question from relative computer novice - help please!!

brummiebabe

Thanks for that - I'm on my dad's laptop currently, but will try your suggestion later/tomorrow!

Donnie

If you are on your dad's laptop maybe you can take the time to download Malwarebytes and to place it on a USB drive or CD, for installation to you computer.

brummiebabe

Shame I didn't read your post earlier - have come back onto my PC & can't access it with either of the links. When I clink on the direct link, it says it's not ' a valid Win32 application' - have no idea what that means?

Edit: Just saved it to my documents and tried to open it from there - says it's a corrupted file & should obtain new copy! Imagine this is all as a result of the virus (or whatever it is!!!!)

Donnie

Just tested the link and software and it's fine.

If it still fails, you can try installing the software in Safe Mode(reboot and tap F8 repeatedly on restarting) or you can try SuperAntiSpyware

brummiebabe

Right...where do I start?

Have done a number of scans over the last day or so....

Spybot - found LOADS of problems/threats. Sorted most of them out, but can't fix the ones that seem to be linked to the problem!!

Malwarebytes - did scan but kept flashing up 'error' and didn't actually manage to show any results or fix anything. However, errors seemed to occur when it was scanning the same thing that spybot detected, but couldn't repair.

I saved the 'full report' from spybot and will post the 1st part of these below - don't know if anyone is able to decipher it or give any further advice as to where to go from here???


FunWebProducts: [SBI $8CC75C5A] Settings (Registry value, fixed)
HKEY_USERS\S-1-5-21-564752080-2425198017-48089344-1007\Software\Microsoft\Internet Explorer\URLSearchHooks\!!00A6FAF6-072E-44cf-8957-5838F569A31D}
FunWebProducts: [SBI $B71E4FFD] Program directory (Directory, fixing failed)
C:\Program Files\FunWebProducts\
MyWay.MyWebSearch: [SBI $17F9DD99] Autorun settings (Registry value, fixed)
HKEY_USERS\S-1-5-21-564752080-2425198017-48089344-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Email Plugin
MyWay.MyWebSearch: [SBI $51E6ABA2] Program directory (Directory, fixing failed)
C:\Program Files\MyWebSearch\
FunWebProducts: [SBI $87976B73] Program directory (Directory, fixing failed)
C:\Program Files\funwebproducts\PopSwatr
FunWebProducts: [SBI $87976B73] Program directory (Directory, fixing failed)
C:\Program Files\funwebproducts\Shared
MyWay.MyWebSearch: [SBI $BEDFCB4A] Program directory (Directory, fixing failed)
C:\Program Files\MyWebSearch\SrchAstt\
MyWay.MyWebSearch: [SBI $78882F84] Program directory (Directory, fixing failed)
C:\Program Files\MyWebSearch\SrchAstt
Microsoft.WindowsSecurityCenter_disabled: [SBI $2E20C9A9] Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start


2nd one:


FunWebProducts: [SBI $8CC75C5A] Settings (Registry value, fixed)
HKEY_USERS\S-1-5-21-564752080-2425198017-48089344-1007\Software\Microsoft\Internet Explorer\URLSearchHooks\!!00A6FAF6-072E-44cf-8957-5838F569A31D}
FunWebProducts: [SBI $B71E4FFD] Program directory (Directory, fixing failed)
C:\Program Files\FunWebProducts\
MyWay.MyWebSearch: [SBI $17F9DD99] Autorun settings (Registry value, fixed)
HKEY_USERS\S-1-5-21-564752080-2425198017-48089344-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Email Plugin
MyWay.MyWebSearch: [SBI $51E6ABA2] Program directory (Directory, fixing failed)
C:\Program Files\MyWebSearch\
FunWebProducts: [SBI $87976B73] Program directory (Directory, fixing failed)
C:\Program Files\funwebproducts\PopSwatr
FunWebProducts: [SBI $87976B73] Program directory (Directory, fixing failed)
C:\Program Files\funwebproducts\Shared
MyWay.MyWebSearch: [SBI $BEDFCB4A] Program directory (Directory, fixing failed)
C:\Program Files\MyWebSearch\SrchAstt\
MyWay.MyWebSearch: [SBI $78882F84] Program directory (Directory, fixing failed)
C:\Program Files\MyWebSearch\SrchAstt
Microsoft.WindowsSecurityCenter_disabled: [SBI $2E20C9A9] Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start





As I said - I don't know whether this sheds any light on things for those of you who understand what it means or is there something else I need to be looking at?

Donnie

Yes, it shows that you were and maybe are still infected.

Hopefully Spybot has fixed enough for Malwarebytes and SuperAntiSpyware to be able to run and then mop up.

LongTermLurker

see here for removal instructions http://www.liamdelahunty.com/tips/fun_web_products.php

Amongst other things FunWebProducts may change your default search engine to MyWebSearch, and it may install a toolbar. You get a "Search Assistant" for when you mistype a URL. You can install it by "upgrading" your smileys in various messengers, cursors for windows, screensavers etc.

Sound familiar?

brummiebabe

Donnie wrote: »

Yes, it shows that you were and maybe are still infected.

Hopefully Spybot has fixed enough for Malwarebytes and SuperAntiSpyware to be able to run and then mop up.

Malawarebytes couldn't run properly due to an error.

Will try SuperAntiSpyware next!

brummiebabe

LongTermLurker wrote: »

see here for removal instructions http://www.liamdelahunty.com/tips/fun_web_products.php
Sound familiar?

I've already done what's advised -uninstalled all mywebsearch stuff - no luck!

brummiebabe

Just wanted to say a big thankyou to you all! I've finally got the problem sorted:j - through a combination of HijackThis and Malwarebytes - plus finding others on specialist pages with the same problem - I've resolved it!:D

Am really grateful for all your advice!!:A