We're aware that some users are experiencing technical issues which the team are working to resolve. See the Community Noticeboard for more info. Thank you for your patience.
📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

Oh help - redirect virus, and totally clueless user...

Options
MoneySavingSapphire_:D
MoneySavingSapphire_:D Posts: 120 Forumite
in Techie Stuff
I recently switched to BT, and in doing so had to temporarily uninstall my McAfee to get the broadband working, and in the short time I was unprotected the redirection virus seems to have snuck into my computer - affecting all browsers :(

I have googled it (from my phone - literally every search result is redirected) and I'm totally baffled, even by the threads on here, so I'm sorry for repeating a question already asked :embarasse

I've uninstalled FF and Chrome, checked my IE add-ons and run a Kaspersky scan which found and deleted 6 threats, but I'm still suffering after rebooting. Can anyone help suggest the steps I should take?? I've also just run a HijackThis scan but obviously I have no idea what I'm looking at there either...!

Oh, also - before I realised I was virus-ed I have accessed emails, FB and my internet banking this morning - is there a chance the virus could get my details from them?? _pale_
Returning MoneySaver, now furiously saving for a house deposit...
«13

Comments

  • bengalknights
    bengalknights Posts: 5,021 Forumite
    Part of the Furniture 1,000 Posts
    If you have backups and full clean install would be my suggestion
  • imho
    imho Posts: 2,515 Forumite
    Part of the Furniture 1,000 Posts Name Dropper Combo Breaker
    id you read this.
    http://deletemalware.blogspot.co.uk/2010/02/remove-google-redirect-virus.html
    Seems helpful as it tells you in pictures what to do.
  • Guardsman
    Guardsman Posts: 991 Forumite
    Reboot in Safe Mode.

    How to Fix a Computer in Safe Mode

    Read more: How to Fix a Computer in Safe Mode | eHow.com http://www.ehow.com/how_5188412_fix-computer-safe-mode.html#ixzz25DNTUh6u

    When you are in safe mode then run your AV and do a full system scan not a quick scan..

    At the same time open your browser and remove addons

    To permanently disable add-ons in Internet Explorer 8
    1. Open Internet Explorer by clicking the Start button 4f6cbd09-148c-4dd8-b1f2-48f232a2fd33_47.png, and then clicking Internet Explorer.
    2. Click the Tools button, and then click Manage Add-ons.
    3. Under Show, click All add-ons.
    4. Click the add-on you want to disable, and then click Disable.
    5. Repeat step 4 for every add-on you want to disable. When you are finished, click Close.
    How to use MSCONFIG in Windows
    This will stop unnecessary programs from starting up with windows.
    http://netsquirrel.com/msconfig/msconfig_xp.html

    If you have computer problems it does help if you give a bit more information about your computer ie what version of windows make of computer etc
      I think the surest sign that intelligent life exists elsewhere in the universe is that none of it has tried to contact us.
    1. Figment
      Figment Posts: 2,643 Forumite
      Part of the Furniture Combo Breaker
      In Waddler's absence....

      Download DDS from the link below and save it to your desktop:

      Link

      After you've downloaded it and saved it to your desktop:
      • Double click DDS to run it.
      • When it's finished, DDS will open two logs:
      1. DDS.txt
      2. Attach.txt
      Save both reports to your desktop.

      Copy & paste the contents of just DDS.txt for now and post it here (you may need to split the log over separate posts)
      How do I add a signature?
    2. MoneySavingSapphire_:D
      MoneySavingSapphire_:D Posts: 120 Forumite
      Thank you all for the links and help - have just saved a few AV's onto a memory stick so will open in safemode now and try that. Hope I haven't now put viruses on my USB...

      Guardsman - oh yes that might have helped, proving my lack of techie-ness there...! I'm on a Dell PC, Windows 7

      ETA - Figment, just seen your post - thanks! Am running it now...
      Returning MoneySaver, now furiously saving for a house deposit...
    3. MoneySavingSapphire_:D
      MoneySavingSapphire_:D Posts: 120 Forumite
      Okay, my scary looking DDS is as follows...

      .
      DDS (Ver_2011-08-26.01) - NTFSAMD64
      Internet Explorer: 9.0.8112.16421
      Run by Siobhan at 12:35:50 on 2012-09-01
      Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4079.2083 [GMT 1:00]
      .
      SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
      .
      ============== Running Processes ===============
      .
      C:\Windows\system32\wininit.exe
      C:\Windows\system32\lsm.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch
      C:\Windows\system32\svchost.exe -k RPCSS
      C:\Windows\system32\atiesrxx.exe
      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
      C:\Windows\system32\svchost.exe -k netsvcs
      C:\Windows\system32\svchost.exe -k LocalService
      C:\Windows\system32\atieclxx.exe
      C:\Windows\system32\svchost.exe -k NetworkService
      C:\Windows\system32\WLANExt.exe
      C:\Windows\system32\conhost.exe
      C:\Windows\System32\spoolsv.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
      C:\Windows\system32\taskeng.exe
      C:\Windows\system32\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe
      C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
      C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
      C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
      C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
      C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
      C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
      C:\Windows\system32\mfevtps.exe
      C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
      C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe
      C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
      C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
      C:\Windows\system32\svchost.exe -k imgsvc
      C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
      C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe
      C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
      C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
      C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
      C:\Windows\system32\taskhost.exe
      C:\Windows\system32\Dwm.exe
      C:\Windows\Explorer.EXE
      C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
      C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
      C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
      C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
      C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe
      C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
      C:\Windows\System32\spool\drivers\x64\3\E_IATIHJE.EXE
      C:\Program Files (x86)\Consumer Input\dca-ua.exe
      C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
      C:\Program Files (x86)\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
      C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
      C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe
      C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
      C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
      C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
      C:\Program Files (x86)\Common Files\Motive\McciContextHookShim.exe
      C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
      C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
      C:\Program Files (x86)\iTunes\iTunesHelper.exe
      C:\Program Files\McAfee.com\Agent\mcagent.exe
      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
      C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
      C:\Windows\system32\conhost.exe
      C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Windows\system32\SearchIndexer.exe
      C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
      C:\Program Files (x86)\Roxio\OEM\Roxio Burn\Roxio Burn.exe
      C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
      C:\Program Files (x86)\Internet Explorer\iexplore.exe
      C:\Program Files (x86)\Internet Explorer\iexplore.exe
      C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
      C:\Program Files (x86)\Nero\Update\NASvc.exe
      C:\Program Files\Windows Media Player\wmpnetwk.exe
      C:\Windows\System32\svchost.exe -k LocalServicePeerNet
      C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10v_ActiveX.exe
      C:\Windows\system32\DllHost.exe
      C:\Windows\system32\wuauclt.exe
      C:\Windows\system32\svchost.exe -k SDRSVC
      C:\Program Files (x86)\Internet Explorer\iexplore.exe
      C:\Program Files (x86)\Internet Explorer\iexplore.exe
      C:\Program Files (x86)\Nero\SyncUP\SyncUP.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      C:\Program Files (x86)\Nero\SyncUP\Nero.AndroidServer.exe
      C:\Windows\system32\taskhost.exe
      C:\Users\Siobhan\Desktop\HijackThis.exe
      C:\Windows\system32\notepad.exe
      C:\Program Files (x86)\Internet Explorer\iexplore.exe
      C:\Windows\system32\prevhost.exe
      C:\Program Files\Windows Media Player\wmprph.exe
      C:\Program Files\McAfee\VirusScan\mcods.exe
      C:\Program Files\Common Files\McAfee\Core\mchost.exe
      C:\Windows\system32\SearchProtocolHost.exe
      C:\Windows\system32\SearchFilterHost.exe
      C:\Windows\system32\SearchProtocolHost.exe
      C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\conhost.exe
      C:\Windows\SysWOW64\cscript.exe
      .
      ============== Pseudo HJT Report ===============
      .
      uStart Page = hxxp://www.google.co.uk/
      mWinlogon: Userinit=userinit.exe
      BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
      BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
      BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
      BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120901093157.dll
      BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
      BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
      BHO: DCA BHO: {b49699fc-1665-4414-a1cb-c4a2a4a13eec} - C:\Program Files (x86)\Consumer Input\dca-bho.dll
      BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
      TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
      uRun: [Consumer Input Update] C:\Program Files (x86)\Consumer Input\dca-ua.exe
      mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
      mRun: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
      mRun: [<NO NAME>]
      mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
      mRun: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
      mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
      StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BELKIN~1.LNK - C:\Program Files (x86)\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
      StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NETGEA~1.LNK - C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
      mPolicies-explorer: NoActiveDesktop = 1 (0x1)
      mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
      mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
      mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
      mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
      IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
      IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
      IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
      IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
      IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
      IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
      DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
      DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
      DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
      DPF: {EBB176D2-AF75-4706-832F-4C8448F72757} - hxxp://www.shopandscan.com/TNSClickrc.CAB
      TCP: DhcpNameServer = 192.168.1.254
      TCP: Interfaces\{5E85E07E-2CEF-495C-A786-F6FD6F496C06} : DhcpNameServer = 192.168.1.254
      TCP: Interfaces\{5E85E07E-2CEF-495C-A786-F6FD6F496C06}\244564F4E4 : DhcpNameServer = 192.168.22.22 192.168.22.23
      TCP: Interfaces\{5E85E07E-2CEF-495C-A786-F6FD6F496C06}\2445F40756E6A7F6E656D284 : DhcpNameServer = 192.168.22.22 192.168.22.23
      TCP: Interfaces\{97826F09-197D-486A-98F3-F1D3831B1CDF} : DhcpNameServer = 192.168.1.254
      Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dll
      Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
      Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
      Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
      Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
      Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
      BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
      BHO-X64: 0x1 - No File
      BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
      BHO-X64: AcroIEHelperStub - No File
      BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
      BHO-X64: McAfee Phishing Filter - No File
      BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120901093157.dll
      BHO-X64: scriptproxy - No File
      BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
      BHO-X64: SkypeIEPluginBHO - No File
      BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
      BHO-X64: DCA BHO: {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files (x86)\Consumer Input\dca-bho.dll
      BHO-X64: DCA - No File
      BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
      TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
      mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
      mRun-x64: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
      mRun-x64: [(Default)]
      mRun-x64: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
      mRun-x64: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
      mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
      .
      ============= SERVICES / DRIVERS ===============
      .
      R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
      R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
      R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
      R0 SCMNdisP;General NDIS Protocol Driver;C:\Windows\system32\DRIVERS\scmndisp.sys --> C:\Windows\system32\DRIVERS\scmndisp.sys [?]
      R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
      R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
      R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-5-14 759048]
      R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
      R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
      R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
      R2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [2011-12-27 166400]
      R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2011-12-27 128512]
      R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-9-1 249936]
      R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-9-1 249936]
      R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-9-1 249936]
      R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-9-1 249936]
      R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2012-9-1 199304]
      R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [2012-9-1 210616]
      R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
      R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
      R2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-25 2823000]
      R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
      R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-10-26 1692480]
      R2 WSWNA3100;WSWNA3100;C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [2011-11-1 285152]
      R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
      R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
      R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
      R3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwlhigh664.sys --> C:\Windows\system32\DRIVERS\bcmwlhigh664.sys [?]
      R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
      R3 MEIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
      R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
      R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
      R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
      R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]
      R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]
      R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]
      R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]
      R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]
      S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
      S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
      S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-27 116648]
      S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
      S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-19 253088]
      S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
      S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-27 116648]
      S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
      S3 optousb;OPTO ELECTRONICS optousb;C:\Windows\system32\DRIVERS\optousb.sys --> C:\Windows\system32\DRIVERS\optousb.sys [?]
      S3 optovcm;OPTO ELECTRONICS optovcm;C:\Windows\system32\DRIVERS\optovcm.sys --> C:\Windows\system32\DRIVERS\optovcm.sys [?]
      S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
      S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2011-3-18 25072]
      S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
      S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
      S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
      S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
      S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
      S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
      .
      =============== Created Last 30 ================
      .
      2012-09-01 11:15:50
      d
      w- C:\Windows\pss
      2012-09-01 09:50:54
      d
      w- C:\TDSSKiller_Quarantine
      2012-09-01 09:41:48
      d
      w- C:\ProgramData\SUPERSetup
      2012-09-01 08:32:06
      d
      w- C:\Program Files (x86)\McAfee.com
      2012-09-01 08:31:57 29312 ----a-w- C:\Program Files (x86)\Mozilla Firefox\ScriptFF.dll
      2012-09-01 08:31:57 10248 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys
      2012-09-01 08:31:55 75936 ----a-w- C:\Windows\System32\drivers\mfenlfk.sys
      2012-09-01 08:31:55 65264 ----a-w- C:\Windows\System32\drivers\cfwids.sys
      2012-09-01 08:31:55 487296 ----a-w- C:\Windows\System32\drivers\mfefirek.sys
      2012-09-01 08:31:55 229528 ----a-w- C:\Windows\System32\drivers\mfeavfk.sys
      2012-09-01 08:31:55 100912 ----a-w- C:\Windows\System32\drivers\mferkdet.sys
      2012-09-01 08:31:49
      d
      w- C:\Program Files\McAfee.com
      2012-09-01 08:31:49
      d
      w- C:\Program Files\McAfee
      2012-09-01 08:31:49
      d
      w- C:\Program Files\Common Files\McAfee
      2012-09-01 08:31:47
      d
      w- C:\Program Files (x86)\McAfee
      2012-09-01 08:23:02 177144 ----a-w- C:\Windows\System32\mfevtps.exe
      2012-08-31 19:15:44 151552 --sha-r- C:\Windows\SysWow64\caclsf.dll
      2012-08-31 06:08:07 9310152 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{70C26E99-ECD2-4338-9570-B44010E0D1B3}\mpengine.dll
      2012-08-30 06:04:56 9310152 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
      2012-08-28 18:50:56
      d
      w- C:\Program Files\BT Broadband Desktop Help
      2012-08-28 18:48:39
      d
      w- C:\Program Files (x86)\Common Files\Motive
      2012-08-28 18:48:36
      d
      w- C:\Program Files\Common Files\Motive
      2012-08-28 18:48:25
      d
      w- C:\Program Files (x86)\BT Broadband Desktop Help
      2012-08-28 18:47:13
      d
      w- C:\Program Files (x86)\Citrix
      2012-08-28 18:45:41
      d
      w- C:\Program Files (x86)\Yahoo!
      2012-08-28 18:45:02
      d
      w- C:\Program Files (x86)\BTHomeHub
      2012-08-16 06:19:00 503808 ----a-w- C:\Windows\System32\srcore.dll
      2012-08-16 06:19:00 43008 ----a-w- C:\Windows\SysWow64\srclient.dll
      2012-08-16 06:18:27 751104 ----a-w- C:\Windows\System32\win32spl.dll
      2012-08-16 06:18:26 67072 ----a-w- C:\Windows\splwow64.exe
      2012-08-16 06:18:26 559104 ----a-w- C:\Windows\System32\spoolsv.exe
      2012-08-16 06:18:26 492032 ----a-w- C:\Windows\SysWow64\win32spl.dll
      2012-08-16 06:13:13 59392 ----a-w- C:\Windows\System32\browcli.dll
      2012-08-16 06:13:13 41984 ----a-w- C:\Windows\SysWow64\browcli.dll
      2012-08-16 06:13:13 136704 ----a-w- C:\Windows\System32\browser.dll
      2012-08-16 06:08:05 3148800 ----a-w- C:\Windows\System32\win32k.sys
      2012-08-16 06:07:58 956928 ----a-w- C:\Windows\System32\localspl.dll
      .
      ==================== Find3M ====================
      .
      2012-06-29 03:56:34 2312704 ----a-w- C:\Windows\System32\jscript9.dll
      2012-06-29 03:49:11 1392128 ----a-w- C:\Windows\System32\wininet.dll
      2012-06-29 03:48:07 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
      2012-06-29 03:43:49 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
      2012-06-29 03:39:48 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
      2012-06-29 00:16:58 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
      2012-06-29 00:09:01 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
      2012-06-29 00:08:59 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
      2012-06-29 00:04:43 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
      2012-06-29 00:00:45 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
      2012-06-22 06:38:16 335784 ----a-w- C:\Windows\System32\drivers\mfewfpk.sys
      2012-06-22 06:36:12 752672 ----a-w- C:\Windows\System32\drivers\mfehidk.sys
      2012-06-22 06:34:00 169320 ----a-w- C:\Windows\System32\drivers\mfeapfk.sys
      2012-06-06 19:59:42 1070152 ----a-w- C:\Windows\SysWow64\MSCOMCTL.OCX
      2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll
      2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll
      2012-06-06 06:02:54 1133568 ----a-w- C:\Windows\System32\cdosys.dll
      2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll
      2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll
      2012-06-06 05:03:06 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll
      .
      ============= FINISH: 12:37:12.56 ===============
      Returning MoneySaver, now furiously saving for a house deposit...
    4. Guardsman
      Guardsman Posts: 991 Forumite
      For now uninstall Java.
      I think the surest sign that intelligent life exists elsewhere in the universe is that none of it has tried to contact us.
    5. Figment
      Figment Posts: 2,643 Forumite
      Part of the Furniture Combo Breaker
      Thanks. First off, you currently do not have Anti Virus protection installed and working. We'll deal with that presently.

      Hold down the Windows Key, and press E to open Windows Explorer. Click on Organize (top left) > Folder and Search options > View [Tab]. 6th item down is Hidden files and folders, which has two radio buttons below. Click the second button ("Show hidden files, folders and drives") followed by Apply then OK

      Now navigate to the following folder:

      C:\Windows\System32\Drivers\etc

      You should see a file with the name Hosts. Right click on this file and click Open. In the Open With box, find and click once on Notepad. Make sure there is no tick in the 'Always use the selected......' box then click on OK. Copy and paste the contents into a reply, then close the file.
      How do I add a signature?
    6. MoneySavingSapphire_:D
      MoneySavingSapphire_:D Posts: 120 Forumite
      Sorry went to do a food shop - okay,

      # Copyright (c) 1993-2009 Microsoft Corp.
      #
      # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
      #
      # This file contains the mappings of IP addresses to host names. Each
      # entry should be kept on an individual line. The IP address should
      # be placed in the first column followed by the corresponding host name.
      # The IP address and the host name should be separated by at least one
      # space.
      #
      # Additionally, comments (such as these) may be inserted on individual
      # lines or following the machine name denoted by a '#' symbol.
      #
      # For example:
      #
      # 102.54.94.97 rhino.acme.com # source server
      # 38.25.63.10 x.acme.com # x client host
      # localhost name resolution is handled within DNS itself.
      # 127.0.0.1 localhost


      Earlier, there was another one under the last bit that said # 1: or something, but I deleted that as per instructions from something I'd googled...

      (Also, I ran a McAfee scan in safemode while I went to the supermarket, and it found nothing, as did Kapersky)
      Returning MoneySaver, now furiously saving for a house deposit...
    7. Figment
      Figment Posts: 2,643 Forumite
      Part of the Furniture Combo Breaker
      Lines in the hosts file that begin with # are just comments and are of no concern.

      Lines without # are mappings. Some are safe, others may be malicious.

      If the line you removed was:

      # ::1 localhost

      it is harmless and safe to replace if you wish.
      How do I add a signature?
    This discussion has been closed.
    ★ ★ ★ Meet your Ambassadors

    🚀 Getting Started

    Hi new member!

    Our Getting Started Guide will help you get the most out of the Forum

    Categories

    • All Categories
    • 350.8K Banking & Borrowing
    • 253.1K Reduce Debt & Boost Income
    • 453.5K Spending & Discounts
    • 243.8K Work, Benefits & Business
    • 598.7K Mortgages, Homes & Bills
    • 176.8K Life & Family
    • 257.1K Travel & Transport
    • 1.5M Hobbies & Leisure
    • 16.1K Discuss & Feedback
    • 37.6K Read-Only Boards

    Is this how you want to be seen?

    We see you are using a default avatar. It takes only a few seconds to pick a picture.
    Update Your Picture