Am I infected with Spyware/Virus?

[dee-u]

Strange, I have made VBForums as my default webpage but ths morning this is the one coming out... I have AVG, S&D and SpywareGuard... What seems to be wrong? I have uninstalled FireFox but still the problem persists...

[baja_yu]

you should post this in the General PC forum. Also, look for my post about Google Search in the same forum, I think the same solution will work for you.

[dee-u]

More people are frequenting ChitChat than General PC so I posted it here. I'll take a search, couldnt you provide the exact thread?

[dglienna]

Look at your start page, if it is vbf, then look in the hosts file

[dee-u]

Hey baja_yu, I found your thread but I cannot understand those things, I'm a bit noob to this kind of situations... What is hosts file? Where can I find it?

[baja_yu]

http://www.vbforums.com/showthread.php?t=345343

Download HijackThis and use it to remove the problem makers you might have.
Also check your hosts file, it is located in the Windows folder, it is called "hosts" (just that, no extension).

[dee-u]

There is no "host" file in my Windows directory...

[baja_yu]

make sure you enable "Show hidden files" and/or "Show protected system files"

[dee-u]

This is the result of HijackThis... What are the ones I should remove?

[baja_yu]

Remove the second R1.
Also, maybe third and fourt O16, but I am not sure, I dont know what software you have installed. If you dont know what the HouseCall control is you should maybe remove it.

[dee-u]

The error still persists and I still cant find any "host" file...

Here's the latest result of HijackThis...

[baja_yu]

There should be a 'hosts' file in you "C:\Windows" folder. Are you sure you enabled listing hidden system files? Look here: http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Anyway, download this, it will list your hosts file: http://www.funkytoad.com/download/hoster.zip

Download: http://www.mvps.org/winhelp2002/DelDomains.inf
To use: right-click and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.

[dee-u]

That Hoster said "HOSTS file does not exists"... Is that normal?

[baja_yu]

hmm... I'm not sure, probably not but here's mine. Copy it to your windows folder.

[dee-u]

This is what the Hoster shown, what should I do now? The problem still persists...

[baja_yu]

Ok, the hosts file is ok. Now, try removing the O6, O16, O16, and O17 items from your last HijackThis log.

[dee-u]

This is the latest result of HijackThis after I have scanned my computer with Microsoft AntiSpyware but still the problem persists....

[dee-u]

When I change the Default Page to www.codeguru.com and tried to start IE it actually goes to codeguru, but when i changed it back to www.vbforums.com and tried to run IE that page in my first page is still the one being shown! Its as if it is being redirected to that page if I use www.vbforums.com, when I try to refresh the actual page of vbforums is shown... What's happening?

[baja_yu]

Remove R1 and O17 if that IP address that they show is unknown to you.
Also, download and run this app: http://www.cexx.org/lspfix.zip

when you run it, it will list some files in the box on the left. Post the filenames here.

[dee-u]

I have removed O17 now...

The files listed are:
1. mswsock.dll (tcpip)
2. winrnr.dll (ntds)
3. rsvpsp.dll (protocol handler)

[baja_yu]

That is all ok. I'm not sure what could be the problem... let me think

[baja_yu]

Does the problem occur on any other browser except IE?

[dee-u]

Yes, it also occurs in FireFox so I have uninstalled FireFox thinking it might be the cause since the page being shown is about Mozilla...

[baja_yu]

What would happen if you set your homepage to:

http://www.vbforums.com/forumdisplay.php?f=1

that will make it go directly to Classic VB.

[dee-u]

That works fine... Its only www.vbforums.com that is somehow being redirected, how come?

[baja_yu]

I have no idea ....... ?!?

[dee-u]

I am currently running Panda ActiveScan right now and its not yet finished but somehow it has detected something infected in the registry, I hope when its finished and I could fix the infected part of the registry all will be fine already....

A million thanks baja_yu!

[baja_yu]

No problem

[Pc_Madness]

If its being redirected then its the hosts file?

The reason he can't find the hosts file is because on Windows XP it isn't stored in C:\Windows, its in,
C:\Windows\System32\drivers\etc\hosts

[baja_yu]

Yeah, but I sent him a link for hosts file examination application. The hosts file is ok.

[dee-u]

Now I found that Host file you are talking about, thanks Pc_Madness, do you have any recommendations or suggestion why this is happening?

[baja_yu]

Open that file and post it's contents here. It should look like the one I sent you.

[Pc_Madness]

Were the contents of that file empty? (apart from 127.0.0.1 localhost)

"hmm... I'm not sure, probably not but here's mine. Copy it to your windows folder."

Seems to imply that you copied the one baja_yu sent you to C:\Windows. If the program above is as dodgy as I'm thinking it is, then its just reading the one in C:\Windows (which has no effect on your net connection). If it did know where to find it on XP, it shouldn't have said that the file was missing?

Otherwise, I'm not sure, it has to be something local if you can view a particular parts of the site, just not the homepage. Tried visiting without the www? vbforums.com

[baja_yu]

If it isnt the same, then copy the one I sent you over your file.

[dglienna]

Look at your start page, if it is vbf, then look in the hosts file

I guess nobody saw this?

[Pc_Madness]

I guess nobody saw this?

I saw it before you even posted it noob! :l33t:

[dee-u]

Panda ActiveScan reported that I'm infected with Adware/Ucmore...

[baja_yu]

I hate pandas

Kaspersky rules!

[dee-u]

Where can I find Kaspersky? Does it have Online scanner?

[baja_yu]

Probably on download.com or on twocows.net
I am not sure about the online scanner though.