Thank You MrCharlie..

If you are infected with Outerinfo pop-ups (aka PurityScan, Oinadserver or OIN) - please start here:

First....

Go to Start > Control Panel > Add/Remove Programs and look for any of these and uninstall them:
(May also be listed in the Programs menu of Windows (Start button > Programs)

Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
or anything similar with Oin or Outerinfo in it.
Zolero
Tizzletalk
MediaTickets
Cowabanga
and any other programs you didn't install or don't recognize - if your not sure please ask first

If not listed....

Download and run this uninstaller: (The uninstaller is safe to run)
http://www.outerinfo.com/OiUninstaller.exe

Tutorial for the uninstaller if needed

Important Note: Some antivirus and antimalware scanners will flag the uninstaller from outerinfo.com as malicious. Similar to how a vaccine must contain parts of the virus to be effective, uninstallers will contain file names, registry locations, etc. that may set off notifications. This uninstaller has been tested by our experts and determined safe. However, it's always wise to use caution when using an uninstaller that originates from the same source as the malware.

Don't reboot!

Next.........

Download and run ComboFix.

Note:
You may not need to run ComboFix....try the rest of the fix first and if you still have a problem follow the instructions to run ComboFix including installing the Recovery Console.

Please Check Here for information on running ComboFix......Follow ALL instructions!!

When finished, it should produce a log, ComboFix.txt.
Post this log in your next reply together with a fresh HiJackThis log.

Note: ComboFix will make some changes to your computer such as create a new system restore point, back up your registry, reset your clock, these will all be reversed when you uninstall ComboFix.

To uninstall ComboFix:
Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /
Then hit enter.
This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.


Next---------

Please download SUPERAntiSpyware Home Edition (free) (SAS)

Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions, click Yes, Let it through your firewall!
Under Configuration and Preferences, click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked:

• Close browsers before scanning
• Scan for tracking cookies
• Terminate memory threats before quarantining.
• Ignore System Restore/Volume Information on ME and XP
• Please leave the others unchecked.
• Click the Close button to leave the control center screen.

On the main screen, under Scan for Harmful Software click Scan your computer.
On the left check C:\Fixed Drive.
On the right, under Complete Scan, choose Perform Complete Scan.
Click Next to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click OK.
Make sure everything in the white box has a check next to it, then click Next.
It will quarantine what it found and if it asks if you want to reboot, click
Yes.

To retrieve the removal information - please do the following:

• After reboot, double-click the SUPERAntispyware icon on your desktop.
• Click Preferences . Click the Statistics/Logs tab .
• Under Scanner Logs , double-click SUPERAntiSpyware Scan Log .
• It will open in your default text editor (such as Notepad/Wordpad).
• Please highlight everything , then right-click and choose copy.
• Click close and close again to exit the program.

___________________

Reboot, your pop-ups should be gone, but at this point I would suggest that you post a HiJackThis log of your system on the forum, this is because this infection is often installed with other malware and we want to make sure that your system is clean.
Follow step #5 on This Page to post your HiJackThis log.
Along with your HiJackThis log - post the logs from SUPERAntiSpyware and ComboFix.

Good Luck, MrC

=====================================================================
This is a self-help guide. Use at your own risk.

Important Note: If you need assistance with Outerinfo/PurityScan, please start a new topic in our Malware Removal Forum.

This post has been edited by MrCharlie: Oct 11 2008, 07:28 AM

This topic has been left open to allow specific questions and comments related ONLY to this guide. It's NOT for posting HJT logs, links to your logs, or any other general malware help. Replies not following these rules will be deleted. Thanks for your cooperation.

first off, thx for this guide., it was really helpful

i have a couple questions though

after i run "hosts" , its does its thing and thats it, right?
and when i run "hostsxpert" it shows the things inside the "hosts" folder, do i have to do anything with "hostsxpert" other than restoring ms original host files?

also, where should i post my combofix log? can i post it the same place i'll post my hijack this log?

Hello and Welcome to G2G!


That is correct.


Nope, since all we wanna do is restore Microsoft's Original Hosts Files.


You will post it in the Malware Removal forum along with a HiJackThis log.
http://www.geekstogo.com/forum/Malware-Rem...o-Here-f37.html

Sorry for probably stating the obvious, but I'm the person that needs a book for 'dummies to understand' 'windows xp for dummies'.
My computer is starting up and running very slowly too and I am wondering if I should do all the 'how to remove' things first before doing all the other things. And do I do all the things in that order. Also, how do I know if I am infected with 'Outerinfo, trojan.w32,kiijsjt, Winhound etc.....
I know it's stupid sounding but I am really 'THE DUMMY'.

Hello Aileen Delahunty

Start here
http://www.geekstogo.com/forum/Must-Read-B...-Log-t2852.html
That will get you started

Why Quarantine, and not removal?

For starters if something was removed by mistake it can easily be restored also if we need a malware file for the investigation...we have it.

After all the malware is cleaned and the computer is operating OK, then you can delete the malware in "Quarantine". Good Luck, MrC

I followed all of the steps to get rid of the Outerware. However, in the process I completely lost all of my audio devices. Is there any way I can get it back? I tried system restore but apparently I have no restore points.

You should post a HiJackThis log of the system as suggested and let someone look at it. You may have other malware on the system.

Please don't post it here in this thread...post it as outlined in the tutorial, also post the logs from ComboFix and AVG- AS, MrC

Hi, outerinfo has blocked all of my privileges (?) and my controll panel is gone!
i cant get to the removal tool, and i have tried the uinstall that comes with the outerinfo
but it takes a second or so, than the window is gone..

does anyone know what i should do?

(Sorry about my english, i am from Norway )

-Fredrik-

See if you can post a HiJackThis log of the system on the forum...please not here!

It most likely isn't Outerinfo but the other malware that's installed with it.

HJT will fit on a floppy if you can't download it.

Follow step #5 on This Page to post your HiJackThis log.

MrC

SmartyChic1: I have split your log from this thread. It can be found at http://www.geekstogo.com/forum/ComboFix-lo...96#entry1042696

I suggest subscribing to that thread. At the top of the page, click on Options (under New Topic). Select Track This Topic.
On the page that loads, select Immediate Notification.

-Ryan

thanks it was heaps helpful

This post has been edited by MATALICOUS: Oct 13 2007, 08:16 AM

Hello and welcome MATALICOUS

Thanks for taking the time to let us know it worked out for you

Glad to hear its sorted