Re: Browser Hijack - Help

Trend recommends that "for the Trend Micro Sysclean Package to be effective, you
must download and place the latest pattern file in the same folder as the Trend
Micro Sysclean Package." There are several pattern files for downloading
fromthe Trend web site. Which one(s) should be downloaded to go with Sysclean?
Thanks... Ben Myers

On Fri, 27 Apr 2007 13:58:08 +0100, Colin Wilson
<REMOVEEVERYTHINGBUTnewsgroup@xxxxxxxxxxxxxxxxxxxxxxxx> wrote:

Before you say "I told you so," please note that I was running AVG
Anti-virus, As Aware SE, Spy Blocker, Panicware Pop-Up blocker and a
firewall......
So far, in 3 days, using "HijackThis," AVG, and AVAST, I'm about 80% back, I
have System Restore back, but my browser is still getting hijacked. Email
and programs are not affected, just the internet.

OhhhhhK... where do we start...

While i'm loathe to suggest trying to access the internet with a
hijacked machine, it might be worth downloading Sysclean from Trend
Micro - if you can't get to their site, the malware will have likely
added stuff to your hosts file to redirect / block it.

If you can't get it from the official site, try going via mine, at
http://www.coreutilities.co.uk (i'll upload a fresh / up to date copy
of the exe and virus sigs in the next few minutes).

Copy both files somewhere you can find them, i.e. C:\SYSCLEAN - you'll
just need the exe and unzip the virus signatures to the same
directory.

Reboot, go into safe mode (press F8 after the BIOS screen finishes)
and then navigate to the directory and run the Sysclean executable,
then click the "start" button - you'll see several "DOS" style boxes
appear (don't worry, it's supposed to do that) and it might take a
while to scan.

It might also be worth downloading Spybot Search & Destroy, and
installing that while you're there - you can grab the updates and
install them offline.

I'll send you a small zip file with the contents of my website (all
plain html) in case that is a useful reference point for you - you get
the odd quirk with Spybot that I point out :-}

Spybot S&D's installation and update files can be found here:

http://www.spybotupdates.com/files/spybotsd14.exe
http://www.spybotupdates.com/updates/files/spybotsd_includes.exe
http://www.spybotupdates.com/updates/files/spybotsd_tools.exe
http://www.spybotupdates.com/updates/files/spybotsd_advcheck.exe

Install Spybot first, don't bother to let it run yet (which it'll
offer to do after installing), then run each of the updates in turn.

Finally, run it and follow some of the tips from my site on how to do
different things (like updating the hosts file)
.

Relevant Pages