IE Host File

[Swytchcraft]

I have gotten a spyware program installed on my computer and cannot remove it. I have scanned in safe mode with MS Antispyware, Adaware, and Spybot, went in and removed every instance I can find and deleted the folders from system32, program files and windows, and opened my is host file and deleted all the ip address's redirecting me. But I still get popups.

Here is what my host file says:


127.0.0.1 localhost

69.20.16.183 auto.search.msn.com
69.20.16.183 search.netscape.com
69.20.16.183 ieautosearch
127.0.0.1

http://www.igetnet.com

127.0.0.1 code.ignphrases.com
127.0.0.1 clear-search.com
127.0.0.1 r1.clrsch.com
127.0.0.1 sds.clrsch.com
127.0.0.1 status.clrsch.com
127.0.0.1

http://www.clrsch.com

127.0.0.1 clr-sch.com
127.0.0.1 sds-qckads.com
127.0.0.1 status.qckads.com

When I delete all but localhost, I safe and close the file. As soon as I open it up again, they are all there. What is writing all these back into my hosts file????? And how do I remove it?

 

[Mike2287]

Your still infected.

Be sure to turn off system restore and run your scans in safe mode.

also run HijackThis

Download from this link and you can also have the log analyzed on this page.

 

[aquias]

Mike is correct, you are still infected...

In addition to Mike's advice, visit Trend Micro's Housecall and see if they detect anything that the others have missed.

 

[Swytchcraft]

Well, I have ran Antispyware, S&D, Adaware, and Hijack this in safe mode. They all continue to come right back.

Any other ideas?

 

[aquias]

Hijack will only list out entries, have you gone through and removed suspect/infections through Hijack This?

 

[Mike2287]

Try spysweeper. The trial version if fully functional for 30 days.

 

[diogenes10]

There is what you are dealing with. Sometimes complicated to get rid of.

http://forum.iamnotageek.com/t-78901.html

You can try those steps, if that doesn't work google on ieautosearch and look at threads in the various help forums to see how it is being dealt with.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?