Had to sneak on BYC, through the back door?

[ivan3]

I'll post this again for folks who are unable to run their antivirus/anti-malware software or think the machine is clean only to find more, well, trash and being redirected to who knows where.

There are several forums that are devoted to taking care of these exploits. One of the better ones is bleeping computer, another is techguy.org .

Most of these sites will have you download and run `hijackthis' from Trend Micro: http://us.trendmicro.com/us/search/?q=hijackthis and post the log created for examination. Often, the malware on your machine will prevent you from running this or other antivirus/anti-malware programs. To prevent this, rename the hijackthis program to `chickenscratch' (for example) and download it to your desktop, install/run/save the log to your desktop (might have to do this in Safe Mode).

Here is an example of a hijackthis log (same nasty nameserver that apparently found its way to BYC via Openx?) created by someone with a similar problem:

http://forums.techguy.org/virus-oth...1-search-engine-redirecting-ntdevice-exe.html (observe that the `client' did not follow through with the entire process - not a good idea - take the time to complete the process).

Here is a description of the program Combofix, that is often used for cleanup - with an extensive list of other forums that can be of help in stripping the machine of, ah, `trash':

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Follow directions given to a `T' and, good luck! (after your machine is `washed' create a restore point immediately and backup your system/registry on removable media - microsoft backup or backup and restore - depending on the version of win you're running).

This `flavor' of `trash' is nasty customer that has `wormed' its way into companies as big as Oracle.

 

[Beekissed]

I have been having the very same problem since this whole episode. I can now only get on these sites through Firefox but would love to go back to my old setup. Whatever this was it gave my computer a big ol' virus as well and I will be sending it to the shop when I can afford it.

My IE now comes up with "Internet Exploiter/Exploder" on it instead of "Internet Explorer" on the tool bar.

I checked out the whole Hijackthis process and it is just too complicated for an oldster like myself, so money will flow to get this fixed.

I also have had problems with my email since this thing....my email I've had for many a long year was used to send out tons of spam to everyone on my address book...some Canadian pharmacy ads and such.

Any idea how to avoid this in the future?

 

[gritsar]

Beekissed, I'm sorry you had the same sort of trouble. I was fortunate in that I got my computer fixed and the programs and software needed to keep it from happening again in the future for free. Unfortunately, I also find the how-to a bit too complicated for my brain but at least they are in place. The Malwarebytes is simple, as simple as the anti-virus to use, so I've got that down pat (just have to remember to start it each night). The Combofix? Not so simple. I do know that in the end the tech. had to go into my computers processes (something I would never dare do) and work for hours removing the trash.
Good luck on getting yours fixed.

 

[Nifty-Chicken]

Bee, did you try the suggestions here: https://www.backyardchickens.com/forum/viewtopic.php?pid=4836194#p4836194

 

[ivan3]

The degree of difficulty is a function of the time needed to review the FAQ's, on the forums listed above, the amount of ink/toner needed to print out instructions in greyscale/draft mode - don't waste any more ink/toner than you have to- (keep handy for review and make notes on), and the amount of time shutting down/rebooting/installing and running the software/scanning the machine/. The sites above use volunteers to walk you through it (why I listed them). Removing registry entries specific to the initial intrusion is fairly adequate if one's machine is otherwise unsullied. However, usually, once in the door, injection of other crud usually ensues and, if one's system has been previously infected, it is advisable to seek a `broad spectrum' treatment (create an account post the hijackthis log and follow the instructions from the person working your `ticket').

I don't suggest anyone run combofix (or similiar software) on their own unless they spend a lot of time with their head `under the hood'.

If you trust the repair shop, and have the money to support the local business, by all means throw the `box' to the boys/girls and let them hose it off.

ed: sp.

 

[gritsar]

Quote:
The tech. left the combofix on my puter in case it was ever needed again, but I told her to hide it somewhere so it would never be tinkered with, should my DH ever decide he knows more about computers than he really does.