Browser Hijacking Virus/Malware Issue

[Cman333]

Originally Posted by asiandude

Open Internet Explorer go to TOOLS < Manage ADDONS and check for anything unusual.

Post your CWindows\System32\Drivers\etc\hosts file

Any particular reason you using those DNS numbers? 68.105.28.12 68.105.29.12 68.105.28.11

Go to local area connection properties, TCP/IP properties set to obtain DNS automatically.

open CMD and do
ipconfig /release
ipconfig /renew
ipconfig /flushdns

Here's what the host file says

127.0.0.1 localhost


No particular reason why were using those DNS. I'm thinking maybe the computer tech did it when we tried to recover the data.

I looked at the local network connections and both IP and DNS were already set to obtain automatically.

[goo3]

You have a rootkit virus. I don't run windows any more so I'm not familiar with all the ins and outs.

But this is a simple thing to try:

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

edit: I just noticed someone posted this earlier. Did it work?

[Psykopathik]

Originally Posted by Cman333

... My gf somehow has installed some sort of browser hijacking virus onto her comp.

next time don't put a PC in the kitchen.

[N.V.M.]

all this time working on it instead of reinstalling the OS? really?

[Psykopathik]

^^backup favorites and reinstall windows. fastest fix by far. I never store anything on the main drive.

also helps my as my main drive is a paltry 128GB SSD no choice but to move everything to E or F drives

[rental_metard]

Are you still encountering this behaviour? I'll chime in

[underscore]

try Panda online virus scanner, that saved my ass the last/only time I've had a virus.

[Cman333]

Originally Posted by goo3

You have a rootkit virus. I don't run windows any more so I'm not familiar with all the ins and outs.

But this is a simple thing to try:

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

edit: I just noticed someone posted this earlier. Did it work?

I havent tried Kaspersky yet. I'll give it a shot. Thanks.

Originally Posted by N.V.M.

all this time working on it instead of reinstalling the OS? really?

The computer came pre installed with windows. I don't have a copy to reinstall and don't want pirated copy on it.

Originally Posted by underscore

try Panda online virus scanner, that saved my ass the last/only time I've had a virus.

I'll try that if Kaspersky idea doesn't work. Thanks.

Originally Posted by rental_metard

Are you still encountering this behaviour? I'll chime in

Unfortunately yes.

[mk1freak]

if you feel you have a good grasp of processes and whats legit, and if you are anal to the point of hunting down the evil manipulator of your girlfriend's goods,

download this:
Process Monitor

run it from USB if you are able to,

once running use browser surf to your favorite pron site (or was it your wife's )

*this next part optional but recommended*
open revscene.net, login to account, hit user cp and click "send pm"
in To field put in "mk1freak" and in message body copy and paste all favorite pron sites links and and requisite user/pw combos. tyvm

*end of optional*

find bad process and process threads (research process for what can be safely deleted) and eradicate with cmd prompt

mind you, if your not comfortable booting into and running ms-dos cmd prompts (for deletion of derrty files) you might want to remove drive and connect it to a another computer.

this is a little time consuming and theres a chance you may remove something your not supposed to so be very careful on how you proceed!

and oh yea have fun reading! funtimes ahead for you.

[whitev70r]

Can you find out name of program that she downloaded and go to Control Panel and remove program?

[N.V.M.]

Originally Posted by Cman333

The computer came pre installed with windows. I don't have a copy to reinstall and don't want pirated copy on it.

you're sure there's not a partitioned back up of the OS on the HDD?

is there a legit sticker on the machine with a valid key # ? then any OEM disk will do.

[iwantaskyline]

use hitmanpro

http://www.surfright.nl/en/downloads

90 percent sure this will resolve your issue

[Psykopathik]

Originally Posted by N.V.M.

you're sure there's not a partitioned back up of the OS on the HDD?

is there a legit sticker on the machine with a valid key # ? then any OEM disk will do.

ooohh...i still have a legit serial sticker and a dead PC. the OEM disc was for a gateway. wonder if i can get another OEM disk and use my serial? whatever.. XP is soo old anyways lol!