[SweetTech]

This is a real pain in the rear.

We Need to Run a Batch Script

• Press the Windows Logo in the bottom left corner of your screen.
• In the box, enter notepad and press Enter.
• Highlight the contents of the following codebox, and copy and paste that text into notepad.
  

  @echo off
  attrib -r -h -s "C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS"
  attrib -r -h -s "C:\Windows\SysNative\drivers\etc\hosts"
  attrib -r -h -s "C:\Windows\SysWOW64\drivers\etc\hosts"
  ren "C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS" hosts.bak
  ren "C:\Windows\SysNative\drivers\etc\hosts" hosts.bak
  ren "C:\Windows\SysWOW64\drivers\etc\hosts" hosts.bak
  del /q /f "C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS"
  del /q /f "C:\Windows\SysNative\drivers\etc\hosts"
  del /q /f "C:\Windows\SysWOW64\drivers\etc\hosts"
  echo 127.0.0.1 localhost > "C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS"
  echo 127.0.0.1 localhost > "C:\Windows\SysNative\drivers\etc\hosts"
  echo 127.0.0.1 localhost > "C:\Windows\SysWOW64\drivers\etc\hosts"
  ipconfig /flushdns
  del %0

• Select File -> Save.
• Press the Desktop button on the left side of the save dialog.
• In the box, type in Fix.bat.
• Press .
• Close Notepad.
• Right click on your desktop, and choose .
• Press Yes if prompted by User Account Control.

Double click on Fix.bat


Let me know if you're still experiencing redirects.

[Advertisements]

Ran it. Will report back soon.

[Matt Smith]

Ran it. Will report back soon.

[SweetTech]

Okay.

[Matt Smith]

Just got redirected.

[SweetTech]

Hi!

When you've been running these fixes, you've had Spybot Search and Destroyed Disabled correct?

Do you recongize this file?

OTL Fix

We need to run an OTL Fix

Note: If you have Malwarebytes 1.6 or higher installed please disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :Processes
  KILLALLPROCESSES
  :OTL
  O1 - Hosts: 184.95.41.155 www.google-analytics.com.
  O1 - Hosts: 184.95.41.155 ad-emea.doubleclick.net.
  O1 - Hosts: 184.95.41.155 www.statcounter.com.
  O4 - HKLM..\Run: [KeyExtender.exe] C:\Program Files (x86)\KeyExtender\KeyExtender.exe -Hide File not found
  [2012/01/11 03:01:38 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
  :Reg
  
  :Files
  dir /s /a "C:\Users\Mafu\AppData\Roaming\redsn0w" /c
  echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
  echo,Y|cacls "C:\Windows\SysNative\drivers\etc\hosts" /G everyone:f /c
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  [EMPTYJAVA]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

[Matt Smith]

Hi!

When you've been running these fixes, you've had Spybot Search and Destroyed Disabled correct?
Yes. I actually don't have Spybot installed at the moment.

Do you recongize this file?
What file?

OTL Fix

We need to run an OTL Fix
The script immediately results in a Cannot create windows hosts file or something like that, and doesn't progress.

[SweetTech]

Hi!

This is the file that i'm inquiring about:

C:\Users\Mafu\AppData\Roaming\redsn0w

Try this running this OTL fix first then the second one below.

We need to run an OTL Fix

Note: If you have Malwarebytes 1.6 or higher installed please disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :Files
  echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
  echo,Y|cacls "C:\Windows\SysNative\drivers\etc\hosts" /G everyone:f /c
  :Commands
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  [EMPTYJAVA]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

--------

We need to run an OTL Fix

Note: If you have Malwarebytes 1.6 or higher installed please disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :Processes
  KILLALLPROCESSES
  :OTL
  O4 - HKLM..\Run: [KeyExtender.exe] C:\Program Files (x86)\KeyExtender\KeyExtender.exe -Hide File not found
  [2012/01/11 03:01:38 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
  O1 - Hosts: 184.95.41.155 www.google-analytics.com.
  O1 - Hosts: 184.95.41.155 ad-emea.doubleclick.net.
  O1 - Hosts: 184.95.41.155 www.statcounter.com.
  :Reg
  
  :Files
  echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
  echo,Y|cacls "C:\Windows\SysNative\drivers\etc\hosts" /G everyone:f /c
  ipconfig /flushdns /c
  :Commands
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  [EMPTYJAVA]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

[Matt Smith]

C:\Users\Mafu\AppData\Roaming\redsn0w is a file used to Jailbreak my ipod that I had.
Running OTL... now.

[Matt Smith]

I run into this error upon running the first script: "cannot create file C:\Windows\System32\drivers\etc\Hosts".
OTL status bar is sitting at "Resetting Hosts File. Do not interrupt". Don't know if it is actually making progress or not.

[SweetTech]

How long has it been sitting at the progress bar like that?

[Matt Smith]

Still waiting. So it's been running since my last posts, about.. 21mins.

[SweetTech]

Hi!

Can you exit out of that window and try and see if this script will run for you.

I'm looking into a few things.

OTL Fix

We need to run an OTL Fix

Note: If you have Malwarebytes 1.6 or higher installed please disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :OTL
  O1 - Hosts: 184.95.41.155 www.google-analytics.com.
  O1 - Hosts: 184.95.41.155 ad-emea.doubleclick.net.
  O1 - Hosts: 184.95.41.155 www.statcounter.com.
  O1 - Hosts: 184.95.41.155 www.google-analytics.com
  O1 - Hosts: 184.95.41.155 ad-emea.doubleclick.net
  O1 - Hosts: 184.95.41.155 www.statcounter.com
  :Reg
  
  :Files
  :Commands
  [CreateRestorePoint]
  [emptytemp]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

[Matt Smith]

Same result. Cannot Create File ..\blah\blah\Hosts.
And now I cant get Java to work. Hmm.. Never had so many small problems.

Correction: Java is working in applications such a Minecraft, but Firefox cannot install Java it seems.

Edited by Matt Smith, 04 February 2012 - 04:00 AM.

[SweetTech]

Hi!

Please run this utility for me:

AVP Tool by Kaspersky

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

Click the cog in the upper right



Select down to and including your main drive, once done select the Automatic scan tab and press Start Scan


Allow AVP to delete all infections found
Once it has finished select report tab (last tab)
Select Detected threats report from the left and press Save button
Save it to your desktop and attach to your next post


Now the Analysis

Rerun AVP and select the Manual Disinfection tab and press Start Gathering System Information



On completion click the link to locate the zip file to upload and attach to your next post

[Matt Smith]

Just finished the scan, just now got redirected while clicking "Reply". The Manual Disinfect file is attached to next post.

Detected Threats:
Status: Deleted (events: 3)
2/5/2012 8:10:54 PM Deleted unknown threat not-a-virus:HEUR:HackTool.AndroidOS.FaceNiff.a C:\Program Files (x86)\GameSpy Arcade\Custom\classes.dex Medium
2/5/2012 8:44:12 PM Deleted Trojan program Backdoor.Win32.ZAccess.aug C:\Windows\assembly\GAC_32\Desktop.ini High
2/5/2012 8:44:13 PM Deleted virus HEUR:Backdoor.Win64.Generic C:\Windows\assembly\GAC_64\Desktop.ini High

Edited by Matt Smith, 06 February 2012 - 04:59 AM.