need help please

always_comping

this is what popped up after drweb ran- Windows operating systems use the HOSTS file to map text hostnames to IP addresses. Modifications to the HOSTS file indicate possible operation of malicious software. Do you want to restore the default HOSTS file? what do i do please?

RussJK

Press yes

always_comping

WOW! This seems to have sorted it can now see the captchas, thanks sooooo much, am i good to go now?

RussJK

Glad it's helped. Still a bit more to do, you'll want to know why your settings were altered.

1. Could you post the log from Dr Web please?

• Press the WINDOWS KEY and R to open the Run dialog. Copy paste %USERPROFILE%\DoctorWeb\CureIt.log into it and press enter, and hopefully the log will come up in notepad.
• Copy paste that into http://pastebin.com as it'll be quite long, and then give me the URL/Link if you will.

2. Then run Hijackthis that you downloaded, and do SYSTEM SCAN and SAVE LOG, and post the log that comes up in notepad. Don't fix anything.

Will eventually recommend Combofix.

always_comping

i cant get it to copy and paster for some reason, shall i do it bit by bit on here? its mahoosive?

RussJK

Email it to me instead if you like, I'll PM you my addy.

Edit: Thanks, got it. Doesn't look like it found anything other than alter the HOSTS file. Not sure where it moves it by default, so I'll see if I can find out.

Skip the Malwarebytes scan in that case, as it won't do anything different.

Do the Hijackthis log if you will instead

RussJK

Okay, it was easier than I though haha, the 'hosts' file will be stored here, so if you don't mind emailing that file as well:
%USERPROFILE%\DoctorWeb\Quarantine

always_comping

ok downloaded highjack ran scan but popped up with- for some reason your system denied write access to the host files and told me to type it into start myself to open up a file bu that wont either?

always_comping

RussJK wrote: »

Okay, it was easier than I though haha, the 'hosts' file will be stored here, so if you don't mind emailing that file as well:
%USERPROFILE%\DoctorWeb\Quarantine

sorry how do i find that? tried typing that into start but it found nothing

RussJK

It just needs to run with elevated rights. Try it this way instead. Save Hijackthis to the desktop:
http://www.trendmicro.com/ftp/products/hijackthis/beta/HijackThis.exe

Then hold LEFT SHIFT and RIGHT CLICK on the downloaded file, and select Run As Administrator. If you are using XP, then select Run As (Current User) and untick the 'protect me' bit.

Try going to:
%USERPROFILE%\DoctorWeb\ then seeing if you can see a quarantine folder. Also you may need to see hidden files
http://www.bleepingcomputer.com/tutorials/tutorial130.html