Infected with something, please see logs

[Deleted User]

spud17 wrote: »

Could it have come from a dodgy torrent?

Completely above board their gov!

I doubt it but then who I am to judge it seems!

[Deleted User]

aliEnRIK wrote: »

Download and run the FREE version of DR WEB
http://www.freedrweb.com/download+cureit/?nc=t&lng=en

Downloading now. I've ran Combofix in safe mode too however I'm still seeing the "Windows Security Alert" firewall popups and IE redirects... I suspect I'm not seeing any Adobe windows as I've uninstalled it for now!

Trinitrotoluene

Two things to check. Start > Run > ncpa.cpl and press enter

Right click your local network adaptor and go to properties. Select TCP/IP protocol (may be called IPV4) and click properties. Ensure that it has not put a static DNS entry in the bottom two options.

In internet explorer go to tools > internet options > connections > Lan settings - here we are looking to make sure there is no proxy address in there

aliEnRIK

Deleted_User wrote: »

Downloading now. I've ran Combofix in safe mode too however I'm still seeing the "Windows Security Alert" firewall popups and IE redirects... I suspect I'm not seeing any Adobe windows as I've uninstalled it for now!

Reset internet explorer

1. Open Internet Explorer.
2. Click Tools, and then click Internet Options.
3. Click the Advanced tab.
4. Under Reset Internet Explorer Settings, click Reset.

..........................................................

Download HostsXpert (US MIRROR)
http://www.softpedia.com/progDownload/Hoster-Download-27041.html
and then follow the below steps.

* Unzip HostsXpert.zip
* It will create a folder named HostsXpert in whatever folder you extract it to.
* Run HostsXpert.exe by double clicking on it.
* click the Make Writeable? button.
* click Restore Microsoft's Hosts File and then click OK.
* Click the X to exit the program

.............................................................

Please run combofix in NORMAL mode again and post the log

[Deleted User]

Trinitrotoluene wrote: »

Two things to check. Start > Run > ncpa.cpl and press enter

Right click your local network adaptor and go to properties. Select TCP/IP protocol (may be called IPV4) and click properties. Ensure that it has not put a static DNS entry in the bottom two options.

In internet explorer go to tools > internet options > connections > Lan settings - here we are looking to make sure there is no proxy address in there

DNS is fine, no proxies set.

aliEnRIK wrote: »

Reset internet explorer

1. Open Internet Explorer.
2. Click Tools, and then click Internet Options.
3. Click the Advanced tab.
4. Under Reset Internet Explorer Settings, click Reset.

..........................................................

Download HostsXpert (US MIRROR)
http://www.softpedia.com/progDownload/Hoster-Download-27041.html
and then follow the below steps.

* Unzip HostsXpert.zip
* It will create a folder named HostsXpert in whatever folder you extract it to.
* Run HostsXpert.exe by double clicking on it.
* click the Make Writeable? button.
* click Restore Microsoft's Hosts File and then click OK.
* Click the X to exit the program

.............................................................

Please run combofix in NORMAL mode again and post the log

Cheers for the advice and thanks to everyone really, although I've decided to reimage the machine and start a fresh. Weighing up how long I've already spent on this with not knowing if it's truely clean I've decided just to zip through a reimage.

aliEnRIK

Good call