godaddy.com comes up as porn sites

Welcome to Majorgeeks!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, renaming, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis​

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • CounterSpy
  • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat
  • HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

 

Run this WareOut Removal and attach the requested log when you come back.

Now uninstall the Sunbelt CounterSpy trial since we are finished with it now!

Now uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_04

Make sure you reboot after uninstalling the above!

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: (no name) -
- (no file)
O2 - BHO: (no name) - HC­
49E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - orer - (no file)
O2 - BHO: (no name) - rsion - (no file)
O2 - BHO: (no name) - xC­
B8AA8-DAF2-4892-BD1D-73F568BCB24E} - (no file)
O2 - BHO: (no name) - ¸E­
J - (no file)
O2 - BHO: (no name) - ÈC­
8255F-E043-4cae-8B3B-B191550C2A22} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasDtServ] gcasDtServ.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{08AB4B72-1A18-4069-88B2-DCE92BA99DE4}: NameServer = 85.255.115.22,85.255.112.156
O17 - HKLM\System\CCS\Services\Tcpip\..\{CEA2444A-E2DB-4EFF-B5F5-1718F7EE7404}: NameServer = 85.255.115.22,85.255.112.156
O17 - HKLM\System\CS1\Services\Tcpip\..\{08AB4B72-1A18-4069-88B2-DCE92BA99DE4}: NameServer = 85.255.115.22,85.255.112.156

After clicking Fix, exit HJT.
Now reboot your PC (in normal mode)


Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

No they don't. You need to get new logs before trying to attach them again. The message you received means you were trying to upload the same logs as previously uploaded. Run the .bat files again and attach NEW logs.

It looks like not all fixes worked based on your HJT log. Make sure you are following directions EXACTLY as written and exiting browsers before clicking Fix checked. Also only run exactly what we ask you to run (nothing else) and run it in the exact order give.

Is SUPERAntiSpyware a paid version or free version?
Are you saying you have a paid version of CounterSpy installed already?
You also have Ad-Aware's Ad-watch and ProtectX. You have tooooo many protection items installed and running. They will conflict and they could make it impossible to fix your problems.

 

Also you did not uninstall the old Sun Java versions and install the new one according to your HJT log.

And also one of those O17 lines is still there.

Shutdown ALL proctection software including McAfee and run the same fix again. Also add the below line to the previous fix:
O4 - HKLM\..\Run: [gcasServ] C:\Program Files\GIANT Company Software\GIANT AntiSpyware\gcasServ.exe

Then attach new logs from GetRunKey, ShowNew and HJT.

 

You're welcome!

No! It was not necessary.

You logs look much better now. However, you should uninstall the free trial of SuperAntiSpyware. And then you need to reconsider using both Ad-Aware's Ad-watch and CounterSpy. I don't recommend using both of these due to the impact on system resource and due to potential conflicts. If CounterSpy is only a trial as you stated, it will expire after 15 days and will be of no use to you unless you purchase it. It is a better program then Ad-Aware but it can be more resource hungry too.


Let's finish one more minor tweak. Another left over from GiantAntiSpyware to be removed.

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now if you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

No! But nothing is more important than your personal and financial security so it never hurts to check with your banks and credit card....etc companies to make sure no strange/illegal activities are occurring.

Your log is clean. I see you dumped Ad-Aware Ad-watch and kept CounterSpy. Don't forget you will need to buy it for it to be useful in the long run.

 

You're welcome. Surf safely!