5 Replies Latest reply on Jun 11, 2014 10:57 AM by Peter M

    Virus or Hijack help needed

    dipys100

      HI all,

      My daughters' laptop got infected with several viruses after downloading Adobe Flash Player 13 ActiveX.
      I have managed to get rid of almost all including Search protect, Reg Clean Pro; rqpbhevlkc64.exe, MyPC Backup, DMUninstaller, BlockAndSurf, FreeV_1.3, AnyProtect. Also Norton Security Scan was removed as we have Mcafee.

      When using HitmanPro_x64 two results are found to repair proxy server infected/hijacked by 127.0.0.1.59818

      After the next step these are removed form laptop.
      These then used to reappear after going on the internet using Firefox (I don't think it happened with Googlechrome or IE)

      This I think has stopped since restting Firefox settings.


      They sometimes seem to reappear after restarting.
      But always reappear when using adwcleaner which prompts a restart (although this program doesn't find these two items)
      Adware finds two files in AppData one for Mozilla pref.js in Roaming and one for Google preferences in Local.

      They also don't show up in MaleWareBytes.
      I have also run TDSKiller and nothing found.

      I have Mcafee Livesafe Internet Security and Windows7

      I have also reset the Proxy settings using Microsoft fixit, with same results. (As It is a home computer it shouldn't have proxyserver)

      I have deleted the following in HKEY_USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet settings.

      ProxyOverride (showing Loopback)                                                     - HitmanPro leaves this as is.
      ProxyServer  (Showing http=127.0.0.1:59818;https=127.0.0.1:59818)    - HitmanPro deletes this.


      I have changed the following in HKEY_USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet settings
      ProxyEnable 1 to 0                                                                            -HitmanPro does the same.

       

      Hope someone is able to help, thanks.

        • 1. Re: Virus or Hijack help needed
          Peter M

          Moved this to Malware Discussion > Home User Assistance as a better spot for it.

           

          Out of the list of programs showing above you need to ditch Search Protect. RegClean Pro (no registry cleaner is worth the trouble or money as they will destroy your system eventually), and Norton Security Scan and possibly a few others that I don't have time to look up.

          Always be on high alert for unwanted extras when downloading anything and always make sure it's coming from the software developer and not some 3rd party of dubious reputation.

           

          We don't operate a complete virus removal service here, McAfee does but they charge for that.  All I can advise you to do is run Hijackthis and post its log as instructed lower down the last link in my signature below.

          1 of 1 people found this helpful
          • 2. Re: Virus or Hijack help needed
            dipys100

            Hi,

            Sorry for posting in wrong area.

            Just to clear up I have said -

             

            "I have managed to get rid of almost all including Search protect, Reg Clean Pro; rqpbhevlkc64.exe, MyPC Backup, DMUninstaller, BlockAndSurf, FreeV_1.3, AnyProtect. Also Norton Security Scan was removed as we have Mcafee."

             

            Help is needed with the the proxy server virus/hijack, thanks.

            • 3. Re: Virus or Hijack help needed
              Peter M

              Don't apologise, navigating these forums can be rather confusing to say the least.   I'm not sure what to suggest other than the Hijackthis route I previously suggested.

              Unless you want to run more tools first as suggested in that last signature link of mine.

               

               

              .

               

              Message was edited by: Ex_Brit on 11/06/14 11:47:08 EDT AM
              • 4. Re: Virus or Hijack help needed
                dipys100

                ok I have the hijack log but don't know how to load it.

                Do I just copy and paste in reply box?

                • 5. Re: Virus or Hijack help needed
                  Peter M

                  Copy and paste it, but not here, do that on one of the recommended forums listed in that link near the bottom.   You'll have to enroll of course.