Solved Help with removing happili virus

[weeksjr]

Hi there!

Recently it seems as though my Google searches are being redirected to happili more and more often (and I think once to infomash?). Anyway, it seems as if people on here have been very helpful in helping folks remove this virus but, it also looks like the instructions vary on a system by system basis. I guess I'd like to join the queue and get some help getting this virus off of my system. I've seen requests for some files to begin the diagnosis so i've gone ahead and attached those files to save some time. Thanks for any help!

 

[marsmimar]

Hello weeksjr and welcome to Seven Forums.

I'm not a malware removal expert but while waiting for one of our experts to respond, you could try a few free on-demand scanners to see if they can remove it.

Malwarebytes | Hitman Pro | Superantispyware | Comodo Cleaning Essentials

If the scanner offers a link to update the data base, do so before running the scan. Then run a full scan rather than a quick scan. If any malware is discovered you will be given the opportunity to quarantine or remove. I'd suggest quarantine because you could reinstall if it turns out to be a false-positive and a necessary file. Please post back if this helps or not.

 

[weeksjr]

Hi there! Thanks for the advice. I'd actually already run Malwarebytes several times and it didn't come up w/ anything. I went ahead and did a scan w/ Hitman Pro and it found something that it thought was malware called neoasi.dll The only options that I had were to ignore it or delete it so, I went w/ delete. I've JUST rebooted and it doesn't look like deleting it had any bad effect on anything. As for the Happili redirect, it happened intermittently so, I can't say for sure or not if it's gone.

 

[Hanna 1]

Weeksjr
See the following thread:

http://www.sevenforums.com/system-security/224166-need-help-removing-happili-redirect-virus.html

Good luck

 

[weeksjr]

Hi! Yeah, I saw that other post and saw that the fix worked but, and of course now i can't remember where, I read somewhere that not everyone should run combofix b/c it could actually do more harm than good. That's what led me to posting my own post.... thought?

 

[weeksjr]

I just got redirected to Happili again so it looks like the malware I removed this AM did not do the trick....will following the instructions in the post from Hanna 1 work for my system or should I wait and get help? Thanks so much for any info!

 

[Golden]

Hi,

You are better off waiting for some help - I emailed Jacee and asked her to visit this thread. Look out for her replies.

Regards,
Golden

 

[weeksjr]

Standing by and thanks for all the help!!!

 

[Golden]

In case Jacee is otherwise engaged, I'll also ask Corinne to have a look at this for you.

Both Jacee and Corinne are professionally trained, and Microsoft recognised, malware removalists.

 

[Jacee]

Download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

• Double click combofix.exe and follow the prompts.
• When finished, it will produce a log for you.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
***A guide and tutorial on "How to use Combofix" can be found here:
A guide and tutorial on using ComboFix

IF CF won't run:
During the download, rename Combofix.exe to sVchost.exe

 

[weeksjr]

Hi Jacee!

Thanks for the post! I've followed the instructions you posted and here's the log file you requested. Please advise as to what you'd like me to do next.

Cheers!

 

[Jacee]

Next, flush the dirty DNS cache, and restore MS's Hosts file:
Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.
Double click on the flush.bat file to run it.Vista and Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.

After your computer reboots, I'd like you to scan your machine with ESET OnlineScan

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the
   
   button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on
      
      to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the
      
      icon on your desktop.
4. Check
   
5. Click the
   
   button.
6. Accept any security warnings from your browser.
7. Check
   
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
    
11. Push
    
    , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the
    
    button.
13. Push
    

 

[weeksjr]

Wow... that took a while! Anyway, the scan just finished and there were no threats found. Since that's the case, I couldn't do the last few steps (exporting the file) so I just grabbed a screenshot to show you. Anything else to be done? Thanks again so much for the help!

 

[Jacee]

Please download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

***TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB). Before running, it will stop Explorer and all other running apps. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.

Now let me know if you are still being redirected while searching in both FF and IE.

 

[weeksjr]

Ok, I went ahead and cleared all of the temp files. I was only getting redirected every now and again so, it will take a little while to confirm that it's worked but, so far so good! I'll post again when I know for sure. Thanks again so much for your help!

 

[weeksjr]

Hmmm... unfortunately, it doesn't look like I'm fixed entirely. In the 10 minutes of surfing I've done this AM, I've already had one redirection to a page that didn't actually load (the URL was totally wrong so, when I backed up and clicked the link again, it actually went to the right page) and then just got redirected to something called beesq. Help?

 

[Jacee]

Which browser (IE or FF) redirected you?



Download TDSSKiller and save it to your Desktop.

• Extract the file and run it.
• Once completed it will create a log in the root directory (usually C:\).
• Please post the contents of that log in your next reply.

 

[weeksjr]

Ok. Done and it looks to me as though it didn't find anything. Here's the log you requested. Thanks!

 

[Jacee]

Log looks okay! You didn't tell me which browser redirected you.

Did you set this "Manual Proxy Configuration" and enter "localhost" as the server and 8000 as the port in Firefox?
FF - prefs.js: browser.startup.homepage - hxxp://www.southpole.usap.gov/
FF - prefs.js: network.proxy.socks - 10.0.2.1
FF - prefs.js: network.proxy.socks_port - 8000

Download Security Check by screen317 from here http://screen317.spywareinfoforum.org/SecurityCheck.exe or here http://screen317.changelog.fr/SecurityCheck.exe
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt.
Please post the contents of that document.

 

[weeksjr]

Sorry. I just came back to the computer b/c I realized that I forgot to tell you that I'm using FF. I definitely set the homepage but the other things I didn't do myself. I had an IT person look at my PC and I *THINK* that's what he set a while ago. Should I remove them?

Anyway, I've run the next program and attached the file... no more re directions have happened recently but, I also haven't been on the computer much....