Facebook & Ebay Acc Blocked Message

debitcardmayhem

Hi Emma , we will need a bit of help from someone with more nouse than us , there are some bits on there I am not happy about not least

C:\Users\Emma\AppData\Roaming\Unbi\ylumv.exe
O15 - Trusted Zone: [URL]http://*.alipay.com[/URL]
O15 - Trusted Zone: [URL]http://*.alisoft.com[/URL]
O15 - Trusted Zone: [URL]http://*.taobao.com[/URL]
O4 - HKCU\..\Run: [Ufasv] C:\Users\Emma\AppData\Roaming\Unbi\ylumv.exe
O4 - HKUS\S-1-5-21-1779938381-1741342189-972649262-1001\..\Run: [Ufasv] C:\Users\Emma\AppData\Roaming\Unbi\ylumv.exe (User '?')

Let's have a wait see . OH and did you reboot after Malwarebytes ?? I am not suggesting that we do that now though

emmamed

yes i did reboot after malware as i was prompted to should i get rid of the ones u have said about

emmamed

i got rid of the ones u said and so far i havent had any problems, hoping it dont rear its ugly head again.

paddyrg

Be aware, a single AV product cannot catch everything, and that HJT log looked too long for my liking...as I said about trusting it...

Can you now run Trend Housecall, see if that comes up with anything different?

I would also suggest checking your hosts file (maybe someone can direct you to it, I just have a phone today) as it looks like it may have got a load of spurious redirects in there

emmamed

i have just done the trend housecall and nothing was found

paddyrg

I will cause a bit of a ruckus here by the following advice, so take it as you find it and see if it is right for you. Flatten and rebuild. Get the Windows installations disks, backup your important files, format the hard drive and reinstall Windows from scratch, then turn on the firewall and connect online to install a fresh AV and all your service packs, then reinstall your essential software and leave off all the old crud that had accumulated. That HJT log to me spoke of helper apps and toolbar thingies, sidebars, BHO's, etc - with a fresh, naked build you may find the machine a lot faster when it isn't dedicating clock cycles to rubbish. And, as I say, the trust is gone, there could easily be bits of malware hidden away and undetected.

There are usually some here who shout it down as heresy, but it is what I have been grateful that I have done in the past, your mileage may vary.

Also, first, a quick search online for "hosts file" will help you find where it is on your computer - open it in Notepad (don't change anything yet) and paste the contents here, I'll bet Malwarebytes cleared the malware, but wasn't able to restore your system to its 'before' state, it may be that deleting a few lines in there can clear up the symptom.

debitcardmayhem

Hosts file is C:\Windows\System32\drivers\etc\HOSTS

debitcardmayhem

It may be useful to use MVPS Hosts see here http://winhelp2002.mvps.org/hosts.htm