Is the Computer clean?

[Monika]

Hi,
I got problems with my computer some days ago (probably due to lack of virus protection for one day).

There was popping up strange advertising and I had problems starting the webbrowser (Internet Explorer).

I have followed the 8-step instruction. The normal Virus program (McAffee) did not find anything. The other programs found a lot.

I enclose the log-files. Is my computer clean?

/ Monika

 

[touch]

Hello Monika

It is not quite clean yet. Because it appears that your Hosts file has been hijacked.

Download HostsExpert: http://www.majorgeeks.com/Hoster_d4626.html

Choose one of the servers at Majorgeeks....save the file on your desktop

Unzip HostsXpert 4.2 - Hosts File Manager to a convenient folder such as C:\HostsXpert 4.2 - Hosts File Manager
Run HostsXpert 4.2 - Hosts File Manager from its new home
Click on "File Handling".
Click on "Restore MS Hosts File".
Click OK on the Confirmation box.
Click on "Make Read Only?"
Click the X to exit the program.

Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

Reboot.

Update Malwarebyte, run a comlpete scan. Attach new hijackthis log, Malwarebyte log, and tell how things are running

 

[Monika]

Thanks a lot!
I have followed your instructions regarding HostsXpert. I have then run Malwarebyte. It found one VundoTrojan, which I deleted when watching the results of Malwarebyte. I did a reboot and then run Hijackthis.

Logs are enclosed.

Regards
Monika

 

[touch]

My pleasure.

Did you set this? Or recognise this setting?
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=Mz7cevxSWa6UtJ4nRA-pS4Ue_XY

If not, check and fix that entry with hijackthis. If not sure, just leave it.

I don´t need more log files.
Please tell me how your computer is running?

 

[Monika]

Did you set this? Or recognise this setting?
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=Mz7cevxSWa6UtJ4nRA-pS4Ue_XY

I do not recognise this setting. In general neither me or any other in the households makes a lot of changes in settings to the system. So I checked it and let Hijackthis Fix it.

The computer is just running fine since I made the 8-step procedure. Obviously there were some things left to take care of even if everything seemed fine.Thanks again for your time.

/ Monika

 

[touch]

Sounds good, and I was glad to help

You should Create a New Restore Point to prevent possible reinfection from an old one.
The easiest and safest way to do this is:
Go to Start > All Programs > Accessories > System Tools > System Restore
Select Create a restore point, and Ok it.
Next, go to Start > Run and type in cleanmgr
Select the More options tab
Choose the option to clean up system restore and OK it.

This will remove all restore points except the new one you just created.

I also suggest you read Tony Klein´s article :
So how did I get infected in the first place?
http://www.spywareinfoforum.com/index.php?showtopic=60955