5 replies to this topic

[anomaly]

Forgive my ignorance of most things technological. I was doing a Google search. Suddenly got "warning" from Windows Defender; told me to click on fix problem. Took me to a page to pay for doing so, although I know enough to know that Windows Defender is a free MS program. I ran F-Prot - got nothing. Ran MalwareByles - got 88 problems; ran Spybot S&D - got 750; ran Registry Mechanic and got a bunch more - clicked "repair." Everything seemed okay until I tried to use Google again--could not connect to Google; also could not use Yahoo search, or any other search engine. I have WinXP Home, and I usually use Firefox. I could not use a search engine from either FF or IE. After reading here how to do a HJT, I downloaded it. I tried to run a HJT, but got window that said something about Hosts files - unable to access. I saved the HJT log that it did run, but do not know where to post it here. Should I attach it to this post? I am not good at troubleshooting all this myself, so I need someone to read the HJT log and tell me what is wrong. Now I cannot find where the HJT log was saved. Sorry. Any help will be much appreciated. Thanks.

[jpshortstuff]

Hi,

Hold off on the HJT log for now, I would instead like to run two other diagnostic tools.

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done two logs should open:
  
• DDS.txt
• Attach.txt

• Save both reports to your desktop.

---------------------------------------------------

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

Please download RootRepeal to your desktop

• Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
• Click the Report tab at the bottom and then the Scan button.
• A box will pop up, check all the boxes and click OK.
• Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
• The scan will take a little while to run, so let it go unhindered.
• Once it is done, click the Save Report button, call it RepealScan and save the log to your desktop. Post that log here in your reply

[anomaly]

Thank you for these suggestions. I wanted to let you know that I joined another forum and after running many, many scans and tests, it appears that "something" is deeply imbedded in my hosts file and my computer will need to be reformatted.

[jpshortstuff]

Any chance you have a link to the other forum where you were receiving help? I've never before heard of a problem with a hosts file that requires a reformat.

[anomaly]

Hi. Actually, the other forum did not tell me I had to reformat. They told me if all other scans and fixes did not work, that I "might" have to reformat. Also, I have been working with a local computer tech who has come here to my home, and who had several kinds of analysis software. I have been communicating back and forth between my tech and the other forum, and reformatting seems to be the consensus because nothing else is able to unlock the hosts files, nor giving permissions for administrative rights. Here is a copy and paste from an email from my computer tech just a few minutes ago: Already deleted files found by Kaspersky scan from HJT backups When ComboFix was ran before, it had been renamed as instructed and returns to original name after scan It appears there is no more infection, just the damage done that needs to be repaired Will try one more scan with Reimage.com to repair Windows files If Reimage.com doesn’t fix issue, will format drive and restore from a backup image from August made with Acronis True Image and manually copy newer files and mail back after all protection is updated and copied files are scanned. Regardless of all that has been done in the past several days, I still welcome anything you might want to add that we have not already thought of and tried. I appreciate your interest!!

[jpshortstuff]

Do you have a Windows Installation Disk? If so, perhaps a Repair Install would be best to repair your system - that leavs all data untouched and just re-installs Windows to replace all the system files.

Regarding the hosts file, I may well have a way of replacing it/deleting it, but I'm afraid I can't do anything without seeing logs from the above tools.