Problems in Nephews Computer

Sarahjovi

My Newphews (14 year old) computer has got some sort of downloaded virus we think. Every Few Clicks even (on MSE) either re-directs to a !!!!!! Website of a site which looks like a advert page. We have run Spybot S & D and Adaware which removed lots of problems including a couple of Trogen type things. I have run these progs whilst having turned off System restore!

We have looked in Add/remove programs and these is a program ms1src.exe which when you click remove it asks you to type in a displayed code to continue, we haven't done this as we are suspicious of it!

We would be gratefull for any help

Thanks

Sarah

danmanchester

Looks like a tricky !!!!!! to remove, just scouring a few forums it seems by running Hijack This (free download) and Ewido security suite (on the 14 day free trial it should solve the problem.

If you look at the reply/post #2 by greyknight17 on this thread it should help I hope.

Freddie_Snowbits

it would be advisible to have a firewall and anti virus software installed.

salli9

Ive just run Hijack This and it's come up with dozens of files and a warning about what you actually delete. How do I know which ones?

Browntoa

if XP then download Ewido and use that

http://www.ewido.net/en/

and Microsoft Anti spyware

http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en

are you running them in safe mode ??

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam

as Spybot and this need to be run in that mode , with system restore off, to clean effectively

you also make no mention of anti Virus software or Firewall has he got those ??

meadowcat

DS3's computer got the lop.com thingy and I tried everything to get rid of it. Spent hours on it and in the end I just used the restore disks. Sis's computer has had it as well. It seems practically impossible to get rid of.

Browntoa

I've only ever had to use restore disks once + copy 2 files from the Xp disk on another occasion to fix PC's in the past, the other times a couple of boots into safe mode,full scans , reboots and scans again and they have been clean

maybe you were just unlucky ??

meep_2

salli9 please click the "do a scan and save a log file", then copy that log into a post so we can see whats running on the computer

Browntoa

but before this we need to have done a clean with Ewido in safe mode

this will more than likely remove this without any assistance

then post a hijack this log to see whats left

from geeks to go in Dans post above :-

1. Install Ewido Security Suite.
2. When installing, under 'Additional Options' uncheck:
* Install background guard
* Install scan via context menu
3. Launch Ewido, there should be an icon on your desktop, double click it.
4. The program will now open to the main screen.
5. When you run Ewido for the first time, you will get a warning 'Database could not be found!'. Click OK. We will fix this in a moment.
6. You will need to update Ewido to the latest definition files.
* On the left hand side of the main screen click update.
* Then click on Start Update.
7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'

Restart your computer and boot into Safe Mode

Now open Ewido and do a scan on your system.

* Click on scanner.
* Click on 'Complete System Scan' and the scan will begin.
* While the scan is in progress you will be prompted to clean the first infected file it finds. Choose 'Remove', then put a check next to 'Perform action on all infections' in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.
* Once the scan has completed, there will be a button located on the bottom of the screen named 'Save report'.
* Click 'Save report'.
* Save the report to your desktop.

Browntoa

salli9 wrote:

Ive just run Hijack This and it's come up with dozens of files and a warning about what you actually delete. How do I know which ones?

salli

don't post your hijack this log in this thread as it will confuse things, if you need help start a new thread

if you want to know whats what in your log then download XrayPc

http://www.snapfiles.com/get/xraypc.html

the online analyser bit will tell you whats bad

intel

Browntoa wrote:

salli

don't post your hijack this log in this thread as it will confuse things, if you need help start a new thread

if you want to know whats what in your log then download XrayPc

http://www.snapfiles.com/get/xraypc.html

the online analyser bit will tell you whats bad

Good bit of kit that I use it all the time