Infected with something

Gemok · 17-01-2006, 23:04

Something has got into my computer which keeps changing the internet settings to connect through a proxy server its affecting Firefox and IE I've run a complete virus scan and spyware sweep but both came up empty I guess something has altered a registry setting somewhere anyone have a clue where to look?

Its starting to P**S me off may end up reinstalling everything just to get rid of it!

Warspite · 17-01-2006, 23:11

TBH its probably using an anonymous registry key that keeps replacing anything you trace - the simplest, and most definate way to be rid is to do a clean install. Total pain but you wont be sure if anything you find is the only thing on your system.

Not much help, but its what I've found is the simplest in the longrun.

Goodluck

evilowl · 17-01-2006, 23:14

Clean install is overkill.

Download hijack this http://www.tomcoyote.org/hjt/ but RTFM first and if you are not sure about anything do not pass go, do not collect £200 but copy and paste the log from the scan on here and we will advise what to remove.

CT · 17-01-2006, 23:28

Sympathies. Hope you get it sorted. A full install is a lot of work.

Gemok · 17-01-2006, 23:52

Thanks for the link evilowl thats a very usefull app
I'm pretty computer savvy so know what I shouldn't be deleting just didn't know where to look in the reg there just way to may branches to look through one by one.
top of the pile was
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = 64.110.74.244:8080
promtly deleted now to see if it comes back and to work out how it got there

evilowl · 18-01-2006, 12:49

I've just tried browsing to that site and been blocked by our corporate firewall (reason being: proxy avoidance)

It looks like it could be an anoymous proxy to me. But it could also be spyware related (logging sites visited, usernames & passwords etc)

http://www.dnsstuff.com/tools/whois....net&em ail=on

ivan.rodriguez@ses-americom.com
abuse@ses-americom.net
andre.christian@verestar.com
admin@ses-americom.net

^^I'm sure would all love to get a nice email detailing your findings.

GfK · 18-01-2006, 12:55

If I ever get any problems like this, I use:

HijackThis
AdAware *
SpyBot Search&Destroy*
CWShredder

* = both do much the same job, but each manages to find stuff that the other misses, so worth having both.

Venomator · 18-01-2006, 13:32

Sympathies also Gemok - hope you are sorted now.

Not wishing to butt in on Gemok's probs ...

But hey guys - there is also some really useful reference material here ... thanx for that and it is also good to know there are peeps more than willing to help and advise on stuff other than photography !

Have used SpyBot S&D before and thought this was all we needed !

Stored for future ref ... thanks again !

Steep · 19-01-2006, 18:09

System Restore is teh devil! switch it off

GfK · 19-01-2006, 18:09

Quote:

Originally Posted by Steep

System Restore is teh devil! switch it off

Dunno, its got me out of a few scrapes over the years...

Matty · 19-01-2006, 18:19

if you get a virus of some sort, turn off system restore before you remove it, otherwise the virus doesnt really go at all, found that out the hard way!

evilowl · 19-01-2006, 21:45

Quote:

Originally Posted by Steep

System Restore is teh devil! switch it off

Indeed

Ghost 4 TEH WIN !!!!111one!!!1

dod · 20-01-2006, 10:28

Quote:

Originally Posted by evilowl

Indeed

Ghost 4 TEH WIN !!!!111one!!!1

Ghost has saved me hours of work

21-01-2006, 10:10

I used to use Acronis True Image Pro, then found the recovery CD just didn't want to play nicely with my new Sata drives, so I use Ghost now instead.

17-01-2006, 23:04	#1 (permalink)
Gemok Getting Comfy Join Date: Aug 2005 Posts: 245	Infected with something Something has got into my computer which keeps changing the internet settings to connect through a proxy server its affecting Firefox and IE I've run a complete virus scan and spyware sweep but both came up empty I guess something has altered a registry setting somewhere anyone have a clue where to look? Its starting to P**S me off may end up reinstalling everything just to get rid of it!

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

17-01-2006, 23:11	#2 (permalink)
Warspite Feet under the table Join Date: Sep 2005 Location: Newcastle Sunderland Middlesbrough (UK) Posts: 1,736	TBH its probably using an anonymous registry key that keeps replacing anything you trace - the simplest, and most definate way to be rid is to do a clean install. Total pain but you wont be sure if anything you find is the only thing on your system. Not much help, but its what I've found is the simplest in the longrun. Goodluck

17-01-2006, 23:14	#3 (permalink)
evilowl Been here a while Join Date: Sep 2005 Location: London village Posts: 376	Clean install is overkill. Download hijack this http://www.tomcoyote.org/hjt/ but RTFM first and if you are not sure about anything do not pass go, do not collect £200 but copy and paste the log from the scan on here and we will advise what to remove.

17-01-2006, 23:28	#4 (permalink)
CT Feet under the table Join Date: Mar 2005 Location: West Mids UK Posts: 3,500	Sympathies. Hope you get it sorted. A full install is a lot of work.

17-01-2006, 23:52	#5 (permalink)
Gemok Getting Comfy Join Date: Aug 2005 Posts: 245	Thanks for the link evilowl thats a very usefull app I'm pretty computer savvy so know what I shouldn't be deleting just didn't know where to look in the reg there just way to may branches to look through one by one. top of the pile was R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = 64.110.74.244:8080 promtly deleted now to see if it comes back and to work out how it got there

18-01-2006, 12:49	#6 (permalink)
evilowl Been here a while Join Date: Sep 2005 Location: London village Posts: 376	I've just tried browsing to that site and been blocked by our corporate firewall (reason being: proxy avoidance) It looks like it could be an anoymous proxy to me. But it could also be spyware related (logging sites visited, usernames & passwords etc) http://www.dnsstuff.com/tools/whois....net&em ail=on ivan.rodriguez@ses-americom.com abuse@ses-americom.net andre.christian@verestar.com admin@ses-americom.net ^^I'm sure would all love to get a nice email detailing your findings.

18-01-2006, 12:55	#7 (permalink)
GfK Forum Regular Join Date: Aug 2005 Posts: 861	If I ever get any problems like this, I use: HijackThis AdAware * SpyBot Search&Destroy* CWShredder * = both do much the same job, but each manages to find stuff that the other misses, so worth having both.

18-01-2006, 13:32	#8 (permalink)
Venomator Forum Regular Join Date: Oct 2005 Location: Hertfordshire Posts: 922	Sympathies also Gemok - hope you are sorted now. Not wishing to butt in on Gemok's probs ... But hey guys - there is also some really useful reference material here ... thanx for that and it is also good to know there are peeps more than willing to help and advise on stuff other than photography ! Have used SpyBot S&D before and thought this was all we needed ! Stored for future ref ... thanks again !

19-01-2006, 18:09	#9 (permalink)
Steep Forum Regular Join Date: Jan 2005 Location: Inverness Posts: 964	System Restore is teh devil! switch it off

19-01-2006, 18:19	#11 (permalink)
Matty Member Join Date: Jan 2005 Location: kings hill Posts: 5,269	if you get a virus of some sort, turn off system restore before you remove it, otherwise the virus doesnt really go at all, found that out the hard way!

21-01-2006, 10:10	#14 (permalink)
Marcel Posts: n/a	I used to use Acronis True Image Pro, then found the recovery CD just didn't want to play nicely with my new Sata drives, so I use Ghost now instead.