Maybe infected [Solved]

Hi marcopcnn, Do you have this problem with any other website? Is this problem limited to a particular browser? (i.e. Internet Explorer, Firefox, Chrome) Try to access different websites, trying to repeat the problem. Also try visiting www.tim.it with each of the above listed browsers. Post the results to the above steps

Tim.it is the only site that show the problem. I have tried to reach it with Mozilla and I,E. and both have the problem Marco

Hi marcopcnn,

Run OTL.exe
Windows Vista and Windows 7 users Right Click and select "Run as Administrator"

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts] 
  [createrestorepoint]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

In your next post please provide the following:

• OTL.txt
• Check and see if www.tim.it is reachable

Hi marcopcnn,

Run OTL.exe
Windows Vista and Windows 7 users Right Click and select "Run as Administrator"

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts] 
  [createrestorepoint]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

In your next post please provide the following:

• OTL.txt
• Check and see if www.tim.it is reachable

Here attached the results of OTL scan
I have tried to reach www.tim.it with good results.
I reach the site at the first attempt

All processes killed
========== FILES ==========
< ipconfig /flushdns /c >
Configurazione IP di Windows
Cache del resolver DNS svuotata.
C:\Users\marco\Desktop\cmd.bat deleted successfully.
C:\Users\marco\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 75 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: marco
->Temp folder emptied: 3382725834 bytes
->Temporary Internet Files folder emptied: 128430566 bytes
->Java cache emptied: 37110813 bytes
->FireFox cache emptied: 198689126 bytes
->Flash cache emptied: 218282 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1028096760 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 4.554,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 11192012_221605

Files\Folders moved on Reboot…
C:\Users\marco\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\marco\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
File\Folder C:\Windows\temp\mcafee_fpfYqWvV2mTy19f not found!

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Hi marcopcnn,

I have tried to reach www.tim.it with good results.
I reach the site at the first attempt

Glad to hear we have resolved that issue.

We reset your Hosts File back to it's default. You will need to reinstall the Hosts File.

Install a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002

Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

Any remaining issues?

Hi marcopcnn, Just checking in to see if you still need help?

Hi marcopcnn,

Just checking in to see if you still need help?

All seems working properly.
Only two concerns/problems
1) To run a sw provided by Italian Government i need to install Java Virtual Machine 1.6
We have removed during the cleaning of the PC and Know when I try to reinstall the installation fails
How can I solve the problem ?
2) When I start my PC the startup of windows 7 is fast as usual but for several minutes the internet navigation si very slow then return quick as usual
Should be due to some security setting ? (i.e. Spyboot settings)
Thanks
Marco

Hi marcopcnn,

1) To run a sw provided by Italian Government i need to install Java Virtual Machine 1.6
We have removed during the cleaning of the PC and Know when I try to reinstall the installation fails
How can I solve the problem ?

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
• Scroll down and locate Java SE 6 Update 37 Click the JRE download button.
• Locate the correct version for your computer. (choose either one)
  
• Windows x86 Online - 0.87 MB - jre-6u37-windows-i586-iftw.exe
• Windows x86 Offline - 16.19 MB - jre-6u37-windows-i586.exe

Next

2) When I start my PC the startup of windows 7 is fast as usual but for several minutes the internet navigation si very slow then return quick as usual
Should be due to some security setting ? (i.e. Spyboot settings)

I included steps to restart Spybots' Tea Timer back in post #14. Is that what you're referring to? The condition is probably due to the number of programs that run in the background at start up.

The condition is probably due to the number of programs that run in the background at start up.

HI OCD,
Thanks for your indication, I have solved the problem with Java 1.6 and konw i am able to run the program i need.
Related to the backround program runnin during the startup how can i manage this programs ?
If i look to autorunning list i can find only pdp but lookin after startup i can identify many active programs.
I have tried to read windows help without any results

Hi marcopcnn,

Malwarebytes StartUpLite
StartUpLite is a lightweight and simple to use application that allows you to speed up your system startup, safely and efficiently. The program allows you to disable or remove unnecessary startup entries from your computer. By using StartUpLite, you can dramatically help shorten your startup time with only a few clicks of the mouse.

Just go to the link provided below and follow the directions for downloading and running the program.

• http://www.malwarebytes.org/products/startuplite/

Windows 7 users Right Click and select Run as Administrator.

Hi marcopcnn, Just checking in to see if you still need help?

Hi marcopcnn,

Just checking in to see if you still need help?

Hi OCD,
I really do not know !

I have used Startup lite but no significant improovement.
It is always very difficult to start internet navigation.
Usually it take from 2 to 10 minutes to reach the normal navigation speed
Recently I have realize that immediately after the connection to modem or router for minutes the system show "No internet connection".
I Have tried with different modem/router/provider but the results is always the same.
It is really strange. I have no experience of similar situation In the past

Hi marcopcnn,

The good news is there doesn't appear to be any malware on your system causing your problems.
With that in mind I'm going to refer you to our Tech Team in the Networking Forum

Give a brief description of the problem along with a link to this thread so the Tech Team helper can see what we have done already.
http://forums.whatthetech.com/index.php?showtopic=124826

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.