VIRUS ALERT

[mnementh]

OK I have a couple issues.

I'm not sure I can run as administrator. I'm not sure if I'm running it as me or the administrator.

What's UAC mean?

I didn't see a drives file or folder. And nothing that says etc folder.

I'm in XP does that matter?

O.K.

Again Bigdog and hopefully without causing offense, have you actually READ what Wiseguy and I have posted???

The folder you can't find is called DRIVERS, not drives!!!

Under normal conditions, if YOU can install programs without getting an administrator login, then you DO have administrator rights.

In our defence, I don't remember if either of us asked what your Operating System is!

As you are using XP, then UAC isn't an issue.

In Win 7 or Vista, UAC stands for User Account Control. This is Microsofts not so subtle method of telling it's millions of users that they are idiots and can't be trusted on a PC without asking interminable times if they REALLY want to do something. (It CAN be turned off, BTW).

XP, fortunately doesn't have this piece of crap installed.

O.K. let's find the Hosts file the easy way.

Open MY COMPUTER

Double click the local drive "C" icon

Go down the tree to the Windows folder and RIGHT click it.

From the pop up menu, select SEARCH

In the search box, click the "More Advanced Options" down arrow.

Tick the boxes for System, Hidden and Sub folders.

Now, in the very top file name box, type hosts

Click SEARCH

In the search results box, you should see one or more files with hosts in the name.

You are interested ONLY in the file called hosts and surprise, surprise, you will see the drivers/etc path as well.

RIGHT click hosts and select the OPEN option (Do NOT double click and do NOT select the Open containing folder option)

The OPEN WITH dialogue box will open and now you select Notepad.

Now follow Wiseguy's instructions.

Sandy

[Bigdog]

I was thinking you were running Vista. Then do this.

1. Open Notepad

2. Click on File and then on Open

3. Click the My Computer button

4. Double Click the Local Disk (C;)

5. Double Click the WINDOWS folder

6. Double Click the system32 folder

7. Double Click the drivers folder

8. Double Click the etc folder

9. Double Click the the hosts file

10. Now delete everything below # For example:

11. Click on File and then on Save

12. Close Notepad

OK I can do everything til I get to #7 there is no drivers folder visable.

[Bigdog]

OK I have a couple issues.

I'm not sure I can run as administrator. I'm not sure if I'm running it as me or the administrator.

What's UAC mean?

I didn't see a drives file or folder. And nothing that says etc folder.

I'm in XP does that matter?

O.K.

Again Bigdog and hopefully without causing offense, have you actually READ what Wiseguy and I have posted???

The folder you can't find is called DRIVERS, not drives!!!

Under normal conditions, if YOU can install programs without getting an administrator login, then you DO have administrator rights.

In our defence, I don't remember if either of us asked what your Operating System is!

As you are using XP, then UAC isn't an issue.

In Win 7 or Vista, UAC stands for User Account Control. This is Microsofts not so subtle method of telling it's millions of users that they are idiots and can't be trusted on a PC without asking interminable times if they REALLY want to do something. (It CAN be turned off, BTW).

XP, fortunately doesn't have this piece of crap installed.

O.K. let's find the Hosts file the easy way.

Open MY COMPUTER

Double click the local drive "C" icon

Go down the tree to the Windows folder and RIGHT click it.

From the pop up menu, select SEARCH

In the search box, click the "More Advanced Options" down arrow.

Tick the boxes for System, Hidden and Sub folders.

Now, in the very top file name box, type hosts

Click SEARCH

In the search results box, you should see one or more files with hosts in the name.

You are interested ONLY in the file called hosts and surprise, surprise, you will see the drivers/etc path as well.

RIGHT click hosts and select the OPEN option (Do NOT double click and do NOT select the Open containing folder option)

The OPEN WITH dialogue box will open and now you select Notepad.

Now follow Wiseguy's instructions.

Sandy

OK using this method I did finally find the ETC folder and I was able to find HOSTS in it.

This is the only thing it said in HOSTS.

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

I used Note pad to read this info. Other than that it's empty. There is no other info in this folder.

There is a file/folder under it called>>>>Imhosts.sam It will not open without knowing the program that created it.

[mnementh]

Do NOT try and open ANY file with the .sam extension.

They are usually security files that contain passwords, etc.

Your hosts file looks pretty much the same as mine on my home PC. and as I don't have the problems you seem to be suffering, it's probably OK. No doubt Wiseguy will have some input.

Again, I would suggest you try to run Smitfraudfix, remembering that option 2 is the clean mode, NOT option 1.

Sandy

[Bigdog]

I did the smitfraud and it didn't seem like much happened.

I did 1,2,5.

[wiseguy]

This is the only thing it said in HOSTS.

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

I used Note pad to read this info. Other than that it's empty. There is no other info in this folder.

There is a file/folder under it called>>>>Imhosts.sam It will not open without knowing the program that created it.

The LMHOSTS file does nothing (the .sam extension means sample in this case). Since it's obvious that your hosts file has not been compromised the redirects will be in the registry, an ActiveX application, or embedded in a system file. Sometimes not even the best anti-virus/spyware software cannot eradicate the intruder. It's sounding like it's time for you to format the hard drive and reinstall Windows XP.

[Kevinper]

Here on this site is what you will need to do and be able to get it done in short order:

http://www.bleepingcomputer.com/virus-r ... virus-soft

[Bigdog]

I read a system repair by booting from the XP disc is a better way to go without losing any info.

[wiseguy]

I read a system repair by booting from the XP disc is a better way to go without losing any info.

You can try that but it really doesn't do much more than the system restore that you have already done.

[Bigdog]

I did a "system" restore from the safe mode. I don't know if that did anything.

But my regular system restore won't let me restore because there are no restore points to use.

[Bigdog]

Microsoft can't protect the restore system or the restore points.

[Bigdog]

Here is the antivirus software tally.

Spyware Doctor starts up the fastest when opened. It runs its scan and finds bad things and deletes them.

AVG opens but has a hard time running the scan.

Malwarebytes antivirus won't even open for about 20 minutes.

I paid for Spyware Doctor.

The other 2 are free.

Kinda like taking free advice. What's it worth???

[Bigdog]

That virus has left an openeing that the 3 antivirus programs don't see. The same viruses keep coming back in. They can't stop it. My sound has been turned off again and the Microsoft Fix It can't Fix it anymore.

These antivirus progams all suck.