Geek squad help needed ?browser hijack?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Master Baiter Joined: 18 Nov 2007 Posts: 192

My brain is melting trying to understand all of this Shocked

You guys have been so helpful but I wonder if I might make things worse by being clueless. I am doing my reading, and I'm learning, but slowly . If I had the cash to spare I could call a professional to save me...but I don't.
How about I just save a few things and use the recovery disc that came with my computer to reload everything? Fresh start? Is that an option or a bad idea?

Not quite a Newb Joined: 22 Jul 2009 Posts: 42

That sounds like a drastic step to me, it's time consuming and a pain in the ass. I'd start with a spyware removal program, see if that helps.

Posted: Sat Jul 25, 2009 4:16 pm

If you are concerned that your PC is still infected then it's probably worth doing a full reinstall. Make sure you have any important docs backed up and then wipe your HD. There are still plenty of rootkits/trojans out there that many AV products won't spot and the "have I-haven't I got one" approach can drive you nuts. When you've re-installed the OS make sure the first thing you do is upgrade to the latest security patches and get a decent AV, AVG is good but a bit of a system hog, Avira is excellent, get a decent firewall too as the Windows one sucks (it only blocks incoming traffic, not outgoing) Zone Alarm is good and free. Ad-aware will take care of most adware problems and also ditch IE as it's a security risk, Chrome is probably the most secure browser out of the box (even the Pwn2Own guys think so) so if you're ultra concerned then thats the way to go.

Master Baiter Joined: 18 Nov 2007 Posts: 192

I might do that and you're right it the wondering bugs me. What I've done now is unistalled avg and installed ca security suite. I disabled windows firewall and I'm using the one from CA. When I first started CA after install I got a message that said internet explorer is trying to act as a server--allow or block---I have no idea what that meant but I blocked it. I also scanned and got these results:
Top infections found during scan (Limited to 10).
HTML/FakeAV.A
HTML/IFrame!exploit
Win32/KollahCryptorB
All of the tools you guys gave me seem to have removed alot. The computer is running faster and I haven't had another issue. Thanks again.

Posted: Sat Jul 25, 2009 8:41 pm

^^here's another good tool for giving your machine a bit of a performance boost: http://www.ccleaner.com/

Posted: Sat Jul 25, 2009 9:42 pm

In 10+ years of being the professional you don't want to call (we are paid well) I have never found a virus that couldn't be deleted. If you go down the reformat and reinstall path, not only do you need the Windows disk, but also the motherboard drivers and the installation files and keys to all the applications you want to reinstall. Then you have to import your records from your disk full of saved info - and do you know how to save email files, for example? Oh, and how do you know you aren't reimporting the virus?

Some viruses are pretty complex, but there are plenty of tools out there which are easy to use. Has anyone mentioned Malwarebytes? It's certainly worth running once.

Master Baiter Joined: 18 Nov 2007 Posts: 192

^^^ I have malwarebytes. I ran it. I did not say I didn't want to call a professional. I said I couldn't afford it, so I just don't have that option. My apologies if I have offended you or your profession.

Posted: Sat Jul 25, 2009 9:52 pm

No offence taken, I knew what the issue was Very Happy

We are rather used to people reluctantly calling us, hoping we get the hell out quickly and never wanting to see us again!

Or is that just me?

Posted: Sat Jul 25, 2009 10:57 pm

Try here for a step-by-step primer to clean up your machine (well, the basics anyway, before getting down to serious stuff)
http://forums.majorgeeks.com/showthread.php?t=35407. Read down and follow Chas Lang's advice to the letter

The you can download HijackThis from here http://www.spychecker.com/program/hijackthis.html to see what's running on your PC and learn how to read the report here (it's not a total annswer, and don't ask it to fix anything yet) http://www.aumha.org/a/hjttutor.php. You can Google anything you find running that you don't understand - I tend to trust the results from http://www.liutilities.com/products/wintaskspro/processlibrary/

And here are some other resources

http://forums.whatthetech.com/HijackThis_Logs_Infections_Removal_f27.html
http://www.spywareinfoforum.com/index.php?showforum=18
http://www.spywarewarrior.com/ (links at the bottom of the page)
http://www.cybertechhelp.com/forums/index.php
http://www.techmonkeys.co.uk/forums/viewforum.php?f=8&sid=3321937f12fb6e1421e44946b21ca2a3
http://www.malwareremoval.com/

Some of these site will give links to on-line scanners - they will often detect but not fix - but at least you then know what you're up against, though.

Others are fora where you can get cleaning tutorials and post a thread to get help with cleaning your machine and its particular infections

Hope it helps. Best of luck.

Edited to add. And once you get it clean, you need to take steps the keep it that way.

I use:

and I sit behind a NATS router with hardware firewall
I also scan weekly with:

And I clean up before scans with CCleaner.

I use Firefox with NoScript and Adblock Plus. I have it set to ask everytime where to downloads files to, so it asks in case of a driveby.

I also regularly check my machine at GRC.com to see if it's fully stealth. I've also got a little utility called tcpview to see if anything is calling home. I have deleted any IM software and I also wouldn't have Skype - I believe it uses a form of PtP fileshare and opens a hole in your firewall.

Not saying mine is the ultimate system, but I go to some pretty dark places (I have a Linux laptop for the really, really iffy areas) and haven't had any issues. Needless to say, I click on nothing and accept no downloads, drivers, codecs or anything else I'm offered unless I'm specifically looking and I trust the source.

You'll need to find something that works for you.

Geek squad help needed ?browser hijack?	View next topic View previous topic