Gaming FLV player

[WeeBabyDoll]

Hey I came back with 10 infections... here's my log file.

CODEMalwarebytes' Anti-Malware 1.44
Database version: 3753
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

17/02/2010 23:24:00
mbam-log-2010-02-17 (23-23-53).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 221663
Time elapsed: 31 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{ef34404a-747c-81d8-843a-d938e181273d} (Adware.BHO.FL) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\petne0jqj (Adware.LoudMo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a8021df4-c8f9-3bc5-4a31-a86bb726f1bf} (Adware.AdRotator) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a8021df4-c8f9-3bc5-4a31-a86bb726f1bf} (Adware.AdRotator) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\BabyDee\AppData\Local\Mozilla\Firefox\Profiles\fnw9ffu1.default\Cache\770B0B90d01 (Adware.MediaPass) -> No action taken.
C:\Users\BabyDee\Downloads\FLVDirect.exe (Adware.MediaPass) -> No action taken.
C:\Windows\System32\petNe0jQj.exe (Adware.LoudMo) -> No action taken.
C:\Windows\SysWOW64\petNe0jQj.exe (Adware.LoudMo) -> No action taken.
C:\Windows\SysWOW64\-7yC-7uf-.dll (Adware.AdRotator) -> No action taken.


Do I select remove selected to get rid??

 

[nitrostemp]

Files Infected:
C:\Users\BabyDee\AppData\Local\Mozilla\Firefox\Profiles\fnw9ffu1.default\Cache\770B0B90d01 (Adware.MediaPass) -> No action taken.
C:\Users\BabyDee\Downloads\FLVDirect.exe (Adware.MediaPass) -> No action taken.
C:\Windows\System32\petNe0jQj.exe (Adware.LoudMo) -> No action taken.
C:\Windows\SysWOW64\petNe0jQj.exe (Adware.LoudMo) -> No action taken.
C:\Windows\SysWOW64\-7yC-7uf-.dll (Adware.AdRotator) -> No action taken.

kill them all

 

[Rydian]

Yeah, get rid of them.

EDIT: Not just the files, everything. The stuff above the files is the BHO information which links with the browser, make sure to remove that as well.

 

[WeeBabyDoll]

Right, removed files and restarted laptop - checked if I was able to go onto the site I was wanting to get on before and it's still coming up with the same thing. I am doing a scan with Microsoft security essentials if that helps??

 

[Rydian]

Go here, view the Setup section, and follow the "remove redirects" part.

 

[WeeBabyDoll]

Got to the part where you copy the value into the run box on the start menu - the file is called etc instead of Host. Does this matter? Also, when I went to send this reply it redirected me somewhere else.

Oops sorry please ignore my first sentence. Didn't read properly...

 

[Rydian]

http://support.mozilla.com/en-US/kb/Managing+profiles

Make a new profile in firefox, does it happen there?

 

[WeeBabyDoll]

Hey, how do I find out my DNS server address?

Forget that, just finished all the steps on your setup section and it worked!! Thank you so much for all your help and patience!

 

[Rydian]

By going to where the opendns instructions tell you and checking if there's already one set there. If not, then you'll use the one set by your router, which is usually the one set by your ISP, though you can ovverride that for something else with the router, but that's not what happened to you.

 

[WeeBabyDoll]

It's okay, it's all sorted! Now to get on with Lost....thank god!! Thanks again for all your help. You should go into teaching.

 

[Rydian]

I don't have that sort of patience.

 

[WeeBabyDoll]

I may have spoken too soon....
I keep getting randomly re-directed to strange pages....just at random times.

 

[Llama Riot]

watch-movies-online.tv is the correct address of the site you are trying to use.

watch-movies.net.in is a spoof site and that is most likely where you got infected.


edit: I have also used FLV player before and I was not infected. VLC player however, is the better player.

 

[WeeBabyDoll]

watch-movies-online.tv won't open any links to the videos for me, but on the spoof everything seems to work perfect.

 

[Llama Riot]

watch-movies-online.tv won't open any links to the videos for me

Do you have javascript turned off? Do you use avast?

 

[WeeBabyDoll]

Javascript is on and I dont use avast..

 

[Llama Riot]

Well sorry then it seems I can't help you, although I am positive that watch-movies.net.in is a bad site.



edit: switch to Google Chrome!

 

[Rydian]

Does it happen in other browsers?

 

[nitrostemp]

install flash

 

[WeeBabyDoll]

My boyfriend uses internet explorer and it doesnt seem to happen to him, I also have flash player.

Should I uninstall firefox and then reinstall it??