Virus? Google search not going where it should

ABARKIE

aliEnRIK wrote: »

Well I really suggest you do run them
Your hosts file has been changed (More than likely)

Hi,

Ran them both.

Hosts file had been changed, now returned to original.

Ran Spybot, no errors / notifications.

Anything else to do now?

Thanks

aliEnRIK

You did 'immunise' with spybot yes?

Find these 'manually' and delete them (Probably need firefox to be off when you do it) ~
c:\documents and settings\ALAN B\Application Data\Mozilla\Firefox\Profiles\t8y4dtan.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayAccess Component.dll
c:\documents and settings\ALAN B\Application Data\Mozilla\Firefox\Profiles\t8y4dtan.default\ext ensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayShortcutMaker.dll


Open notepad and copy/paste the text in RED below

File::
c:\windows\system32\stsf.bat
c:\windows\system32\agsaami.dll
c:\windows\system32\agsaamg.dll
c:\windows\system32\agsaamj.dll
c:\windows\system32\agsaamc.dll
c:\windows\system\ppacklib.dll
c:\windows\sslzdlt.dll


Save this as "CFScript" (FULL file will be 'CFScript.txt')

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.




This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.

ABARKIE

Hi,

Yes I did immunize.

Will do the rest tonight.

Thanks

ABARKIE

Hi,

Done the script and ran it.

Below is the log.

What next please?

ComboFix 09-11-07.03 - ALAN B 10/11/2009 7:32.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1013.596 [GMT 0:00]
Running from: c:\documents and settings\ALAN B\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\ALAN B\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Created a new restore point

FILE ::
"c:\windows\sslzdlt.dll"
"c:\windows\system\ppacklib.dll"
"c:\windows\system32\agsaamc.dll"
"c:\windows\system32\agsaamg.dll"
"c:\windows\system32\agsaami.dll"
"c:\windows\system32\agsaamj.dll"
"c:\windows\system32\stsf.bat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\sslzdlt.dll
c:\windows\system\ppacklib.dll
c:\windows\system32\agsaamc.dll
c:\windows\system32\agsaamg.dll
c:\windows\system32\agsaami.dll
c:\windows\system32\agsaamj.dll
c:\windows\system32\stsf.bat

.
((((((((((((((((((((((((( Files Created from 2009-10-10 to 2009-11-10 )))))))))))))))))))))))))))))))
.

2009-11-08 15:32 . 2009-11-09 18:22

---

d

---

w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-08 15:32 . 2009-11-08 22:37

---

d

---

w- c:\program files\Spybot - Search & Destroy
2009-11-08 14:08 . 2009-11-08 14:08

---

d

---

w- c:\program files\CCleaner
2009-11-07 14:31 . 2009-11-07 14:31 152576 ----a-w- c:\documents and settings\ALAN B\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-06 23:39 . 2009-11-06 23:39

---

d

---

w- c:\documents and settings\ALAN B\Application Data\Malwarebytes
2009-11-06 23:39 . 2009-09-10 14:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-06 23:39 . 2009-11-06 23:39

---

d

---

w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-06 23:39 . 2009-09-10 14:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-06 23:39 . 2009-11-06 23:39

---

d

---

w- c:\program files\Malwarebytes' Anti-Malware
2009-11-05 19:31 . 2009-07-28 16:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-05 19:31 . 2009-03-30 10:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-11-05 19:31 . 2009-02-13 12:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-11-05 19:31 . 2009-02-13 12:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-11-05 19:31 . 2009-11-05 19:31

---

d

---

w- c:\program files\Avira
2009-11-05 19:31 . 2009-11-05 19:31

---

d

---

w- c:\documents and settings\All Users\Application Data\Avira
2009-10-22 21:02 . 2002-01-05 10:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-10-22 21:02 . 2002-01-05 04:40 487424 ----a-w- c:\windows\system32\msvcp70.dll
2009-10-22 21:02 . 2002-01-05 05:48 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-10-22 21:02 . 2003-08-07 14:01 237568 ----a-w- c:\windows\system32\lame_enc.dll
2009-10-22 21:01 . 2009-10-22 21:01

---

d

---

w- c:\program files\AML Products
2009-10-17 08:30 . 2009-10-17 08:30

---

d

---

w- c:\documents and settings\ALAN B\Local Settings\Application Data\PCHealth

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-08 12:02 . 2009-09-06 08:30

---

d

---

w- c:\documents and settings\ALAN B\Application Data\FrostWire
2009-11-07 14:32 . 2008-05-26 11:38

---

d

---

w- c:\program files\Java
2009-11-06 22:35 . 2009-05-17 19:14

---

d

---

w- c:\program files\SUPERAntiSpyware
2009-11-05 23:29 . 2009-07-24 21:36

---

d

---

w- c:\program files\COMODO
2009-11-03 20:57 . 2009-04-21 22:33

---

d

---

w- c:\program files\ProgDVB
2009-11-03 07:28 . 2009-03-21 11:03 1 ----a-w- c:\documents and settings\ALAN B\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-10-24 19:41 . 2009-08-09 19:26

---

d

---

w- c:\documents and settings\ALAN B\Application Data\FileZilla
2009-10-16 07:41 . 2009-09-03 05:58

---

d

---

w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-11 04:17 . 2009-03-21 10:21 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-05 17:30 . 2009-03-21 12:43

---

d

---

w- c:\documents and settings\ALAN B\Application Data\uTorrent
2009-09-11 16:30 . 2009-04-05 21:12

---

d

---

w- c:\program files\Microsoft Silverlight
2009-09-11 14:18 . 2008-04-14 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 18:52 . 2009-07-25 08:23 493425 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-09-10 18:10 . 2009-05-17 19:16 117760 ----a-w- c:\documents and settings\ALAN B\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-09-06 08:47 . 2009-09-06 08:47 0 ----a-w- c:\documents and settings\ALAN B\Application Data\FrostWire\.NetworkShare\Incomplete\T-4506256-LimeWireWin4.16.6.exe
2009-09-06 08:32 . 2009-09-06 08:30 12588752 ----a-w- c:\documents and settings\ALAN B\Application Data\OpenCandy\pal_install_r83035.exe
2009-09-04 21:03 . 2008-04-14 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-03 18:02 . 2009-03-10 21:27 94976 ----a-w- c:\documents and settings\ALAN B\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 07:36 . 2008-04-14 12:00 832512

---

w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2008-04-14 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2008-04-14 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-27 23:12 . 2009-03-21 10:58 952 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-08-26 08:00 . 2008-04-14 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-23 14:47 . 2009-08-23 14:47 152576 ----a-w- c:\documents and settings\ALAN B\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-17 22:33 . 2009-08-17 22:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
.

((((((((((((((((((((((((((((( SnapShot@2009-11-08_14.46.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-10 07:43 . 2009-11-10 07:43 16384 c:\windows\Temp\Perflib_Perfdata_798.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-11 39408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-15 2000112]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-11 1028096]
"QuickFinder Scheduler"="c:\program files\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-02 83568]
"UCam_Menu"="c:\program files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
"LanguageShortcut"="c:\program files\HomeCinema\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2008-06-10 782336]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-06-10 220160]
"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"lxdimon.exe"="c:\program files\Lexmark 3500-4500 Series\lxdimon.exe" [2007-07-16 434864]
"lxdiamon"="c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe" [2007-07-16 25264]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-07 16862208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Mobile User VPN.lnk - c:\program files\WatchGuard\Mobile User VPN\SafeCfg.exe [2009-4-1 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-06 08:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\NetMeeting\\Conf.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\ALAN B\\My Documents\\SATELLITE FOLDER\\dcc295\\DCC.exe"=
"c:\\WINDOWS\\system32\\lxdicoms.exe"=
"c:\\Program Files\\Lexmark 3500-4500 Series\\lxdimon.exe"=
"c:\\Program Files\\Lexmark 3500-4500 Series\\App4R.exe"=
"c:\\Program Files\\Lexmark 3500-4500 Series\\lxdiamon.exe"=
"c:\\WINDOWS\\system32\\lxdicfg.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdipswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxditime.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdijswx.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\WatchGuard\\Mobile User VPN\\IreIKE.exe"=
"c:\program files\WatchGuard\Mobile User VPN\ViewLog.exe"= c:\program files\WatchGuard\Mobile User VPN\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog
"c:\program files\WatchGuard\Mobile User VPN\CmonApp.exe"= c:\program files\WatchGuard\Mobile User VPN\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp
"c:\program files\WatchGuard\Mobile User VPN\vpn.exe"= c:\program files\WatchGuard\Mobile User VPN\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [17/02/2009 10:43 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17/02/2009 10:43 74480]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [05/11/2009 19:31 108289]
R2 Crypto;Crypto;c:\windows\system32\drivers\Crypto.sys [01/04/2009 19:22 521786]
R2 IPSECDRV;SafeNet IPSec Plugin;c:\windows\system32\drivers\IpSecDrv.sys [01/04/2009 19:22 119864]
R2 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]
R3 DniVap;SafeNet WAN Miniport (VA);c:\windows\system32\drivers\vap.sys [01/04/2009 19:18 36188]
R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [10/06/2008 10:36 156160]
R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [26/05/2008 11:10 572416]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17/02/2009 10:43 7408]
S2 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdiserv.exe [21/04/2009 22:05 99248]
S2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [10/06/2008 09:14 159744]
S3 BGRaSvc;BGRaSvc;"c:\program files\BullGuard Software\BullGuard\support\bgrasvc.exe" --> c:\program files\BullGuard Software\BullGuard\support\bgrasvc.exe [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://www.medion.com
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Open with WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
FF - ProfilePath - c:\documents and settings\ALAN B\Application Data\Mozilla\Firefox\Profiles\t8y4dtan.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo.co.uk
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-10 07:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Driver Signing]
@Denied: (2) (Administrators)
@Allowed: (2) (Administrators)
"Policy"=hex:00,00,00,00

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange"="1"
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.

---

DLLs Loaded Under Running Processes

---

- - - - - - - > 'winlogon.exe'(1096)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3472)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.

---

Other Running Processes

---

.
c:\program files\WatchGuard\Mobile User VPN\IreIKE.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WatchGuard\Mobile User VPN\IPSecMon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\lxdicoms.exe
c:\windows\system32\PSIService.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Google\Google Desktop Search\GoogleDesktopIndex.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-11-10 7:49 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-10 07:48
ComboFix2.txt 2009-11-08 14:48

Pre-Run: 40,534,253,568 bytes free
Post-Run: 40,403,845,120 bytes free

- - End Of File - - 84D873BAE3FFB4B891CDCF91B80ECCD7

aliEnRIK

Download and run the FREE version of DR WEB
http://www.freedrweb.com/download+cureit/
It will auto QUICK scan
After that set to scan the WHOLE computer and press the 'play' icon

GunJack

from the log, it looks like limewire has been used on this pc......you really ought to think seriously about removing this application (if you haven't already), as it's not only a well-known source of spreading nasties, most of the downloads on it are illegal

You may wish also to disable Spybot's Tea-Timer function, as it can cause issues/conflicts.....

ABARKIE

Hi,

Do you mean Frostwire?

I have uninstalled that.

I have ran Dr Web & then a complete scan.

No viruses reported.

What not?

Thanks

ABARKIE

Hi,

Still getting the same problem though as at the start

Eg not going to web page - goes to 64.11.96 etc then onwards

Driving me mad!!

GunJack

Still got the hijacker ?? okay, try superantispyware, update and full scan, post the log back on here, and then do another HJT scan and log....

GunJack

ABARKIE wrote: »

Hi,

Do you mean Frostwire? no, deffo limewire. in the log there seemed to be a partially-completed download from limewire. Frostwire is similar, so maybe they download via each other, not familiar with fw

I have uninstalled that. probably a wise move


Thanks

any p2p is a potential security risk, not to mention content of dubious legality