Spyware.Possible_Website_Hijack

Discussion in 'Malware Help (A Specialist Will Reply)' started by stuhaz, Feb 17, 2009.

  1. stuhaz

    stuhaz Private E-2

    I could do with some advice here. Spyware Doctor detected 109 infections - all under "Spyware.Possible_Website_Hijack" - only on full scan, but it cannot remove the items.

    Spybot S&D and McAfee do not identify "Spyware.Possible_Website_Hijack".
    I have read READ & RUN ME FIRST. Malware Removal Guide and have used CCleaner to remove the "crap" from all users (using Vista) and defragged the C drive using IObit Smart Defrag.

    I followed the directions on Vista Cleaning procedure - and downloaded SUPERAntiSpyware, Malwarebytes Anti-malware (renamed mb.exe), and Combofix.exe (this one to my Desktop - the previous two to my Download folder) and MGTools.exe (to my C: drive). None of these were opened.

    I then re-ran Spyware.Doctor & McAfee - mainly to re-check the problem was still reported (these scans take a few hours and were done overnight).
    Spyware.Doctor still reports 109 infections but the McAfee has quarantined Generic!Atemis (Trojan) (2 files) and Combofix.exe was now unaccessible in my download folder and is missing off my Desktop:mad.

    I deleted Combofix from my Downloads (intending to re-download) and now Firefox will not open the Combofix.exe link (File Not Found - Firefox can't find the file at http://download.bleepingcomputer.com/sUBs/ComboFix.exe.)
    It seems I've been a bit stupid!

    My intention was to post a thread with the relevant attachments but now cannot use Combofix.

    My computer seems to run okay - occasionally it will hang when I try to logon with my user password. Usually works okay after I switched off the mains power and re-booted.

    Do I have a problem with these 109 infections that need cleaning?
    How should I proceed?

    Thanks for any advice & sorry for the trouble.

    Stuart
     
    stuhaz, Feb 17, 2009
    #1
  2. stuhaz

    stuhaz Private E-2

    I know I shouldn't reply to my own post but I've just happened across a website that indicates that Spyware Doctor tends to detect "Possible Website Hijack" in the HOSTS file (which mine does) and that this is a false detection.

    http://www.mvps.org/winhelp2002/hostsfaq.htm

    They indicate that:

    "There is no known infection that only affects the HOSTS file."

    If someone could confirm that for me (that there is no "infectuion") I'd be pleased to close this thread!

    Stuart
     
    stuhaz, Feb 17, 2009
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If Spyware Doctor is a trial version, uninstall it.

    Then attach the requested logs so we can see what is happening in your system.
     
    TimW, Feb 18, 2009
    #3
  4. stuhaz

    stuhaz Private E-2

    problems getting logs (esp Combofix):

    SUPERAntiSpyware runs and indicates nothing found, but, 1st time, no log is created; 2nd time I ran it again indicated no problems; log created but not able to open or view. As both these scans ran overnight, I moved onto SpyBot.
    SpyBot indicated no problems.
    Malwarebytes Anti-Malware ran okay, indicated no infections, and log created okay.

    Combofix is problematic - I note that your instructions indicate that McAfee can interfer with it. Upon running Combofix (after disabling Virus and Firewall protection) I get no Autoscan window; instead the screen has gone into "sleep" or "power save" mode; it has been like that for 6 hours now! Is this normal? Should I interrupt, and, if so, how?
    Thanks for advice.

    Stuart
     
    stuhaz, Feb 19, 2009
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Reboot......and get me the log from running C:\MGTools.exe --> C:\MGLogs.zip.
     
    TimW, Feb 19, 2009
    #5
  6. stuhaz

    stuhaz Private E-2

    similar problem here again - MGtools cannot make MGlogs.zip - it seems not to have permissions; I have disabled McAfee antivirus & firewall and disabled the User Account Control.

    I get an error message regards HiJackThis

    "For some reason your system denied write access to the Hosts file. If any hijacked domains are in this file, Hijack This may NOT be able to fix this.

    If that happens you need to edit the file yourself. To do this click Start, Run and type:

    notepad C:\Windows\System32\drivers\etc\hosts

    and press Enter. Find the line(s) HijackThis reports and delete them. Save the file as 'hosts.' (with quotes) and reboot.

    For Vista: simply, exit HijackThis, right click on the HijackThis icon, choose Run as Administrator"

    I run Vista but have not downloaded HijackThis, and have no icon to click.

    Any suggestions?

    Stuart
     
    stuhaz, Feb 19, 2009
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Did you follow the instructions to disable the UAC in vista? Is it still disable after the reboot? Can you run the other scans ...I would still like to see those logs.
     
    TimW, Feb 19, 2009
    #7
  8. stuhaz

    stuhaz Private E-2

    I have re-run SUPERAntiSpyware.exe (no problems found), SpyBot (no problems found) and MGTools.

    I didn't bother with Combofix again as I had so much trouble last time.

    Logs appended.

    Computer running fine.

    Stuart
     

    Attached Files:

    stuhaz, Feb 22, 2009
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know......If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, Feb 22, 2009
    #9
  10. stuhaz

    stuhaz Private E-2

    I now find that Combofix is not on my Desktop (although I thought I "dragged it there" from my download folder) - probably explains why I had problems running it (assuming McAfee hasn't interfered with it).

    I can only find "Combofix-Download.exe" in my C:\Combofix folder, along with loads of other files and stuff.

    I have reenabled UAC & tried to uninstall HijackThis (but it seems to already have been uninstalled) & removed MGTools.

    I haven't looked at the System restore yet.

    How might I best remove Combofix?

    Thanks.

    Stuart
     
    stuhaz, Feb 22, 2009
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that were created.
     
    TimW, Feb 22, 2009
    #11
  12. stuhaz

    stuhaz Private E-2

    All sorted.

    Many thanks for all your help.


    Stuart
     
    stuhaz, Feb 23, 2009
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome.....safe surfing. :)
     
    TimW, Feb 23, 2009
    #13

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds