I need some answers. Thanks

12 years ago

Hi everyone,

When I type in the browser, example(sunglasses),it redirests me to sites that try to sell me different things.I have downloaded Malware Pro and run the full scan and it finds 2 trojans every time and tells me to reboot to get rid of them. When I log back in they are still on my computer.I am not computer savy and need advise on how to proceed in fixing this problem. The log that is at the end of the scan has "svchost.exe" . Does anyone know how to help? Thanks

Sort by:Oldest

Comments (12)

mikie_gw
12 years ago
maybe try
malwarebytes.com free version

or my favorite
superantispyware.com free version

might be wise to check for root kit with kapersky's little fast checker....

Here is a link that might be useful: tdsskiller
azinoh
12 years ago
If you are actually using a program named "MALWAREPRO", that is the infection!! If this was my computer, I would download Malwarebytes and Superantispyware, install them in safe mode, do a full scan with each in safe mode. I would update the antivirus and do a full scan with that in safe mode. Also, you need to Google "MALWAREPRO" and learn what it does and how to get rid of it.
Related Discussions
I have a question,I hope some one can answer
Q
Comments (3)
Thank you kay and Nancy., well, now I am not expecting seeds from this,so if I do get seeds and they turn out they are good one and grow me a new daylily, I will be very surprised.Hope it works,anyway.maybe I be beginers luck? jean
...See More
New to this forum.... need some answers, please
Q
Comments (4)
Heartzlink,welcome. I tried wintersowing for the first time last year. Before that I barely knew how to get a plant from the store and transplant it. Since then I became obsessed and read every book, every site, every piece of advice I could get my hands on. I had spent a few years trying to amend my soil. Decided last year that it was now or never. (still on my first cup of coffee. Bear with me) The wintersowing is basically foolproof. I use milk jugs, two liters, 20oz. bottles, anything that will hold dirt. Can't believe my homeowners association didn't complain last winter.I had 1/2 of my tiny plot of land covered with jugs which probably looked like trash to them. But come spring, I had the prettiest garden in the neighborhood. As for seeds swaps you might want to look into meetup.com. They have people from your area ( well, all area's but it goes by city) that that sign up for things that they are interested in and gardening is usually an option. I joined one here that was organized by "spencersmom" who sometimes posts here. Transportation is an issue for me so I haven't been able to go as much as I would have liked but the one I did go to was so much fun. A ton of great people. I just got back from the Richmond area a few days ago. Henirco County.Not sure if I spelled that right. We found a beautiful house for sale with 3/4 of an acre, which is huge compared to what I have now. And I mean HUGE! We are in the process of getting it and if all goes well, we will be moving there by next year. If all doesn't go well we will be looking into the Highland Springs area. That's where my mom is and she is getting older and I would like to be close. But the economy is in such a state that moving right now is not an option. Don't want to give up hubbie's job and our health insurance til I know we have something lined up and more in our savings. So, in closing, wintersowing is great, meetup.com to find people that enjoy gardening in your area and most importantly, spring will be here soon!
...See More
Is anyone still watching LOST..? I need some answers...
Q
Comments (14)
I look forward to Thursday night and LOST all week. But I think they better give me some answers soon because I am getting really frustrated. The episode where Desmond jumps between 2 time periods was really stretching it. And that wasn't even a flash forward or backward. My son announced after that show aired that he was afraid LOST had "jumped the shark" If you're unfamiliar with that phrase, here's how Wikipedia describes it......"The term jumping the shark alludes to a specific scene in a 1977 episode of the TV series Happy Days when the popular character Arthur "Fonzie" Fonzarelli literally jumps over a shark while water skiing. The scene was so preposterous that many believed it to be an ill-conceived attempt at reviving the declining ratings of the flagging show. Since then, the phrase has become a colloquialism used by U.S. TV critics and fans to denote the point at which the characters or plot of a TV series veer into a ridiculous, out-of-the-ordinary storyline. Such a show is typically deemed to have passed its peak. Once a show has "jumped the shark" fans sense a noticeable decline in quality or feel the show has undergone too many changes to retain its original charm" I don't think Lost has gone that far, but I am a little worried. We tape LOST while we watch it because my son works Thursday nights. So I watch it again on Friday when he's home and it helps me follow along.
...See More
Totally confused - I need some answers
Q
Comments (12)
Bless your heart. LEAF - how sweet! SECOND - I was in the same place when I first started out - didn't know the terms, and it seemed nobody was willing to draw it all out - used general terms - blah, blah, blah. I wrote several on-line artists, and still got no answers. I even went to my local tile store for info when I was about to mosaic my front walk, and the old man owner told me "you can't do that unles blah, blah, blah." "Yeah, right, I thought - you just watch me." My next move was to call Mapei's 800 number. Yes - thinset is mortar. I use Mapei because it already has the polymer admixture in it - just add water. Mapei man on the phone assured me that what I wanted to do was possible, and so I began. Not one tile has budged on my front walk, except where I mosaiced over a crack on a very hot August day. I need to repair the crack, and mo over it (someday). You just have to step out and EXPERIMENT. I'm glad you're going to start tomorrow. I'll be thinking of you, and YES - Mapei Ultra Flex II is thinset - or mortar or cement-based adhesive. Go for it. You're gonna have tons of fun, once you get over this fear factor. I put my front walk project off for months and months and months. It's still there, after - oh I don't know for how long - probably four/five years.
...See More
pluto
Original Author
12 years ago
Sorry, The program I downloaded is Malwarebytes. I upgraded to the Pro version of Malwarebytes. When I type a site in my browser and hit search I am redirected to other websites that have absolutely nothing to do with what I was searching for. I guess I must have a virus and will require professional help with this. Thanks
zep516
12 years ago
Hi pluto,

You're correct in that you need professional help. If you want to use the forum method I have provided a link for you.

Google re-directs like that can be a sign of rootkit activity. For the sake of this thread can you identify the names of the Trojans that are being found and tell us what they are named.

Joe

Here is a link that might be useful: malware-removal/log-posting-instructions
pluto
Original Author
12 years ago
This pops up on the screen after a scan.Can anyone tell if this is a virus. Thanks

Malwarebytes Anti-Malware (PRO) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.03.04.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
John :: JOHN-PC [administrator]

Protection: Enabled

3/4/2012 1:30:11 PM
mbam-log-2012-03-04 (13-30-11).txt

Scan type: Quick scan
Scan options enabled: Memory : Startup : Registry : File System : Heuristics/Extra : Heuristics/Shuriken : PUP : PUM
Scan options disabled: P2P
Objects scanned: 192624
Time elapsed: 1 minute(s), 42 second(s)

Memory Processes Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> 1928 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.

(end)
albert_135 　 39.17°N 119.76°W 4695ft.
12 years ago
We were cursed with a browser hijack(s) for several days. The usual suggestions didn't work. Finally someone at SDMB suggested TDSSKiller. The problems were finally resolved with TDSSKiller in just a matter of a couple of minutes. Rootkit.boot.pihar.b was removed.
ravencajun Zone 8b TX
12 years ago
Go to the link Zep gave you this is one that you will need assistance with. Do not use any other programs till the team there tells you to. You will need to register there and create your own post in the malware removal section. The team will lead you step by step instructions to fully recover from this infection. If not done properly parts of it will remain. Don't use this pc for purchases or banking till clean.
If you need help to get registered let me know I am there too.
pluto
Original Author
12 years ago
Thanks for the link Zep. I am going to register there and hope for the best. Thanks Ravencajun .
zep516
12 years ago
Good!

c:\windows\svchost.exe----->Infected file, it's in the wrong folder. svchost.exe runs only from the System32 folder.

Malwarebytes says it removes it but probably can't

\Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b )
Above is probably the rootkit, as albert pointed out.

The forum will run more revealing scans for you too.
pluto
Original Author
12 years ago
Ravencajun......I need help with registering at that site.
corrine_mvp
12 years ago
Hi, pluto.

I checked the list of new members awaiting activation and there isn't anyone waiting from the last few days.

If you would send an e-mail to me at the address below, I will pre-register your account. After it is set up, you will be able to login and change the password to one of your choice.

Send to: Corrine-LzD @ hotmail.com (without the spaces)
corrine_mvp
12 years ago
Account created so pluto should be good to go!

I need some answers. Thanks

Comments (12)

mikie_gw

azinoh

Related Discussions

pluto
Original Author

zep516

pluto
Original Author

albert_135 　 39.17°N 119.76°W 4695ft.

ravencajun Zone 8b TX

pluto
Original Author

zep516

pluto
Original Author

corrine_mvp

corrine_mvp

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

I need some answers. Thanks

Comments (12)

Related Discussions

plutoOriginal Author

plutoOriginal Author

plutoOriginal Author

plutoOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

pluto
Original Author

pluto
Original Author

pluto
Original Author

pluto
Original Author