Help? keep getting redirected..

[Reevesith]

New problem,  I keep getting redirected to "search" sites & pop-ups to either fake adds or virus ware, Ran spybot, avast, no luck, Tried searching but luck.. any info/help is greatfull..  thank you for your time.

[Ianki]

install and run malware bytes in safemode with networking.

It'll get rid of it.  I think that's the same fake virus detection spyware i had a couple weeks ago.

[CaffeinePowered]

install and run malware bytes in safemode with networking.

It'll get rid of it.  I think that's the same fake virus detection spyware i had a couple weeks ago.

Also spybot

[Vlambo]

1. Download and run RKill
2. Install/Run Malwarebytes
3. ????
4. Profit

[Reevesith]

thanks for the help @w@ that was heeeeeell

[Reevesith]

Bumps

[CaffeinePowered]

Did you retry the same steps you took before?

[Reevesith]

Yeah, pretty sure its the reason why I got the last virus, had it in safe mode & ran Malwarebytes it looked like it got but no. ><

[Vandamguy]

check your hosts file.

c:\windows\system32\drivers\etc\

you'll have to press alt in explorer , go to tools> folder options> tab called view > scroll down that list of check boxes and check "show hidden files" and uncheck "hide protected operating system files"

double click on hosts , open with notepad.

if there's anything in there except for

Code:

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
#    127.0.0.1       localhost
#    ::1             localhost

127.0.0.1 localhost

delete everything. file can be blank.
save , win.

unless the virus has removed you permissions to edit said file.
in that case open Command prompt as an administrator (not even sure what OS you're running)
type: cd c:\windows\system32\drivers\etc\
type: cacls hosts /g "your account name":f
are you sure ? y/n

then you can delete the hosts file completely , then make a new one in notepad, save a blank onto desktop , copy paste to \etc\, rename and remove the .txt extension.

you can go back to folder otpions and hide proteced system operating files again , they're sorta annoying.

[Reevesith]

Thank you for your help Vandamguy 

Alright I just did that, there was a list of sites but had "Start of entries inserted by Spybot - Search & Destroy"  & there seems to be 6 hosts backup files, that normal?

[Vandamguy]

its not abnormal , but they're unessecary.. the spybot entries were probably 'good' in a way that if you type a bad website , then you would get redirected to yourself. i prefer to just have it clean.

are you still getting redirected >?
 

[DragonEkarus]

if DA happens to be one of these site that you get redirected from 10 to 1 it's yet another advertising mess they created... So far my personal favorites are:
PDF Banner Ads (Yup, full blown PDF advertisements which if you were using firefox, would crash it)
Redirecting Banner Ads (Yes, they had this going for awhile)
Trojan Banner ads (No not the condom, the Malware)

[Reevesith]

Well so far no pop ups or redirected, so hoping its fixed, yeah avast would pick up the Banner ads, stopping it..
Tho the svchost.exe time to time eat up all the cpu

[Vandamguy]

Well so far no pop ups or redirected, so hoping its fixed, yeah avast would pick up the Banner ads, stopping it..
Tho the svchost.exe time to time eat up all the cpu

windows button + R > msconfig > services tab > checkmark "hide all MS services" > disable everything that isnt related to: wireless, antivirus, sound, or video.

[Reevesith]

what I see in the list line up @3@;

[Vandamguy]

i'd turn off
flexnet
logme
istall
windows card
java
live update
logmin
logmin
seaport
yahoo

[Reevesith]

damn it happen again :/

[Vandamguy]

lul find me on steam
http://steamcommunity.com/id/vandamguy/

[DragonEkarus]

I can't help but notice that mostly everything you listed says "Unknown" as the manufacturer but when I run it I only get "Unknown" on a few things

I hate to say it but that may be part of a virus Reeve >.=.<

[Reevesith]

Thats a good point there.