Click load

[bellla]

ok, did it, do I run the script now? should I restart first?

 

[ken545]

Try the script

 

[bellla]

so I did it and before it even finished (i think) it said something about connection and (judging by the screaming coming from my sons room he lost his connection)and it rebooted.

 

[ken545]

Go ahead and disable it again and let me know if when you go to that banking site if its still the scam one

 

[bellla]

...yes it's only on that one page.

 

[ken545]

Bello,

Boot to safemode and then do this, I am not convinced the DNS cache has been flushed


Go to Start > Run > Type CMD then enter, then at the command prompt type ipconfig /flushdns , then enter on your keyboard. You can copy and paste this in if it will be easier ipconfig /flushdns

If this still does not flush it out then I need to look further

 

[bellla]

Hello,
Ken I followed your instruction and I'm getting an error saying unable to query host name.

 

[bellla]

Hello again..
Good news...I went to the banking website and the pop up is GONE:thanks:
Something must have worked even though it gave me the error msgs!

 

[ken545]

Great.

Lets be sure, lets try it one more time. Do this with your network cable unplugged and from safemode, when you get to safemode, disable your Antivirus. Prior to Safemode disable the Teatimer in Spybot



Disable the TeaTimer, leave it disabled, do not turn it back on until we're done or it will prevent fixes from taking

• Run Spybot-S&D in Advanced Mode.
• If it is not already set to do this Go to the Mode menu select "Advanced Mode"
• On the left hand side, Click on Tools
• Then click on the Resident Icon in the List
• Uncheck "Resident TeaTimer" and OK any prompts.
• Restart your computer.<--You need to do this for it to take effect

Open OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :processes
  killallprocesses
  
  :OTL
  
  
  
  :Services
  
  :Reg
  
  :Files
  ipconfig /release /c
  ipconfig /renew /c
  ipconfig /flushdns /c
  
  
  
  
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [start explorer]
  [Reboot]

• Then click the Run Fix button at the top. <--Not run Scan
• Let the program run unhindered, reboot when it is done
• Then post the results of the log it produces.
• Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

 

[bellla]

Hi Ken,
Here is the log

All processes killed
========== PROCESSES ==========
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /release /c >
Windows IP Configuration
No operation can be performed on Local Area Connection while it has its media disconnected.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.bat deleted successfully.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.txt deleted successfully.
< ipconfig /renew /c >
Windows IP Configuration
No operation can be performed on Local Area Connection while it has its media disconnected.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.bat deleted successfully.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Could not flush the DNS Resolver Cache: Function failed during execution.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.bat deleted successfully.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: ALICIA
->Temp folder emptied: 246618 bytes
->Temporary Internet Files folder emptied: 54726 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 56572293 bytes
->Flash cache emptied: 1638 bytes

User: All Users

User: Damien Lis
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: isabella
->Temp folder emptied: 591868 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 7801045 bytes
->Flash cache emptied: 1790 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: ROBERT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Robert.HOME
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 586305 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 63.00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04252011_222135

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

 

[bellla]

..and the next one

All processes killed
========== PROCESSES ==========
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /release /c >
Windows IP Configuration
No operation can be performed on Local Area Connection while it has its media disconnected.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.bat deleted successfully.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.txt deleted successfully.
< ipconfig /renew /c >
Windows IP Configuration
No operation can be performed on Local Area Connection while it has its media disconnected.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.bat deleted successfully.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Could not flush the DNS Resolver Cache: Function failed during execution.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.bat deleted successfully.
C:\Documents and Settings\isabella\My Documents\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: ALICIA
->Temp folder emptied: 246618 bytes
->Temporary Internet Files folder emptied: 54726 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 56572293 bytes
->Flash cache emptied: 1638 bytes

User: All Users

User: Damien Lis
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: isabella
->Temp folder emptied: 591868 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 7801045 bytes
->Flash cache emptied: 1790 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: ROBERT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Robert.HOME
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 586305 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 63.00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04252011_222135

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

 

[ken545]

Bella, how are you doing with the fake window that opens when you go to your bank ?

 

[bellla]

Good morning.
it's gone I tried several times and it's no longer there. How were the scans?

 

[ken545]

Well, cant figure out why the DNS cache is not being flushed but it must have at least once somewhere along the line . Glad your not getting that bogus window no more.

How are things running now ?

 

[bellla]

hello
Ken everything seems back to normal, if not better. thank you so much for your patience. Would you sugest i keep those scans we downloaded for regular use?

 

[ken545]

Bella, thats great , glad things are better for you

Lets update your Java to make your system more secure

Go to your Control Panel and click on the Java Icon ( looks like a little coffee cup ) click on About and you should have Version 6 Update 22, if not proceed with the instructions.

Download the latest version Here save it, do not install it yet.

Java SE Runtime Environment (JRE)JRE 6 Update 21 <--The wording is confusing but this is what you need

• Go to your Add Remove Programs in the Control Panel and uninstall any previous versions of Java
• Reboot your computer
• Install the latest version

You can verify the installation Here






Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups

• 
  How did I get infected in the first place ?
  Read these links and find out how to prevent getting infected again.
• Tutorial for System Restore <-- Do this first to prevent yourself from being reinfected.
• WhattheTech
• Grinler BleepingComputer
• GeeksTo Go
• Dslreports

Safe Surfn
Ken

 

[bellla]

Ken,
I don't see java there at all?

 

[ken545]

I see it on your log, when you to to Start> Control Panel you cant see Java in there ?

C:\Program Files\Java <--What about here ? Open it and see if there is an update option

 

[bellla]

I found it it was an old version so I updated it. Also did the clean up.
Ken, do you think Rogers AV is sufficient, or should i get a different one?

 

[ken545]

Good Morning Bella,

I had an other helper look in and said that the reason we could not flush the DNS Cache is because the DNS Client was stopped, it has to be running



Go to Start> Run and type in services.msc > enter, then look for DNS Client, right click on it and select Automatic

As far as Rogers, not sure, I dont see to many people with it installed. If your unhappy with it you can uninstall it and try one of these other ones that are free, my self I use Norton Internet Security which includes AV and antispyware and also a firewall. There selling it for around $59 a year for 3 computers , your call if you want to go that route, I even saw it at Costco for $25
http://antivirus.norton.com/norton/...ho_sem_sy:us:ggl:en:e|kw0000060218|6426073396

Free Anti Virus Programs

• Free Avast 4 Home Edition
• Avira AntiVir® Personal Edition Classic
• AVG Free

Free Firewalls

• Zone Alarm
• Sygate Personal Firewall Free Edition
• Outpost Firewall Free

But you only need one so if you use one of the other ones than you need to uninstall Rogers

Ken