helpers" tab, if you installed it.

[jacu]

I did look under Display IE Helpers in WinPatrol and I recognized all but two lines. One line was blank with the exception of "TOOL" and the other line just began with the logo "Research" with nothing following it.

Thanks,
jacu

[askey127]

You can use WinPatrol to get rid of them if you choose. I don't know exactly what they are, but "helpers" are not required.
Some helpers can be useful, like the Google Toolbar, for instance.

[jacu]

My brain is a little mushy at the moment. I hope I'm not forgetting to ask anything. You've been so kind and patient. I surely appreciate you and this site.

I am curious about one thing. On the board page, sometimes the emblem on the far left of a subject is scrolling. I couldnt' find a legend to tell me what that meant.

Am I good to go?

Thanks so much,
jacu

[askey127]

jacu,
This machine is good to go.
The other one, well..... see the other post.
askey127

[jacu]

Askey,

I'm sorry to prolong this thread, but something disconcerting just happened. Internet Explorer just asked for server rights. I had just gotten on the internet and went from my homepage (google) to ancestry.com. I only remember this happening once a long time ago. Should I be concerned?

Thanks,
jacu

[askey127]

No not particularly. But any query about server rights is usually bogus, unless you changed Internet providers.
ancestry.com is a site that serves up ads.
You can right click WinPatrol (blue Scotty dog icon, lower right) and choose IE helpers and make sure there are no additions.

You will get less junk if you use Firefox. Download, install it and use it as much as you can.
http://www.mozilla.com/en-US/firefox/
You still need IE for a few sites.

[askey127]

jacu,
I just remembered that the "server" error message can come up if an update entry or a file for Google's Toolbar becomes corrupted due to an infection or a "fix".
You may be able to correct the problem if you go to Ctrl Panel, Add/Remove Programs, and remove the Google Toolbar.
Then download it and install a fresh copy.
askey127

[jacu]

I don't have a google toolbar. The first time it happened was Tuesday. It happened once again I think on Thursday. Then it happened a third time today.

You previously had me install Spyware Blaster and Hosts Manager. You had me uninstall Spybot and AdAware because they were older versions and said I really wouldn't need them anymore anyway. This morning just for peace of mind, I downloaded and installed Spybot. I ran it and it found Microsoft Windows Redirected Hosts-1 "entries". I'd never found this with Spybot before. Could this be because of the Hosts Manager?

Thanks,
jacu

P.S. Regarding my husband's computer that couldn't run HijackThis and you determined it had a bad block, we found out on Thursday that the repair person was unable to clone it. He said it booted up a couple of times, then wouldn't boot up again. He's still working on it and we don't have a clue what we're going to get back.

[askey127]

The server prompt was undoubtedly from a program that could not update to its satisfaction.
I wouldn't worry about it.

The other PC is a victim of what I feared, that the Hard drive would quit before you got it copied.
Now you should expect to get back a new hard drive with nothing on it but an OEM Windows system. Hope you got documents off the old one. We did our best, but we can't overcome an equipment failure.

[askey127]

Glad we could be of assistance. This topic is now closed. If you wish it to be reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.
Please do not contact us to reopen this topic if you are not the topic starter.
A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

You can help support this site from this link : Donations For Malware Removal