Solved Help with removing happili virus

[Dwarf]

I notice from the attached file that you have 2 copies of Java installed, one being the current version, but the other being version 22. This is the one that is out of date, however, because it is still on your system malware can still attach to it and make use of any holes that exist in its code. Please update it to the latest version, as malware can manifest itself by exploiting holes in applications such as this. Keeping them up to date is an important step towards protecting yourself.

Java Downloads for All Operating Systems

I recommend that you use the uninstaller to remove your current version first and then download and run both offline versions (as you have a 64-bit system, you will need both 32-bit and 64-bit versions of Java).

In addition to that, you need to update Adobe Reader X. The current version is 10.1.3, whereas you have version 10.1.2.

http://get.adobe.com/uk/reader/?promoid=BUIGO

Once you have done that, please run the Security Check program that Jacee mentioned again and post the report in your next post.

 

[weeksjr]

Hmmm... that's odd. I thought I was pretty good about staying on top of updates.... anyway, I've updated Java and Adobe now and have posted the results here.

Thanks!

 

[Jacee]

Make sure the proxy settings in Internet Explorer are disabled :
1) Under “Tools” in the browser tool bar select “Internet Options”.
2) In the “Internet Options” window that pops up, click the “Connections” tab at the top.
3) Click “LAN Settings” near the bottom of the “Connections” section.
4) If the “Proxy server” checkbox is marked with a check, click it to deselect/uncheck it.
5) Click “Ok” to close the “Local Area Network (LAN) Settings” window.
6) Click “Ok” to close the “Internet Options” window.
Reboot
Make sure "Proxy server" is still disabled under your LAN Settings.

Now, close down Firefox, right click on a "command" prompt to run as Administrator.

Copy/paste each of these lines in the command prompt and press the enter key:
ipconfig /flushdns
net stop dnscache
net start dnscache

Now, download HijackThis!
HijackThis - Trend Micro USA

Right click to run as Administrator. Click 'Do a System Scan and Save logfile'.
The HJT log will open in notepad. Copy and paste the log back here.

 

[weeksjr]

Ok, I did the instructions listed above and have run hijackthis and have attached the log.... At this point, this has gotten over my head so I don't even know what to look for anymore thanks again...

 

[Jacee]

Rescan with HJT, check this line:

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

Close all windows except HJT, then click 'fix checked'. Exit out of HJT.

Reboot your computer.

Connect to Firefox and see if a search still redirects you. Let me know.
If it does, I want you to unplug and reset your router.

 

[weeksjr]

Ok, I went ahead and cleared that line out of HJT, rebooted and then searched on google and opened about 30 windows, none of which were redirected so, I think it's fixed! Thanks so much!!!! If you don't mind typing a bit more, can you explain what the heck happened? I really don't do anything fishy on the internet and am pretty smart about what I open, etc so, I'm just wondering what might have put this on my PC (and when I say "this", is it a virus or something else?). How should I go about keeping it from happening again?

 

[Jacee]

You apparently clicked on a link or website that was running malicious code or script. See this Malware - Wikipedia, the free encyclopedia and How does a computer get infected with a virus or spyware?

Tips from MS for 'online safety' Online Safety Tips | Protect Kids and Family Online | Microsoft Security

 

[Jacee]

Delete Combofix now:

Click on the Start button and then select Run from the menu. This will open up the Run box.
Copy/Paste combofix /uninstall (Please note that there is a space between combofix and /uninstall), click on the OK button or Enter on your keyboard.
You can now delete the ComboFix.exe program from your computer.

(This program is continually updated and keeping it as a form of 'security' won't help you.)

Set a new/clean "Restore Point". http://www.sevenforums.com/tutorials/697-system-restore-point-create.html

 

[weeksjr]

Done and done. I haven't seen any redirection today so, can I assume that everything is completed? if so, thank you SOOOO much!!! (Well, still thank you SOOOOO much if we're NOT done too )

 

[weeksjr]

Noooooooooooooooooooo!!!!!!!!!!!!!!! I just got redirected again. Google search using FF. clicked the link and was directed to happili*. Went back, clicked link and went to the right page.... about to burn the laptop....

 

[Dwarf]

Take a look at this video.

 

[Jacee]

What link did you click? Just tell me the name, but don't post link's address.

 

[weeksjr]

It was for the local roller derby team here... the denver roller dolls but, it was the .com version not the .org

 

[Jacee]

Try the .org Denver Roller Dolls - the premier Denver Roller Derby League This is a legit site.

 

[weeksjr]

It just happened again this time with the website for Colorado National Monument....

 

[Jacee]

Download MiniToolBox and open it. Check the following boxes: Flush DNS, Reset IE Proxy Settings, Reset FF Proxy Settings If you have Firefox open, close it before you click the Go button.

 

[weeksjr]

Ok, I've run Minitoolbox and then done a few google searches and no redirects as of yet. I'll keep you posted. thanks for your patience and persistence!

 

[weeksjr]

Well, that didn't take long.... just happened again w/ happili....

 

[Jacee]

ArrrGH!!

Did you delete the old Combofix? Hopefully you did, so let's now download a newer version:

Download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

• Double click combofix.exe and follow the prompts.
• When finished, it will produce a log for you.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply
After rebooting ensure your Security applications have been re-enabled.

 

[weeksjr]

Ok, combofix take 2.... Yes, i did delete the old one when you mentioned it earlier in the post and it worked properly. Here's the log from the most recent run....