SweetPacks

JohnG

Hi, just a warning to anyone who, like me, go to download Hitman Pro to scan your computer and fall foul of unwanted software going by the name of "SweetPacks" :mad:.
I have used Hitman Pro in the past with no problems but couldn't recall which site I took it from before. I did a search and pulled up what seemed a safe and legitimate site as far as I could tell http://download.cnet.com I now always try to avoid clicking on a wrong link/download button and went ahead. I noticed it was taking an unusually long time to install and in the end it became clear it had not only installed Hitman it had added something called SweetPacks which took hold of my browser and goodness knows what else? Initial uninstall didn't seem to get rid of it and clicking the uninstall link on their web page simply listed a dozen or more of their items which seemed to suggest they were all on my PC and would have to be removed one by one? :eek:
Anyway, after running various numerous anti malware and cleaning tools inc Malwarebytes, Adwcleaner etc I think Ive got rid of most of it - my fear is some traces are still hiding somewhere? How can I be sure it's gone?

Incidently, I seem to be having trouble with HijackThis, when I click to do a scan it comes up with a window that states:
For some reason your system denied write access to the Hosts file. If Hijack domains are in this file, Hijack this may not be able to fix this.
It then says I should go through Windows/System32/driver/etc/hosts
I've gone into this and can't see anything relating to Hijackthis?
I tried a repair, uninstalled and reinstalled but it's still doing the same. I can still do a scan and have cleaned one or two obvious bad files but it won't always let me remove a file?

I still have one or two ongoing problems with this PC i.e. unable to install window updates - that's one of the reasons I was trying Hitman Pro

WTFH

Eek!

Step 1... Uninstall Hitman Pro.
Step 2... Install Malwarebytes.

There won't be a reference to HijackThis in your hosts file.
What it is telling you is that if some nasty bit of software has written in bad things into your hosts file, HijackThis will not be able to fix it.

What anti-virus are you using?
What version of Windows?

debitcardmayhem

WTFH wrote: »

Eek!

Step 1... Uninstall Hitman Pro.
Step 2... Install Malwarebytes.

There won't be a reference to HijackThis in your hosts file.
What it is telling you is that if some nasty bit of software has written in bad things into your hosts file, HijackThis will not be able to fix it.

What anti-virus are you using?
What version of Windows?

Errm no its not, HJT needs to run as administrator to read the Hosts file to check for entries in the hosts file

WTFH

debitcardmayhem wrote: »

Errm no its not, HJT needs to run as administrator to read the Hosts file to check for entries in the hosts file

Errm, yes it is.
If you don't run HijackThis as administrator, then it can't check the hosts file. That's what I said.

What you said is also correct. If it's run as admin then it can check the hosts, but since the OP was looking in the hosts file for references to HijackThis, I thought it made more sense to explain what was going on.

GunJack

sweetpacks and the various search engines it installs may need to be removed manually from your browser - also check you haven't installed iLivid inadvertently, it's another gateway for nasties getting onto your system....

JohnG

Thanks to all, I did uninstall Hitman Pro earlier (then reinstalled it from Surfright site) before giving it a go - can't remember what it cleared - was feeling a bit harassed at the time .
Already have Malwarebytes (updated) which took out about 27 unwanted items out - so this I think has cleared most if not all.
However I still kept getting the SweetPack web browser coming up afterwards though this has since cleared, either by my efforts through the Internet Options or by Windows/Explorer resetting the default itself? A message did pop up this morning saying that it changed back to the previous 'Bing' following another program interfering with the default.

I have checked the browser and there isn't any reference to the SweetPack now so that's a relief. When it was there though, I couldn't actually delete it - only disable it - is that right?

Pleased to report I can't find any trace of ILivid by doing a search at least.

I'm afraid I don't understand this Host folder thing, all I can do or see is a choice of programs to use to open it and whichever one I choose, it simply gives a 'Sample' of the Host file?

closed

right click hijackthis, run as admin

the host file is just a txt file, which is probably empty apart from comments and a localhost entry, if so, nothing to worry about

kwikbreaks

Can't you just do a system restore to an earlier date? I've always found this to be the simplest first thing to try if crud has been accidentally installed.