midan
asked on
I am unable to access youtube
As far as I am aware I am able to access all websites except youtube.
When I put the youtube address the page just does not load as if there is no internet connection. At the same time other pages come up without any problem.
I try to use google which offers me a cache copy. However if I click on a video again nothing happens.
Any idea what is happening?
When I put the youtube address the page just does not load as if there is no internet connection. At the same time other pages come up without any problem.
I try to use google which offers me a cache copy. However if I click on a video again nothing happens.
Any idea what is happening?
are you on a work network? - and IT admin may have blocked your access
Can you access www.hulu.com? If they are blocking youtube, most likely they are blocking hulu.com as well.
ASKER
badgermike- the pc is a single user laptop working off a home wireless broadband.
jdonaldson- I have no difficulty in accessing the website www.hulu.com
jdonaldson- I have no difficulty in accessing the website www.hulu.com
Can you open up a command prompt and run "ping www.youtube.com"? Does it list an ip address? Also, do you get 4 replies?
ASKER
This is what I get
Pinging www.youtube.com [64.46.38.208] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 64.46.38.208:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
Pinging www.youtube.com [64.46.38.208] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 64.46.38.208:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
From the command line type "ipconfig /flushdns" and try it again.
That IP returned when you pinged youtube.com is owned by a company called rackforce.com. Do you use any resources hosted by this company such as a vpn?
There may be a firewall, software or router, blocking access to this particular site. Check to make certain that the site hasn't been added to any of the blocked sites lists.
ASKER
This is what I get
"The requested operation requires elevation"
I know nothing about rackforce.
There was a malware that was interfering with the pc last week but I managed to get rid of it.
"The requested operation requires elevation"
I know nothing about rackforce.
There was a malware that was interfering with the pc last week but I managed to get rid of it.
Can you check and make sure you are not using a proxy?
From Internet Explorer go to:
Tools -> Internet Options -> Connections -> Lan Settings
Make sure "Use a proxy server for your lan" has not been checked.
From Internet Explorer go to:
Tools -> Internet Options -> Connections -> Lan Settings
Make sure "Use a proxy server for your lan" has not been checked.
Start > all programs > accesseries > right click on cmd & run as administrator
then > ipconfig /flushdns
type "services.msc" in opend cmd or start run box
stop DNS clint service, set startup mode to manual & try youtube again with internet.
then with cache
then > ipconfig /flushdns
type "services.msc" in opend cmd or start run box
stop DNS clint service, set startup mode to manual & try youtube again with internet.
then with cache
You might try resetting your hosts file:
http://www.funkytoad.com/index.php?option=com_content&id=13&showall=1
Good luck!!!
http://www.funkytoad.com/index.php?option=com_content&id=13&showall=1
Good luck!!!
You need to run "ipconfig /flushdns" in en elevated command prompt.
What is an elevated command prompt?
Elevated command prompt = open a Command Window in Administrator mode:
* clickStart
* click All Programs, thenAccessories
* right click on the Command Prompt option,
* on the drop down menu which appears, click on the Run as Administratoroption.
* If you haven’t disabled User Account Control (and you shouldn’t!) you will be asked for authorisation. Click the Continue button if you are the administrator or insert the administrator password.
What is an elevated command prompt?
Elevated command prompt = open a Command Window in Administrator mode:
* clickStart
* click All Programs, thenAccessories
* right click on the Command Prompt option,
* on the drop down menu which appears, click on the Run as Administratoroption.
* If you haven’t disabled User Account Control (and you shouldn’t!) you will be asked for authorisation. Click the Continue button if you are the administrator or insert the administrator password.
After launching en elevated command prompt, run the command below.
ipconfig /flushdns
You should be fine. If still no go, call your ISP for help.
ipconfig /flushdns
You should be fine. If still no go, call your ISP for help.
Did you have any luck with this yet?
ASKER
I got the message "successfully flushed the dns resolver cache".
Sadly still unable to access youtube. The other things also has not resolved the problem.
To understand the problem we need to determine what distinguishes the youtube website from alll the other websites or where it could be blocked other than by a firewall.
Sadly still unable to access youtube. The other things also has not resolved the problem.
To understand the problem we need to determine what distinguishes the youtube website from alll the other websites or where it could be blocked other than by a firewall.
Did you check the hosts file?
Can you try pinging www.youtube again and post the results? Also run the command tracert www.youtube.com and post the results. Before you run the ping or tracert command, will you turn off your windows firewall temporarily and re-enable after you run the commands?
ASKER
Phototropic I am not sure about downloading stuff I don't recognise. Is there something I can do with settings?
Idonaldson
For the ping command I got the following
ping www.youtube.com
Pinging www.youtube.com [64.46.38.208] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 64.46.38.208:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
For the tracert command I got the following
tracert www.youtube.com
Tracing route to www.youtube.com [64.46.38.208]
over a maximum of 30 hops:
1 3 ms 1 ms 1 ms 192.168.0.1
2 37 ms 35 ms 35 ms cr1.wewmai.uk.easynet.net [82.108.11.56]
3 31 ms 31 ms 32 ms fe2-0-0.ar11.bllon.uk.easy
3]
4 35 ms 37 ms 33 ms te0-6-0-0.er10.thlon.ov.ea
211]
5 32 ms 33 ms 35 ms 195.50.122.113
6 33 ms 35 ms 32 ms ae-34-52.ebr2.London1.Leve
7 102 ms 102 ms 103 ms ae-44-44.ebr1.NewYork1.Lev
8 102 ms 102 ms 101 ms ae-4-4.ebr1.NewYork2.Level
9 101 ms 102 ms 104 ms ae-1-100.ebr2.NewYork2.Lev
10 133 ms 127 ms 123 ms ae-2-2.ebr1.Chicago1.Level
11 123 ms 123 ms 124 ms ae-6-6.ebr1.Chicago2.Level
12 146 ms 159 ms 145 ms ae-3-3.ebr2.Denver1.Level3
13 173 ms 176 ms 179 ms ae-2-2.ebr2.Seattle1.Level
14 176 ms 213 ms 174 ms ae-2-52.edge1.Seattle3.Lev
15 180 ms 184 ms 176 ms BIG-PIPE-IN.edge1.Seattle3
50]
16 175 ms 176 ms 177 ms 66.163.78.77
17 176 ms 175 ms 176 ms ra2wh-tge1-1.vc.shawcable.
18 239 ms 239 ms 239 ms h64-251-80-26.bigpipeinc.c
19 200 ms 201 ms 200 ms cr1-1-1.kel2.rackforce.net
20 199 ms 207 ms 203 ms cr1-451.kel1.rackforce.net
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.
Trace complete.
Hostsxpert is a well-known and much used method of resetting the hosts file.
Another hosts file which is defensive is mvps:
http://www.mvps.org/winhelp2002/hosts.htm
Both these are known and trusted downloads. They are routinely recommended by experts here at ee, and I have used them many times myself.
Another hosts file which is defensive is mvps:
http://www.mvps.org/winhelp2002/hosts.htm
Both these are known and trusted downloads. They are routinely recommended by experts here at ee, and I have used them many times myself.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
The proxy server box was not checked.
In the file imhosts there was no mention of you tube.
I will attempt to download hostsxpert to see if does anything.
If YouTube is a blocked site where else other in the firewall folder would it show?
In the file imhosts there was no mention of you tube.
I will attempt to download hostsxpert to see if does anything.
If YouTube is a blocked site where else other in the firewall folder would it show?
ASKER
I have downloaded hostsxpert and there is shown theyoutube address along with google addresses of other countries. Is this an MS plot?
I tried restoring hosts file but I got message Error cannot create file C:\windows\systems32\drive
Please let me if there is something I need to do now?
I tried restoring hosts file but I got message Error cannot create file C:\windows\systems32\drive
Please let me if there is something I need to do now?
Take a look here:
http://www.bleepingcomputer.com/forums/topic295453.html
"...•Open the folder and double-click HostsXpert.exe to run the program.
•If using Vista, right-click on it and Run As Administrator.
•Click "Restore MS Hosts File".
•Click OK at the confirmation box.
•Click "Make Read Only".
•Click the X to exit the program..."
or here:
http://support.microsoft.com/kb/923947
"...Click StartCollapse this imageExpand this image, click All Programs, click Accessories, right-click Notepad, and then click Run as administrator.
Collapse this imageExpand this imageIf you are prompted for an administrator password or for a confirmation, type the password, or click Allow or Yes.
Open the Hosts file or the Lmhosts file, make the necessary changes, and then click Save on the Edit menu. If using Windows 7, you will need to click Save on the File menu..."
http://www.bleepingcomputer.com/forums/topic295453.html
"...•Open the folder and double-click HostsXpert.exe to run the program.
•If using Vista, right-click on it and Run As Administrator.
•Click "Restore MS Hosts File".
•Click OK at the confirmation box.
•Click "Make Read Only".
•Click the X to exit the program..."
or here:
http://support.microsoft.com/kb/923947
"...Click StartCollapse this imageExpand this image, click All Programs, click Accessories, right-click Notepad, and then click Run as administrator.
Collapse this imageExpand this imageIf you are prompted for an administrator password or for a confirmation, type the password, or click Allow or Yes.
Open the Hosts file or the Lmhosts file, make the necessary changes, and then click Save on the Edit menu. If using Windows 7, you will need to click Save on the File menu..."
ASKER
It has not been possible to prevent the error message coming up when trying to restore or following microsoft support.
The problem must be to do with hosts file because all the web addresses listed cannot be accessed.Most I do not recognise but www.bing.com was there .All show address 64.46.38.208.
The problem must be to do with hosts file because all the web addresses listed cannot be accessed.Most I do not recognise but www.bing.com was there .All show address 64.46.38.208.
Download this hosts fix from Bleeping Computer:
http://download.bleepingcomputer.com/bats/hosts-perm.bat
"...When the file has finished downloading, double-click on the hosts-perm.bat file that is now on your desktop. If Windows asks if you if you are sure you want to run it, please allow it to run. Once it starts you will see a small black window that opens and then quickly goes away. This is normal and is nothing to be worried about. You should now be able to access your HOSTS file..."
Try Hostsxpert again. Or follow Microsoft's instructions here:
http://support.microsoft.com/kb/972034
http://download.bleepingcomputer.com/bats/hosts-perm.bat
"...When the file has finished downloading, double-click on the hosts-perm.bat file that is now on your desktop. If Windows asks if you if you are sure you want to run it, please allow it to run. Once it starts you will see a small black window that opens and then quickly goes away. This is normal and is nothing to be worried about. You should now be able to access your HOSTS file..."
Try Hostsxpert again. Or follow Microsoft's instructions here:
http://support.microsoft.com/kb/972034
ASKER
Before I do anything please explain what is a hosts file and what is happening to prevent the websites listed being accessed.
The hosts file is a text file which associates host names (eg: www.youtube.com) with ip addresses.
If your hosts file has been hijacked by malware, it may be used to block access to av sites, or to redirect you to rogue sites when you type urls of well-known sites.
A typical Microsoft Vista hosts file would look like this:
http://download.bleepingcomputer.com/misc/host-files/windows-vista/hosts
You Tube uses multiple servers and so has several ip addresses, such as the following:
208.65.153.238
208.65.153.251
208.65.153.253
208.117.236.69
Your hosts file has been hijacked by malware so that when you type "www.youtube.com" your computer attempts to connect to 64.46.38.208 rather than an address in the range of those above.
You need to reset your hosts file in order for your internet connectivity to go back to normal.
Since the malware has locked permissions on your hosts file, you need to run the download from Bleeping Computer in order to reset the permissions for your hosts file. Once you have done that, you can change your hosts file back to the default using Hostsxpert, or the Microsoft tool I linked to above:
http://support.microsoft.com/kb/972034
Good luck!!!
If your hosts file has been hijacked by malware, it may be used to block access to av sites, or to redirect you to rogue sites when you type urls of well-known sites.
A typical Microsoft Vista hosts file would look like this:
http://download.bleepingcomputer.com/misc/host-files/windows-vista/hosts
You Tube uses multiple servers and so has several ip addresses, such as the following:
208.65.153.238
208.65.153.251
208.65.153.253
208.117.236.69
Your hosts file has been hijacked by malware so that when you type "www.youtube.com" your computer attempts to connect to 64.46.38.208 rather than an address in the range of those above.
You need to reset your hosts file in order for your internet connectivity to go back to normal.
Since the malware has locked permissions on your hosts file, you need to run the download from Bleeping Computer in order to reset the permissions for your hosts file. Once you have done that, you can change your hosts file back to the default using Hostsxpert, or the Microsoft tool I linked to above:
http://support.microsoft.com/kb/972034
Good luck!!!
ASKER
We have got to the heart of the problem but bleeping computer download has not resolved the situation where the functions of hostsxperts have been immobilised. MS support fix it didn't work.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I did this and I opened the file lmhosts.There was nothing there like I found with hostsxperts. What am I supposed to change?
C:\Windows\System32\Driver
hosts
lmhosts.sam
networks
protocol
services
The file you are concerned with is the first one. It is a text file named "hosts".
Follow the proceedure outlined in my last post:
Open notepad as an administrator;
Select the hosts file and open it;
Restore it to the Microsoft default:
http://download.bleepingcomputer.com/misc/host-files/windows-vista/hosts
You should then be able to access youtube.
hosts
lmhosts.sam
networks
protocol
services
The file you are concerned with is the first one. It is a text file named "hosts".
Follow the proceedure outlined in my last post:
Open notepad as an administrator;
Select the hosts file and open it;
Restore it to the Microsoft default:
http://download.bleepingcomputer.com/misc/host-files/windows-vista/hosts
You should then be able to access youtube.
ASKER
The bad news is that the hosts file appears to be missing. Where do we go from here?
We will have to create a new hosts file.
Hostsxpert can do this for you:
Rt.click on the Hostsxpert icon. Select "run as administrator". Click on "restore ms hosts file".
If that does not work, try this:
Download the Vista default hosts file from here to your desktop:
http://download.bleepingcomputer.com/misc/host-files/windows-vista/hosts
File - Save as - call the file "hosts" and save it to your desktop.
Now do the following: Go to and open the C:\Windows\system32\driver
"...Right-click an open space in the C:\Windows\system32\driver
point to New, click Text Document,
type hosts, and then press ENTER.
Click Yes to confirm that the file name extension will not be txt.
Open the new created hosts file in a text editor, for example, in the Notepad.
Copy the Vista default hosts file on your desktop to the hosts file;
Save and close the file..."
excerted from: http://support.microsoft.com/kb/972034
Hostsxpert can do this for you:
Rt.click on the Hostsxpert icon. Select "run as administrator". Click on "restore ms hosts file".
If that does not work, try this:
Download the Vista default hosts file from here to your desktop:
http://download.bleepingcomputer.com/misc/host-files/windows-vista/hosts
File - Save as - call the file "hosts" and save it to your desktop.
Now do the following: Go to and open the C:\Windows\system32\driver
"...Right-click an open space in the C:\Windows\system32\driver
point to New, click Text Document,
type hosts, and then press ENTER.
Click Yes to confirm that the file name extension will not be txt.
Open the new created hosts file in a text editor, for example, in the Notepad.
Copy the Vista default hosts file on your desktop to the hosts file;
Save and close the file..."
excerted from: http://support.microsoft.com/kb/972034
ASKER
I get to open etc folder.I right click on the open space,I point to new but I do not see text document I see folder.So I went to accessories notepad and found new text document there.Then I copied vista hosts file.So there is now a hosts file but I think in .txt.Trying out hostsxperts nothing has changed.Isn't the problem with lmhosts which contains the youtube address.
OK. To edit the lmhosts file, follow the Microsoft proceedure here:
http://support.microsoft.com/default.aspx?scid=kb;en-us;923947
"...Click Start , click All Programs, click Accessories, right-click Notepad, and then click Run as administrator.
If you are prompted for an administrator password or for a confirmation, type the password, or click Allow or Yes.
Open the Hosts file or the Lmhosts file (File - open - C:\Windows\System32\Driver
A default lmhosts file can be seen here:
http://en.wikipedia.org/wiki/LMHOSTS
Re: the hosts file. Try downloading and running the following:
http://www.mvps.org/winhelp2002/hosts.htm
Download the zip file to your desktop: http://www.mvps.org/winhelp2002/hosts.zip
Unzip (extract) the included files in the "hosts.zip"
Right-click on "mvps.bat" and select: Run as Administrator
Double-click on "mvps.bat"
This is a defensive hosts file which I use a lot on client machines.
http://support.microsoft.com/default.aspx?scid=kb;en-us;923947
"...Click Start , click All Programs, click Accessories, right-click Notepad, and then click Run as administrator.
If you are prompted for an administrator password or for a confirmation, type the password, or click Allow or Yes.
Open the Hosts file or the Lmhosts file (File - open - C:\Windows\System32\Driver
A default lmhosts file can be seen here:
http://en.wikipedia.org/wiki/LMHOSTS
Re: the hosts file. Try downloading and running the following:
http://www.mvps.org/winhelp2002/hosts.htm
Download the zip file to your desktop: http://www.mvps.org/winhelp2002/hosts.zip
Unzip (extract) the included files in the "hosts.zip"
Right-click on "mvps.bat" and select: Run as Administrator
Double-click on "mvps.bat"
This is a defensive hosts file which I use a lot on client machines.
ASKER
What comes up with hostsxperts namely showing youtube is not in the lmhosts file. It must be in the hosts file but the hosts file appears to be missing.
I suspect that the original hosts file is now hidden.Where could it be?
I suspect that the original hosts file is now hidden.Where could it be?
It sounds as if some malware has locked your hosts file.
Try this:
Open a run box by holding down the Windows key and pressing "R";
In the run box, type the following:
notepad c:\windows\system32\driver
Does your hosts file appear? If so, it is locked and we must delete it and then recreate it.
I found a proceedure to do this from this thread:
http://www.dslreports.com/forum/r23042263-Hosts-file-attributes-set-to-system-and-hidden~start=40
It involves using the File Assassin tool in Malwarebytes to delete the rogue file.
Please download Malwarebytes' Antimalware to your desktop:
http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button
Install the program. Rt. click the icon and click "run as administrator". Click the "More Tools" tab. Under File Assassin, click "Run tool". Navigate to C:\Windows\System32\Driver
Once the file has been deleted, attempt to create a hosts file again.
Good luck!!!
Try this:
Open a run box by holding down the Windows key and pressing "R";
In the run box, type the following:
notepad c:\windows\system32\driver
Does your hosts file appear? If so, it is locked and we must delete it and then recreate it.
I found a proceedure to do this from this thread:
http://www.dslreports.com/forum/r23042263-Hosts-file-attributes-set-to-system-and-hidden~start=40
It involves using the File Assassin tool in Malwarebytes to delete the rogue file.
Please download Malwarebytes' Antimalware to your desktop:
http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button
Install the program. Rt. click the icon and click "run as administrator". Click the "More Tools" tab. Under File Assassin, click "Run tool". Navigate to C:\Windows\System32\Driver
Once the file has been deleted, attempt to create a hosts file again.
Good luck!!!
ASKER
Yes the hosts file appears.
Last time I tried to create a new hosts file I only created a text document.Will it be ok this time?
Is there any way to unlock the hosts file?
Last time I tried to create a new hosts file I only created a text document.Will it be ok this time?
Is there any way to unlock the hosts file?
If the hosts file appears, then it is clear that it has been locked by malware. According to the post I linked to, several others have had this problem. If you scan through the three pages of posts, you will see that many things were tried, but nothing worked except the File Assassin proceedure outlined above.
Have you scanned your computer for malware? What av software do yoiu have in place?
I would recommend running some scans and removing what is found, and then trying the above proceedure to unlock your hosts file.
Please download Malwarebytes Antimalware to your desktop:
http://www.malwarebytes.org/mbam.php
Install it. Update it. Then run it.
When it completes, review what it has found, then click on "remove selected". Please post the scan log here.
Also, please download Hitman Pro to your desktop.
http://www.surfright.nl/en/downloads
There are 32-bit and 64-bit versions of this program. If you are not sure what your o/s is, right click on "My Computer" and select "Properties". Download the appropriate version and run it.
If Mbam will not update, or Hitman Pro will not run, it may mean that they are also blocked by your rogue hosts file. If that is the case, we shall have to reconsider.
Please post the scan results here.
Have you scanned your computer for malware? What av software do yoiu have in place?
I would recommend running some scans and removing what is found, and then trying the above proceedure to unlock your hosts file.
Please download Malwarebytes Antimalware to your desktop:
http://www.malwarebytes.org/mbam.php
Install it. Update it. Then run it.
When it completes, review what it has found, then click on "remove selected". Please post the scan log here.
Also, please download Hitman Pro to your desktop.
http://www.surfright.nl/en/downloads
There are 32-bit and 64-bit versions of this program. If you are not sure what your o/s is, right click on "My Computer" and select "Properties". Download the appropriate version and run it.
If Mbam will not update, or Hitman Pro will not run, it may mean that they are also blocked by your rogue hosts file. If that is the case, we shall have to reconsider.
Please post the scan results here.
ASKER
Result of malwarebytes:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5768
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019
15/02/2011 19:14:39
mbam-log-2011-02-15 (19-14-39).txt
Scan type: Quick scan
Objects scanned: 163363
Time elapsed: 6 minute(s), 51 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 142
Registry Values Infected: 12
Registry Data Items Infected: 0
Folders Infected: 18
Files Infected: 78
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{3
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_CLASSES_ROOT\CLSID\{8
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{1
HKEY_CLASSES_ROOT\CLSID\{1
HKEY_CLASSES_ROOT\CLSID\{2
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{3
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{5
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\CLSID\{6
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{7
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{7
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{7
HKEY_CLASSES_ROOT\CLSID\{8
HKEY_CLASSES_ROOT\CLSID\{8
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{9
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{9
HKEY_CLASSES_ROOT\FunWebPr
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{9
HKEY_CLASSES_ROOT\ScreenSa
HKEY_CLASSES_ROOT\ScreenSa
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{A
HKEY_CLASSES_ROOT\CLSID\{A
HKEY_CLASSES_ROOT\CLSID\{A
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\CLSID\{B
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{C
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{C
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{D
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{E
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\Typelib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\SM502_22
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{7
HKEY_CLASSES_ROOT\CLSID\{D
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
c:\program files\funwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\scree
c:\program files\funwebproducts\scree
c:\program files\mywebsearch (Adware.MyWebSearch) -> Delete on reboot.
c:\program files\mywebsearch\bar (Adware.MyWebSearch) -> Delete on reboot.
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\Avat
c:\program files\mywebsearch\bar\Game
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\Mess
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Over
c:\program files\mywebsearch\bar\Sett
Files Infected:
c:\Program Files\MyWebSearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\Users\audrey dangoor\AppData\LocalLow\m
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\Windows\System32\f3PSSa
c:\Users\audrey dangoor\AppData\Roaming\mi
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\Insta
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\Avat
c:\program files\mywebsearch\bar\Game
c:\program files\mywebsearch\bar\Game
c:\program files\mywebsearch\bar\Game
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\Mess
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Over
c:\program files\mywebsearch\bar\Sett
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5768
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019
15/02/2011 19:14:39
mbam-log-2011-02-15 (19-14-39).txt
Scan type: Quick scan
Objects scanned: 163363
Time elapsed: 6 minute(s), 51 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 142
Registry Values Infected: 12
Registry Data Items Infected: 0
Folders Infected: 18
Files Infected: 78
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{3
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_CLASSES_ROOT\CLSID\{8
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{1
HKEY_CLASSES_ROOT\CLSID\{1
HKEY_CLASSES_ROOT\CLSID\{2
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{3
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{5
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\CLSID\{6
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{7
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{7
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{7
HKEY_CLASSES_ROOT\CLSID\{8
HKEY_CLASSES_ROOT\CLSID\{8
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{9
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{9
HKEY_CLASSES_ROOT\FunWebPr
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{9
HKEY_CLASSES_ROOT\ScreenSa
HKEY_CLASSES_ROOT\ScreenSa
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{A
HKEY_CLASSES_ROOT\CLSID\{A
HKEY_CLASSES_ROOT\CLSID\{A
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\CLSID\{B
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{C
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{C
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\FunWebPr
HKEY_CLASSES_ROOT\CLSID\{D
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\CLSID\{E
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\Typelib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\MyWebSea
HKEY_CLASSES_ROOT\SM502_22
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{0
HKEY_CLASSES_ROOT\TypeLib\
HKEY_CLASSES_ROOT\Interfac
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{7
HKEY_CLASSES_ROOT\CLSID\{D
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CURRENT_USER\SOFTWARE
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
c:\program files\funwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\scree
c:\program files\funwebproducts\scree
c:\program files\mywebsearch (Adware.MyWebSearch) -> Delete on reboot.
c:\program files\mywebsearch\bar (Adware.MyWebSearch) -> Delete on reboot.
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\Avat
c:\program files\mywebsearch\bar\Game
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\Mess
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Over
c:\program files\mywebsearch\bar\Sett
Files Infected:
c:\Program Files\MyWebSearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\Program Files\MyWebSearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\Users\audrey dangoor\AppData\LocalLow\m
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\Windows\System32\f3PSSa
c:\Users\audrey dangoor\AppData\Roaming\mi
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\Insta
c:\program files\funwebproducts\Insta
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\1.bi
c:\program files\mywebsearch\bar\Avat
c:\program files\mywebsearch\bar\Game
c:\program files\mywebsearch\bar\Game
c:\program files\mywebsearch\bar\Game
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\icon
c:\program files\mywebsearch\bar\Mess
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Noti
c:\program files\mywebsearch\bar\Over
c:\program files\mywebsearch\bar\Sett
That's a lot of malware that Mbam has removed. However, it all seems to relate to MyWebSearch (and the related FunWebProducts). This is adware that often crops up, and I don't think it would be responsible for locking your hosts file.
I noticed in your log entries like this:
c:\program files\mywebsearch\bar\1.bi
When the scan completes, you need to make sure that there is a tick in the box next to each item to be removed.
Did you run Hitman Pro? Did it find anything?
Would you please run a scan with TDSSKiller:
http://support.kaspersky.com/viruses/solutions?qid=208280684
After it has completed. please try to reset a default hosts file with Hostsxpert.
This is a good utility for correcting redirects. Download the executable file to your desktop, right-click and run as administrator.
I noticed in your log entries like this:
c:\program files\mywebsearch\bar\1.bi
When the scan completes, you need to make sure that there is a tick in the box next to each item to be removed.
Did you run Hitman Pro? Did it find anything?
Would you please run a scan with TDSSKiller:
http://support.kaspersky.com/viruses/solutions?qid=208280684
After it has completed. please try to reset a default hosts file with Hostsxpert.
This is a good utility for correcting redirects. Download the executable file to your desktop, right-click and run as administrator.
ASKER
I've tried again to edit the hosts file with notepad.This time I opened properties unchecked read only and checked to allow all in security.This time when I edited out YouTube I was able to save the edited file. Now I have access to youtube!
Phototropic thanks for identifying the cause of the problem and showing that I needed to edit the hosts file.
Phototropic thanks for identifying the cause of the problem and showing that I needed to edit the hosts file.
You are welcome.
I'm glad to hear that your problem is resolved.
I'm glad to hear that your problem is resolved.