HELP!!! 'Man in the browser' Virus UPDATED!

aliEnRIK

Hijack this ~ just run the exe file again and rescan and tick those entries then remove them

aliEnRIK

Log seems ok at 1st glance
I notice you use FROSTWIRE. Thats more than likely the cause of your problems
BIGFISHGAMES also has malware attached

With the seriousness of your problems though, is recommend another couple of scans ~
Download SUPERANTISPYWARE (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_superantispyware/
UPDATE and PERFORM COMPLETE SCAN
(Then goto console and LOGS and post the log it created then untick it from STARTING UP WITH WINDOWS)

Download and run the FREE version of DR WEB
http://www.freedrweb.com/download+cureit/gr/
Turn your anti virus OFF
Click CANCEL to the 'Would you like to read purchase terms now?' message
Click START click OK
It will auto QUICK scan
After that set to scan the WHOLE computer and press the 'play' icon
***DO NOT UPGRADE TO FULL VERSION***

geminibabe

aliEnRIK wrote: »

Hijack this ~ just run the exe file again and rescan and tick those entries then remove them

Ok lovely have done that now!

geminibabe

Ok, I have uninstalled frostwire and big fish games now. I will do the next tasks you have set me tomorrow evening. Thank you so much for your help you have been AWESOME!!!!! If you are on tomorrow etc I will do those things and post logs etc so you can have a look if its not too much trouble. Thanks again!!!!!

geminibabe

OK, superantispyware log as follows;

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/29/2010 at 00:26 AM

Application Version : 4.34.1000

Core Rules Database Version : 4742
Trace Rules Database Version: 2554

Scan type : Complete Scan
Total Scan Time : 00:45:18

Memory items scanned : 675
Memory threats detected : 0
Registry items scanned : 7822
Registry threats detected : 0
File items scanned : 40079
File threats detected : 96

Adware.Tracking Cookie
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@statse.webtrendslive[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@ads.pointroll[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@bs.serving-sys[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@account.7digital[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@tradedoubler[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@247realmedia[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@serving-sys[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@atdmt[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@zedo[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@doubleclick[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@advertising[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@msnportal.112.2o7[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@questionmarket[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@apmebf[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@ad.yieldmanager[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@atdmt[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@atdmt[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@adopt.euroclick[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@media.adrevolver[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@advertising[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@apmebf[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@2o7[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@2o7[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@clicks.emarketmakers[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@trafficmp[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@247realmedia[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@ad.yieldmanager[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@doubleclick[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@channel4.112.2o7[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@channel4.112.2o7[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@network.realmedia[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@realmedia[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@stats.adbrite[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\heath_&_lia@www.mynortonaccount[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@revsci[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@atdmt[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@atdmt[4].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@atdmt[8].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@atdmt[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@atdmt[5].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@adrevolver[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@atdmt[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@atdmt[6].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@adopt.euroclick[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@ehg-totalsystemsservices.hitbox[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@advertising[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@media.adrevolver[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@imrworldwide[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@advertising[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@bs.serving-sys[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@bs.serving-sys[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@advertising[4].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@2o7[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@clickshift[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@2o7[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@server.lon.liveperson[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@server.lon.liveperson[4].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@server.lon.liveperson[5].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@server.lon.liveperson[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@reztrack[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@specificclick[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@serving-sys[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@questionmarket[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@at.atwola[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@247realmedia[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@247realmedia[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@247realmedia[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@ad.yieldmanager[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@serving-sys[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@ad.yieldmanager[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@statse.webtrendslive[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@statse.webtrendslive[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@socialmedia[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@tradedoubler[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@www.clash-media[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@hitbox[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@doubleclick[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@doubleclick[5].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@doubleclick[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@doubleclick[6].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@doubleclick[3].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@mediatraffic[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@doubleclick[4].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@ad.jemm-traffic.co[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@adviva[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@adviva[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@dmtracker[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@go.globaladsales[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@fastclick[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@media6degrees[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@msnportal.112.2o7[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@overture[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@tacoda[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@stats.channel4[1].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@www.googleadservices[2].txt
C:\Users\Heath & Lia\AppData\Roaming\Microsoft\Windows\Cookies\Low\heath_&_lia@www.googleadservices[3].txt

geminibabe

Bump for AlienRIK!

Am doing those scans now and posting results as advised.

Cheers

:beer:

hansi

I would now suggest that you get a top anti virus programme, not a free one.

espresso

hansi wrote: »

I would now suggest that you get a top anti virus programme, not a free one.

I would suggest that you are talking rubbish!

hansi

and why would you say that?

espresso

hansi wrote: »

and why would you say that?

No you please explain your reasons for posting that advice.