Hi Derek,
I checked every where you suggested just incase and all is the way you say
it's suppose to be. Incase you missed my other posts... My computer is Fixed
now. Yes, I was running updated versions of malwarebytes. I kept up dating
it every day and running it. One of their updates finally did the trick and
wiped this virus cocktail off my computer. These things just keep getting
more sophisticated all the time it takes the malware / virus removal guy's
time to come up with a fix. I'm sure it affected many people and they were
aware of it and came up with an update to kill it. Thanks for your
suggestions I'll keep them for future reference.
Gregg
----- Original Message -----
From: "Derek Buchanan" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Tuesday, March 23, 2010 10:55 AM
Subject: Re: [PCSOFT] can't get rid of a redirecting/browser hijacking Virus
> Gregg,
> There are two places right off the bat that I would check. First off,
> go back to safe mode and make sure there are no proxy settings boxes
> checked
> in the Internet Options. On the *Tools* menu in Internet Explorer,
> click *Internet
> Options*, click the *Connections* tab, and then click *LAN Settings*.
> Under
> *Proxy server*, unclick to select the *Use a proxy server for your
> LAN*check box if it is selected. Also unclick the checkbox to select
> the
> *Bypass proxy server for local addresses* check box if it is selected.
>
> The second location, while not hacked much anymore is the hosts file.
> It is located in c:\windows\system32\drivers\etc. You can open it with
> notepad, wordpad, etc. It should have only one entry in it by default
> under
> the documentation area that Microsoft puts in.
> 127.0.0.1 localhost
>
> One hacked examples would be: 127.0.0.1 www.mcafee.com
> That essentially blocks you from getting to anything Mcafee related.
> Deleting the entry 127.0.0.1 www.mcafee.com would reopen access to mcafee.
> If you are not comfortable editing the host file you can move or delete it
> from the folder.
>
> I would then update and run Malwarebytes again since there might be
> something else hanging out and you did not mention if you ran an updated
> scan or just installed and ran Malwarebytes as it came from the download.
> Have you ever run spybot - search and destroy?
>
> Derek
The NOSPIN Group has added a new feature on our website,
web based bulletinboard for questions and answers:
Visit our sister website at http://nospin.com
|
