katz I am getting very aggitated, I have pop ups and yet pop up blocker is enabled, so there is an infection somewhere, yet I have tried looking for it even downloading tools to scan with, but the little thing is eveading me, grrr Back to Top
Touch Forum Moderator Hello katz
After You have run the scan tools -
Reboot normally
Post Hijackthis log along with SuperAntiSpyware log, , C: combofix TXT in this topic
I´ll look to it
Do NOT post your problem in someone elses thread.
Back to Top
katz
katz OK had ccleaner anyway and run that, spybot will not load on my pc says unknown error occurred and was not saved, done this three times. have downloaded combofix but unsure as to what to do next as I have not done the spybot, can see where the pop ups were coming from mywebsearch, when I went to do the quaruntine bit it was not there??? scanned twice and same thing happened. I am not a novice when it comes to unstalling and using software so I don't think it is my mistake, nor am I an expert to know what is going wrong, getting frustrated now how do you fellas cope with it all? Will wait till I am told what to do next thank you Back to Top
katz Got as far as combo fix for some reason it says the script is wrong so going to download it again, sorry to take so long, I am trying to do as you asked, but could you just bear with me, I have a disease in my hands that only lets me work on the pc so long. I do appreciate your help, thanks Back to Top
katz Ok I have downloaded combo fix from three of the locations given the 1st one said the page was not available anymore the url or something was not found. The other three come up the same each time saying the script CFS is not correctly spelt, the blue box comes up ready to work but does not go any further. Back to Top
Touch Forum Moderator You are not supposed to use script CFS - yet
Let´s try this methos (after mothers day. Congratulation BTW
)
Please download Combofix:
and save to the desktop.
Close all other browser windows.
Important-> Temporarily disable your anti-virus, real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Go to start --> run and copy/paste in the following: "%userprofile%\desktop\combofix.exe" /killall When finished, it will produce a logfile located at C:\ComboFix.txt.
Post the contents of that log in your next reply with a new hijackthis log. Note: Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
Do NOT post your problem in someone elses thread.
Back to Top
katz Redone ccleaner and spybot as well as superantispyware, one tracking cookie in superantispyware this time round, deleted. Downloaded combofix again and tried to run it, got the same meeage again. You said I should not be using CFS yet, but I have not done anything to use it or allow it at all. When I downloaded HJT it said for some reason my system has denied access to the hosts file, and to sort this out for vista to go to administrator and run then, this I am unsure of how to do it. Back to Top
katz
Touch Forum Moderator Ok, we´ll try another scanner then -
(If you get an error, rightclick on - dss exe - run as admin)
I´ll look to it tomorrow, as it´s getting late here in Denmark
Do NOT post your problem in someone elses thread.
Back to Top
katz kard's System Scanner v20071014.68.js - JSFile - shell\open\command - NOTEPAD.EXE %1 .reg - regfile - shell\open\command - NOTEPAD.EXE %1 .scr - scrfile - shell\open\command - NOTEPAD.EXE %1 .vbs - VBSFile - shell\open\command - NOTEPAD.EXE %1 Back to Top
katz Hope this helps and that I have done it correctly, thank you Back to Top
Touch Forum Moderator It looks right
Update Superantispyware
Download DrWebCureit:
to your desktop.
Run Hijackthis and place a check beside each of the following. Close all other browser windows except HJT.
Click fix checked.
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKCU\..\Run: [lqglq] c:\users\katzyin\appdata\local\lqglq.exe lqglq
Please print out or copy this page to Notepad as you will be in Safe Mode and unable to refer to this page.
Doubleclick the "drweb-cureit.exe" and click "Start" in the prompt window that will open , asking "start the express scan now".
It will first make a quick scan of your system, let it clean what it find, and when it says "done"
Click on the Options->Change settings.
Actions Tab- Adware-Dialers-Riskware-Hacktools, use dropdown menu and select –Rename
Click – Apply - OK
Click on Scan Tab. Move dot from Express scan to Complete Scan . Click on The Green It will now scan your drive(s), say yes to all
After the scan, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
Start Superantispyware.
Hit - Scan Your Computer - button
Click on the drive(s) you want to scan. Put a check in - Perform Complete Scan, then next,
it will scan now. When scan have finished, put a checkmark with all items it found. Next, after cleaning, allow it to Reboot
Start Superantispyware again –
Click Preferences and then click the statistics/logs tab.
Click the dated log and press view log and a text file will appear.
Post this log along with fresh hijackthis log, Dr.Web log and tell how things are running ?
Do NOT post your problem in someone elses thread.
Back to Top
katz Aw Touch I am getting into a bit of a muddle here so sorry, you are patient too. let me explain a little. Back to Top
Touch Forum Moderator Ok, let´s try another scanner then
Download Deckard's System Scanner:
http://www.techsupportforum.com/sectools/Deckard/dss.exe Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, a text file will open - Main.txt.
Click on Format and Uncheck Word wrap, if checked.
Please save this file and close Notepad.
A folder, C:\Deckard, will also open. In it will be another text file, Extra.txt. Please save this file too, and exit Notepad.
Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.
Post back to the Forum the contents of Main.txt and the contents of C:\Deckard\Extra.txt
Do NOT post your problem in someone elses thread.
Back to Top
katz This is the only text that came up with this scan, did it three times just to make sure. I do remember last time there was two text reports. Back to Top
Touch Forum Moderator They will do
Run Hijackthis and place a check beside each of the following. Close all other browser windows except HJT.
O4 - HKCU\..\Run: [hweset] c:\users\katzyin\appdata\local\hweset.exe hweset
Re-start your PC in Safe Mode
Delete-
Files:
c:\users\katzyin\appdata\local\hweset.exe
Reboot normally, and tell i how things are running now ?
Do NOT post your problem in someone elses thread.
Back to Top
katz Touch all is gone left it till the next day just to see, and the pop ups are definately gone, thank you very much! Back to Top
katz Touch all is gone left it till the next day just to see, and the pop ups are definately gone, thank you very much! Back to Top
Touch Forum Moderator That´s good news
Ever considered using Firefox ?
Please read Tony Klein's excellent article about how to prevent against spyware/hijackers in the future
Do NOT post your problem in someone elses thread.
Back to Top
katz Touch all is gone left it till the next day just to see, and the pop ups are definately gone, thank you very much! Back to Top
Touch Forum Moderator I was glad to help
Since your problem appears to be resolved, this thread will now be closed.
If you need this topic reopened, please PM a Moderator and we will reopen it for you
Do NOT post your problem in someone elses thread.
Back to Top
Forum Information Currently it is Sunday, May 26, 2013 12:05 AM (GMT +3)View Active Threads Who's Online This forum has 34622 registered members. Please welcome our newest member, jenninash .Details 5 Latest Threads
|
Forum Help Manual
