My daughters' laptop got infected with several viruses after downloading Adobe Flash Player 13 ActiveX.
I have managed to get rid of almost all including Search protect, Reg Clean Pro; rqpbhevlkc64.exe, MyPC Backup, DMUninstaller, BlockAndSurf, FreeV_1.3, AnyProtect. Also Norton Security Scan was removed as we have Mcafee.
When using HitmanPro_x64 two results are found to repair proxy server infected/hijacked by 127.0.0.1.59818
After the next step these are removed form laptop.
These then used to reappear after going on the internet using Firefox (I don't think it happened with Googlechrome or IE)
This I think has stopped since restting Firefox settings.
They sometimes seem to reappear after restarting.
But always reappear when using adwcleaner which prompts a restart (although this program doesn't find these two items)
Adware finds two files in AppData one for Mozilla pref.js in Roaming and one for Google preferences in Local.
They also don't show up in MaleWareBytes.
I have also run TDSKiller and nothing found.
I have Mcafee Livesafe Internet Security and Windows7
I have also reset the Proxy settings using Microsoft fixit, with same results. (As It is a home computer it shouldn't have proxyserver)
I have deleted the following in HKEY_USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet settings.
ProxyOverride (showing Loopback) - HitmanPro leaves this as is.
ProxyServer (Showing http=127.0.0.1:59818;https=127.0.0.1:59818) - HitmanPro deletes this.
I have changed the following in HKEY_USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet settings
ProxyEnable 1 to 0 -HitmanPro does the same.
Hope someone is able to help, thanks.
Moved this to Malware Discussion > Home User Assistance as a better spot for it.
Out of the list of programs showing above you need to ditch Search Protect. RegClean Pro (no registry cleaner is worth the trouble or money as they will destroy your system eventually), and Norton Security Scan and possibly a few others that I don't have time to look up.
Always be on high alert for unwanted extras when downloading anything and always make sure it's coming from the software developer and not some 3rd party of dubious reputation.
We don't operate a complete virus removal service here, McAfee does but they charge for that. All I can advise you to do is run Hijackthis and post its log as instructed lower down the last link in my signature below.
Sorry for posting in wrong area.
Just to clear up I have said -
"I have managed to get rid of almost all including Search protect, Reg Clean Pro; rqpbhevlkc64.exe, MyPC Backup, DMUninstaller, BlockAndSurf, FreeV_1.3, AnyProtect. Also Norton Security Scan was removed as we have Mcafee."
Help is needed with the the proxy server virus/hijack, thanks.
Don't apologise, navigating these forums can be rather confusing to say the least. I'm not sure what to suggest other than the Hijackthis route I previously suggested.
Unless you want to run more tools first as suggested in that last signature link of mine.
.Message was edited by: Ex_Brit on 11/06/14 11:47:08 EDT AM