Help, I think I have a virus

Viruses and worms
1

Hey! I’m new here, I downloaded the Malwarebytes program after a lot of work. Then ran it yesterday and it took off 7 different objects that were on my computer. I thought maybe it was fixed, but today it is showing up again! I am getting something called partner37.mydomainadvisor when I try to go to some web sites. Also something called Welcome to nginx! :cry:

Is this a virus? Or viruses? If so can someone please help me get rid of them, I would really appreciate it very much!

Thanks!!!

2

follow this guide and attach (not copy and paste) logs from malwarebytes / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0

3

Here are the files you requested. Thank you for your help!

4

Hi this can be a pain to remove … But lets try this first

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL FF - prefs.js..keyword.URL: "http://search.toolbars.alexa.com/?ver=spkyf-1.7.0&src=ab&aid=ZHt7f1cjTB00gr&q=" O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))

:Files
ipconfig /flushdns /c
C:\USERS\NANCY’S\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\T0HGDQQZ.DEFAULT\EXTENSIONS\TOOLBAR@ALEXA.COM.XPI

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

5

I ran the fix above and am attaching the OTL I ran after rebooting.

Thanks!

6

Are you still getting Welcome to nginx ?

7

It hasn’t done it yet, but last time I thought it was fixed, it showed up a day later. It’s strange, it only comes up sometimes and I never know when. I will post here again if it pops back up.

Thanks so much for your help!

8

Ok could you keep me informed ;D

9

I will! Probably won’t be on until tomorrow, but I’ll let you know.

:slight_smile: