virus/malware.

Reluctant_spender

I agree with part of what the above poster has said. I do disagree with clearing the restore points point prior to being clean.

The reason I clear restore after you're clean is that should you make a mistake you can roll back - even if this means to an infected machine. If you clear your restore points you have nothing to roll back to.

GunJack

I personally would ensure the restore points are deleted....I had a similar situation where although the main infection was cleared, but ther were remnants in the restore points. Got rid of the restore points, re-ran the cleaners and then create a new restore point once clean. Did the job for me..I think providing you're careful and are reasonably competent, deleting restore points ain't so bad

atro1

Reluctant spender. Afraid that did not work copy of the malware log.

Malwarebytes' Anti-Malware 1.30
Database version: 1316
Windows 5.1.2600 Service Pack 3
25/10/2008 10:07:44
mbam-log-2008-10-25 (10-07-31) malware
Scan type: Full Scan (C:\|)
Objects scanned: 158646
Time elapsed: 36 minute(s), 34 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 6
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.8 85.255.112.11 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\!!818080aa-894f-43fb-89a6-97b5fb10b42f}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.8 85.255.112.11 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.8 85.255.112.11 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\!!818080aa-894f-43fb-89a6-97b5fb10b42f}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.8 85.255.112.11 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.8 85.255.112.11 1.2.3.4 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\!!818080aa-894f-43fb-89a6-97b5fb10b42f}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.8 85.255.112.11 1.2.3.4 -> No action taken.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Gave me 6 items which I removed! All dns changers.

What started this all off, I downloaded IE8, tried it for a couple of weeks did not like it as pc kept 'hanging' went to system restore and brought back IE7.

atro1

Do I turn off restore points and do it again. Deleting restore points really does not matter too much because it looks like if this does not work it will have to be a clean install.

aliEnRIK

atro1 wrote: »

What started this all off, I downloaded IE8, tried it for a couple of weeks did not like it as pc kept 'hanging' went to system restore and brought back IE7.

I would highly recommend using FIREFOX instead for now (Well personally id use it in place of it, but certainly be safer for now). Theres a fair possibility that when you boot up IE, then it auto runs a trojan.

http://www.mozilla-europe.org/en/firefox/

aliEnRIK

I would also recommend running the top 2 scans of CCLEANER
http://www.ccleaner.com/download
This will remove the 'temp' files that some trojans like to reside in
(backup the REGISTRY when it asks)

atro1

I will try both of them thanks.
I really am grateful for all the help I have been given.
At p[resent I am downloading to Mozilla back up. Have copied my Pictures to disc.
Preparing for the inevitable, new install. But I will keep trying all these tips.
Once again thanks.

atro1

Even using firefox still no joy. Three main sites so far. It will not let me into.
Hotukdeals.
Windows update Windows download.
Picasa web albums.

espresso

What happens if you enter http://85.13.221.162 into your browsers address bar?

atro1

That worked up came hotukdeals!! What next?