System Tools Virus Infection Removal

aliEnRIK

TICK and FIX these in hijack -
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: FCToolbarURLSearchHook Class - {ada2ac0d-15c6-4611-ba5d-5b0a8b52fd6d} - C:\Program Files\Nectar Search Toolbar\Helper.dll
O1 - Hosts: ::1 localhost
O3 - Toolbar: Nectar Search Toolbar - {8020143D-5926-4394-A04D-DD0B649DA121} - C:\Program Files\Nectar Search Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SmileboxTray] "C:\Users\Bec\AppData\Roaming\Smilebox\SmileboxTray.exe"
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

becky170

Thanks for all your help aliEnRIK, I've done that (destroyed the file and did the tick and fix in hijack)!! Does that mean I should be ok now?

aliEnRIK

Can you clarify there was a file in that folder and its gone now?

becky170

Inside c:\programdata\ePjGgMf06308, there was a file of the same name and malwarebytes was able to destroy it. Still have the folder but the file has done.

aliEnRIK

manually remove the folder too

The HOSTS file usually gets changed with this so id recommend resetting it

Download HostsXpert (US MIRROR)
http://www.softpedia.com/progDownload/Hoster-Download-27041.html
and then follow the below steps.

* Unzip HostsXpert.zip
* It will create a folder named HostsXpert in whatever folder you extract it to.
* Run HostsXpert.exe by Pressing the SHIFT key, RIGHT CLICKING and selecting to 'RUN AS' (admin)
* click the Make Writeable? button.
* click Restore Microsoft's Hosts File and then click OK.
* Click the X to exit the program

aliEnRIK

After that id recommend one (very long) final scan

Download and run the FREE version of DR WEB
http://www.freedrweb.com/download+cureit/gr/
Turn your anti virus OFF
Click CANCEL to its first question (Unless your happy to lock windows until its run)
Click NO to opening the purchase page
Click START
click YES
It will auto QUICK scan
Pess the STOP button on the right (Unless your happy to quick scan first)
After that set to COMPLETE SCAN the computer and press the 'play' icon
This will more than likely take hours (12 is average!), so leave running overnight or whatever

***DO NOT UPGRADE TO FULL VERSION***

reset the HOSTS file if it asks you

becky170

aliEnRIK wrote: »

manually remove the folder too

The HOSTS file usually gets changed with this so id recommend resetting it

Download HostsXpert (US MIRROR)
http://www.softpedia.com/progDownload/Hoster-Download-27041.html
and then follow the below steps.

* Unzip HostsXpert.zip
* It will create a folder named HostsXpert in whatever folder you extract it to.
* Run HostsXpert.exe by Pressing the SHIFT key, RIGHT CLICKING and selecting to 'RUN AS' (admin)
* click the Make Writeable? button.
* click Restore Microsoft's Hosts File and then click OK.
* Click the X to exit the program

I can't see a Make Writeable button in HostsXpert. Under file handling it says 'make readonly', 'Backup/restore' and 'Restore MS host files'. Should I just go straight for 'Restore MS host files'? Sorry not the most experienced computer person

aliEnRIK

Yes, restore the hosts file (i think the options change depending on operating systems etc)

becky170

aliEnRIK wrote: »

Yes, restore the hosts file (i think the options change depending on operating systems etc)

Ok I've done that. I'll run the long scan overnight and let you know how I get on tomorrow. Thanks for all your help, I really appreciate you giving up all your time to help us all! I'll reinstall some Anti-Virus software now as well

aliEnRIK

Id recommend AVAST or AVIRA free (from filehippo)