Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Google won't load (2)

  • This topic is locked This topic is locked
7 replies to this topic

#1 Dennis50


  • Members
  • 8 posts
  • Local time:04:53 AM

Posted 08 January 2010 - 10:31 AM

This is a continuation of the following topic: http://www.bleepingcomputer.com/forums/ind...p;#entry1571287.

I was redirected to this topic because my HiJackThis-log looked very suspicious.

Here is the log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:36:51, on 8/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton 360\Engine\\ccSvcHst.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Norton 360\Engine\\ccSvcHst.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts: test1111.com
O1 - Hosts: test1112.com
O1 - Hosts: 4-open-davinci.com
O1 - Hosts: securitysoftwarepayments.com
O1 - Hosts: privatesecuredpayments.com
O1 - Hosts: secure.privatesecuredpayments.com
O1 - Hosts: getantivirusplusnow.com
O1 - Hosts: secure-plus-payments.com
O1 - Hosts: www.getantivirusplusnow.com
O1 - Hosts: www.secure-plus-payments.com
O1 - Hosts: www.getavplusnow.com
O1 - Hosts: www.securesoftwarebill.com
O1 - Hosts: google.ae
O1 - Hosts: google.as
O1 - Hosts: google.at
O1 - Hosts: google.az
O1 - Hosts: google.ba
O1 - Hosts: google.be
O1 - Hosts: google.bg
O1 - Hosts: google.bs
O1 - Hosts: google.ca
O1 - Hosts: google.cd
O1 - Hosts: google.com.gh
O1 - Hosts: google.com.hk
O1 - Hosts: google.com.jm
O1 - Hosts: google.com.mx
O1 - Hosts: google.com.my
O1 - Hosts: google.com.na
O1 - Hosts: google.com.nf
O1 - Hosts: google.com.ng
O1 - Hosts: google.ch
O1 - Hosts: google.com.np
O1 - Hosts: google.com.pr
O1 - Hosts: google.com.qa
O1 - Hosts: google.com.sg
O1 - Hosts: google.com.tj
O1 - Hosts: google.com.tw
O1 - Hosts: google.dj
O1 - Hosts: google.de
O1 - Hosts: google.dk
O1 - Hosts: google.dm
O1 - Hosts: google.ee
O1 - Hosts: google.fi
O1 - Hosts: google.fm
O1 - Hosts: google.fr
O1 - Hosts: google.ge
O1 - Hosts: google.gg
O1 - Hosts: google.gm
O1 - Hosts: google.gr
O1 - Hosts: google.ht
O1 - Hosts: google.ie
O1 - Hosts: google.im
O1 - Hosts: google.in
O1 - Hosts: google.it
O1 - Hosts: google.ki
O1 - Hosts: google.la
O1 - Hosts: google.li
O1 - Hosts: google.lv
O1 - Hosts: google.ma
O1 - Hosts: google.ms
O1 - Hosts: google.mu
O1 - Hosts: google.mw
O1 - Hosts: google.nl
O1 - Hosts: google.no
O1 - Hosts: google.nr
O1 - Hosts: google.nu
O1 - Hosts: google.pl
O1 - Hosts: google.pn
O1 - Hosts: google.pt
O1 - Hosts: google.ro
O1 - Hosts: google.ru
O1 - Hosts: google.rw
O1 - Hosts: google.sc
O1 - Hosts: google.se
O1 - Hosts: google.sh
O1 - Hosts: google.si
O1 - Hosts: google.sm
O1 - Hosts: google.sn
O1 - Hosts: google.st
O1 - Hosts: google.tl
O1 - Hosts: google.tm
O1 - Hosts: google.tt
O1 - Hosts: google.us
O1 - Hosts: google.vu
O1 - Hosts: google.ws
O1 - Hosts: google.co.ck
O1 - Hosts: google.co.id
O1 - Hosts: google.co.il
O1 - Hosts: google.co.in
O1 - Hosts: google.co.jp
O1 - Hosts: google.co.kr
O1 - Hosts: google.co.ls
O1 - Hosts: google.co.ma
O1 - Hosts: google.co.nz
O1 - Hosts: google.co.tz
O1 - Hosts: google.co.ug
O1 - Hosts: google.co.uk
O1 - Hosts: google.co.za
O1 - Hosts: google.co.zm
O1 - Hosts: google.com
O1 - Hosts: google.com.af
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\\IPSBHO.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\\coIEPlg.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" -autorun
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKUS\S-1-5-21-1202660629-1078145449-839522115-1006\..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe (User 'postgres')
O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1222157440052
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1222953027796
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\\coIEPlg.dll
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\\ccSvcHst.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

End of file - 13538 bytes

Thanks in advance.

EDIT: The log won't paste because it's of a BETA HiJackThis Program, please give me 5 minutes to download and paste the log or have a look in the topic of which the link is posted above. Thanks

EDIT2: Fixed

Edited by Dennis50, 08 January 2010 - 10:37 AM.

BC AdBot (Login to Remove)


#2 Farbar


    Just Curious

  • Security Developer
  • 21,689 posts
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:53 AM

Posted 08 January 2010 - 11:09 AM

Hi Dennis50,

Welcome to BC HijackThis forum. I am going to assist you with your problem.

Please refrain from making any changes to your system (scanning or running other tools, updating Windows, installing applications, removing files, etc.) from now on as it might interfere with our fixes. Please let me know in your next reply if you agree with this.

Download HostsXpert.zip
  • Extract (unzip) HostsXpert.zip to a permanent folder on your hard drive such as C:\HostsXpert
  • Double-click HostsXpert.exe to run the program.
  • Click "Make Hosts Writable?" in the upper right corner (If available).
  • Click "Restore Microsoft's Hosts file" and then click "OK".
  • Click the X to exit the program.
  • Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

Please let me know if the problem is fixed.



#3 Dennis50

  • Topic Starter

  • Members
  • 8 posts
  • Local time:04:53 AM

Posted 08 January 2010 - 03:42 PM

Hi Farbar,

Yes, I agree to refrain from making changes to my system.
I've followed your steps and got the following message after doing step 4:

"ERROR: Cannot create file C:WINDOWS\system32\DRIVERS\ETC\hosts"

What's my next step?

Thank you.

#4 Farbar


    Just Curious

  • Security Developer
  • 21,689 posts
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:53 AM

Posted 08 January 2010 - 05:16 PM

Let's try this one.

Download the attached file and double-click to run it. It produces a log. Please post the content to your reply.

#5 Dennis50

  • Topic Starter

  • Members
  • 8 posts
  • Local time:04:53 AM

Posted 09 January 2010 - 02:20 AM

Here's the log:

c:\windows\system32\drivers\etc\hosts NT AUTHORITY\Geverifieerde gebruikers:(speciale toegang:)


# Copyright © 1993-1999 Microsoft Corp.
# Dit is een voorbeeld HOSTS-bestand dat wordt gebruikt door Microsoft TCP/IP for Windows.
# Dit bestand bevat de toewijzingen van IP-adressen naar hostnamen. Elke vermelding
# moet op een afzonderlijke regel staan. Het IP-adres dient in de eerste kolom te worden
# geplaatst, gevolgd door de bijbehorende hostnaam. Het IP-adres en de hostnaam dienen
# gescheiden te zijn door ten minste één spatie.
# Daarnaast kunnen opmerkingen (zoals deze) worden toegevoegd op extra
# regels of gevolgd door de computernaam, voorafgegaan door een #.
# Bijvoorbeeld:
# rhino.acme.com # bronserver
# x.acme.com # x clienthost localhost test1111.com test1112.com 4-open-davinci.com securitysoftwarepayments.com privatesecuredpayments.com secure.privatesecuredpayments.com getantivirusplusnow.com secure-plus-payments.com www.getantivirusplusnow.com www.secure-plus-payments.com www.getavplusnow.com www.securesoftwarebill.com google.ae google.as google.at google.az google.ba google.be google.bg google.bs google.ca google.cd google.com.gh google.com.hk google.com.jm google.com.mx google.com.my google.com.na google.com.nf google.com.ng google.ch google.com.np google.com.pr google.com.qa google.com.sg google.com.tj google.com.tw google.dj google.de google.dk google.dm google.ee google.fi google.fm google.fr google.ge google.gg google.gm google.gr google.ht google.ie google.im google.in google.it google.ki google.la google.li google.lv google.ma google.ms google.mu google.mw google.nl google.no google.nr google.nu google.pl google.pn google.pt google.ro google.ru google.rw google.sc google.se google.sh google.si google.sm google.sn google.st google.tl google.tm google.tt google.us google.vu google.ws google.co.ck google.co.id google.co.il google.co.in google.co.jp google.co.kr google.co.ls google.co.ma google.co.nz google.co.tz google.co.ug google.co.uk google.co.za google.co.zm google.com google.com.af google.com.ag google.com.ar google.com.au google.com.bn google.com.br google.com.by google.com.bz google.com.cu google.com.ec google.com.fj www.google.ae www.google.as www.google.at www.google.az www.google.ba www.google.be www.google.bg www.google.bs www.google.ca www.google.cd www.google.com.gh www.google.com.hk www.google.com.jm www.google.com.mx www.google.com.my www.google.com.na www.google.com.nf www.google.com.ng www.google.ch www.google.com.np www.google.com.pr www.google.com.qa www.google.com.sg www.google.com.tj www.google.com.tw www.google.dj www.google.de www.google.dk www.google.dm www.google.ee www.google.fi www.google.fm www.google.fr www.google.ge www.google.gg www.google.gm www.google.gr www.google.ht www.google.ie www.google.im www.google.in www.google.it www.google.ki www.google.la www.google.li www.google.lv www.google.ma www.google.ms www.google.mu www.google.mw www.google.nl www.google.no www.google.nr www.google.nu www.google.pl www.google.pn www.google.pt www.google.ro www.google.ru www.google.rw www.google.sc www.google.se www.google.sh www.google.si www.google.sm www.google.sn www.google.st www.google.tl www.google.tm www.google.tt www.google.us www.google.vu www.google.ws www.google.co.ck www.google.co.id www.google.co.il www.google.co.in www.google.co.jp www.google.co.kr www.google.co.ls www.google.co.ma www.google.co.nz www.google.co.tz www.google.co.ug www.google.co.uk www.google.co.za www.google.co.zm www.google.com www.google.com.af www.google.com.ag www.google.com.ar www.google.com.au www.google.com.bn www.google.com.br www.google.com.by www.google.com.bz www.google.com.cu www.google.com.ec www.google.com.fj google.com www.google.com bing.com www.bing.com search.yahoo.com www.search.yahoo.com search.live.com search.msn.com googleads.g.doubleclick.net www.googleads.g.doubleclick.net pubads.g.doubleclick.net www.pubads.g.doubleclick.net partner.googleadservices.com www.partner.googleadservices.com www.partner.googleadservices.com

#6 Farbar


    Just Curious

  • Security Developer
  • 21,689 posts
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:53 AM

Posted 09 January 2010 - 06:15 AM

  1. Please download Malwarebytes' Anti-Malware from one of these locations:
    • Double Click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the MBAM log.

    Extra Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

  2. Please open Malwarebytes' Anti-Malware.
    • Go to the "More Tools" tab and click on the "Run Tool" button.
    • Browse to the location of the file(s) to remove using the drop down box next to "Look in:".
    • Copy and paste the following in the File name box:


    • When you find the file(s), click "Open".
    • You will be prompted with a message warning: This file will be permanently deleted. Are you sure you want to continue?. Click Yes.
    • If removal did not require a reboot, you will receive a message indicating the file was deleted successfully.

  3. Now run HostsXpert.exe to create the hosts file.

#7 Dennis50

  • Topic Starter

  • Members
  • 8 posts
  • Local time:04:53 AM

Posted 09 January 2010 - 08:26 AM

It worked! I can't thank you enough, farbar!
Keep up the good work.



#8 Farbar


    Just Curious

  • Security Developer
  • 21,689 posts
  • Gender:Male
  • Location:The Netherlands
  • Local time:05:53 AM

Posted 09 January 2010 - 09:15 AM

Glad I could help and you are most welcome Dennis. smile.gif

This thread will now be closed since the issue seems to be resolved.

If you need this topic reopened, please send me a PM and I will reopen it for you.

If you should have a new issue, please start a new topic.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users