petertron

i'm going to download these: Malwarebytes' Anti-Exploit McShield Unchecky (foistware??) i must admit, i have windows update turned off, as i recall once i had an update and it buggered up things and i had to roll it back! i'm starting to see that this should be on at all times. as for windows firewall, does this do a decent enough job, or would you say there are better 3rd party ones out there?

excellent! so i shall go ahead and delete frst, combifix & zoek (and associated txt files)? i am reading through what you just posted. at the moment, i have: windows firewall avast (free) malwarebytes (free) ccleaner auslogics adblocker+ shall i continue reading the posted links in my own time before discussing the downloading of the recommended software? after that, run delfix?

it seems fine. restarts booting ff, chrome & ie don't show any bad stuff. i take it any background bad stuff was (hopefully) taken care of by the previous apps?

done. i'm still puzzled at how one text file edited on one pc can affect someone elses, without that edited file being given to them to run on their pc. how does that work? i'm grateful that it does, but still.. were my previous copied-and-pasted bad entries similar to what you found (and removed)?

done. chrome still has four russian items in the toolbar, but the homepage is default to google. firefox was (seemingly) working ok beforehand, but is reset now. one more thing: when i sent you previous txt files and you said you 'removed some bad entries', i was wondering how that would affect me. if you're editing my posted txt files on your pc, how would that edited information remove bad entries on my pc? unless you were physically on my pc, i don't see how these bad entries were removed.

i'm starting to understand the process by which you work with the finished logs. i was under the impression that these apps we have been using actually found bad entries and deleted them themselves at the same time you were seeking out bad entries, i was doing the same thing. with the previous FRST & Combifix logs, i was reading them a few times to spot bad entries. i should have mentioned that, but i thought "you're the profesional here, let him do his job without too many interuptions". i spotted these following entries in the zoek scan: ==== Firefox Start and Search pages ====================== user_pref("browser.search.selectedEngine", "ПоиÑк@Mail.Ru"); user_pref("keyword.URL", " ==== All HKCU SearchScopes ====================== {FFEBBF0A-C22C-4172-89FF-45215A135AC7} ?????@Mail.Ru Url="http://go.mail.ru/search?q={SearchTerms}&fr=ntg" ==== shortcuts in Quick Launch ====================== C:\Users\peter tron\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk - C:\Program Files\Internet Explorer\iexplore.exe http://www.mail.ru/cnt/8136 ==== shortcuts After Repair ====================== C:\Users\peter tron\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk - C:\Program Files\Internet Explorer\iexplore.exe zoek-results.log

what did you make of the log files, what happened? did you see any problems there? i read through them and noticed some Mail.Ru / http://orbevod.ruevidence within those logs. there is something though: while the process was going, i had an icon appear on my desktop called 'the internet that looked like the internet explorer logo. at some point during those scans, internet explorer overid firefox to become my primary web browser. when i click on it, it goes to the smartin.ru home page. i have google chrome as my backup secondary browser, and that is still controlled by smartinf.ru. so both google chrome and internet explorer are still hijacked by the smartinf.ru homepage.

here you go! ComboFix.txt

ok, my pc restarted and i have a fixlog file in my downloads folder, uploading now. just a heads up: i'm shooting off to work at 18:00 and i'll be back at 20:00 Fixlog.txt

ah, got it! Addition.txt FRST.txt

hey twineagle, cheers for getting back to me erm, i can't seem to locate the 'attach' button for the files

hello all! long story short, i performed a 'schoolboy error' and clicked a link that installed rubbish on my browser. i have managed to manually fix the browser so it is no longer hijacked. i have removed the Mail.Ru add-on from firefox. i have managed to uninstall the program related to Mail.Ru / smartinf.ru. i have run mawarebytes & avast. now everything seems ok, but... i still have a problem, and i am hoping someone here can help. upon restarting, firefox automatically boots, even though it is not supposed to, and i have checked msconfig. i have discovered (by running a diagnostic startup) that there is a problem when i click the os to boot on startup. when it boots up, it automatically boot firefox with the smartinf.ru homepage (even though clicking the google homepage button gets rid of it). i have discovered the problem, but i require assisstance in remedying it. i have attached a jpeg of my msconfig, and you will notice the command line that is highlighted for the os has been replaced by russian text. how is this resolved? br barry