[Crustyoldbloke]

Helol again Kyle

In addition to the automated delete, HJT shows one other, but only minor.

Rescan with HijackThis. Close all programmes leaving only HijackThis running. Place a checkmark or tick against the following:

O17 - HKLM\System\CCS\Services\Tcpip\..\{BF46CDA8-6D28-4D0D-84AE-2EE739194CE0}: NameServer = 195.112.4.4,195.112.4.7

Click on Fix Checked when finished and exit HijackThis.

Install Ewido Security Suite.

• Install Ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
  • You will need to update Ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")

If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates
Do NOT run a scan yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:

Safe Mode

Launch Ewido, there should be an icon on your desktop, double-click it.

• The programme will now open to the main screen.
• When you run Ewido for the first time, you will get a warning "Database could not be found!". Click OK.

Now that the updates have been installed do the following:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with Ewido it is finding cases of false positives.
  • You will need to step through the process of cleaning files one-by-one.
  • If Ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop and include it in your reply.

Now close Ewido security suite.

[Advertisements]

I carried out the above, and it cut off my connection to the internet, I don't know why, but it wouldn't detect I was online. I did a system restore to before that point, any advice?

[marchhair]

I carried out the above, and it cut off my connection to the internet, I don't know why, but it wouldn't detect I was online. I did a system restore to before that point, any advice?

[Crustyoldbloke]

Hello Kyle

Are you connected to the internet OK now? WE can go backwards in HJT if we need to.

The IP 195.112.4.7 is for url of http://www.accentuk.com/ and the domain is nildram.co.uk which according to Jotti's virus list is an IRC flood virus.

We best leave it alone.

Did you run the Ewido scan OK?

How are things now?

[marchhair]

Hello Kyle

Are you connected to the internet OK now? WE can go backwards in HJT if we need to.

The IP 195.112.4.7 is for url of http://www.accentuk.com/ and the domain is nildram.co.uk which according to Jotti's virus list is an IRC flood virus.

We best leave it alone.

Did you run the Ewido scan OK?

How are things now?

Yeah, everything's working okay! I'm connected to the internet fine. A bit worrying when your ISP is detected as a virus o.0 I'm no longer receiving...any pop-ups, really, which is great! Extreme gratitude, much appreciated.

[Crustyoldbloke]

Congratulations! your new log is clean. Just a little bit more to do to prevent further infection.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.

3. Turn ON System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
I recommend going to the following link and update as recommended by Microsoft. This adds more security and extra features including a pop-up blocker for Internet Explorer. Microsoft Update

Now that everything is fixed, I suggest that you consider getting these programmes to help keep the computer clean:

SPYWARE BLASTER - Blocks bad ActiveX items from installing on your computer.
AD-AWARE PERSONAL – A fine free malware detector and removal programme
SPYBOT S&D – Excellent free spyware detector and removal programme
GOOGLE TOOLBAR - Blocks many unwanted pop-ups in Internet Explorer.
FIREFOX - Safer alternative to the Internet Explorer web browser.
AVG ANTIVIRUS FREE EDITION - Free antivirus programme if you currently are not using one.
ZONEALARM - Free firewall programme if you currently are not using one (Windows XP has a built-in firewall).

Remember to update these frequently.

Please note that whilst there is nothing wrong in having more than one antispyware programmes for “on demand” scanning, having two or more antivirus systems is not recommended as they may well interfere with each other.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep your Windows, antispyware and antivirus updated.

A correction to Jottis's list was posted late last night. I'm afraid that human error creeps in from time to time. Anyway, I wish you happy safe surfing Kyle!

[Crustyoldbloke]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.