http://freetestonline.net

Hello,

This morning I visited some website that (I think) downloaded something pretty bad into my PC. Can you help?

Here are the symptoms:

1) On my desktop, there appeared two new icons -- Security Troubleshooting and Online Security Guide. I deleted these icons, but remaining in the Start Menu are:

Security Troubleshooting (put your cursor over it, and you see "http://freetestonline.net")

Online Security Guide (put your cursor over this, you see "http://onlinesecuritysolution.net"

2) I keep getting fake warnings popping up from some unknown antivirus program saying that my PC is infected, could crash, and then asks me to run the program to remove the problem. I say it's fake, b/c it's definitely not the AVG program I run or any other antivirus program I have installed intentionally.

3) I keep getting warnings from either Spywareguard or Spybot (sorry, right now I don't remember exactly which known security program it is) that my home page has been changed by a BHO.

None of these were problems or occurred before visiting the offending website last night. I suspect it was that website, as my AVG suddenly popped up a warning that my PC was infected with a virus. It let me "heal" it, but again I suspect it's somehow related.

In a development that may or may not be related, earlier I googled the name "http://freetestonline.net" and saw numerous sites talking about this being a nasty infection. Now if I type the same thing into google, I don't get any of those results, only the phrase "Did You Mean: http://freehostonline.net" and then a few other things for me to click on. I haven't clicked on anything b/c for some strange reason this Google webpage looks a little funny -- I don't know how to describe it other than to say it just doesn't feel right.

Does this sound familiar to you? I'd appreciate your help.

By the way, other than that, my PC seems to be running fine.

Thanks,

BeenBit

 

You might want to go to one of the sites here CastleCops, SpywareInfo and TomCoyote and post a Hijackthis log and let the experts help you clean it up.


http://castlecops.com/forums.html

http://www.tomcoyote.org/hjt/

http://www.spywareinfoforum.com/

bigc

 

U may want to post a HijackThis log over at this site,

http://gladiator-antivirus.com/forum/index.php?showtopic=10517

for analysis then the malware experts there will give u recommendations on removal of any possible infections.



snowbound

 

I just tried these site (and the links to other sites, i.e. SpySheriff), it's all crap and marked red by McAfee SiteAdvisor. But I have to admit: those are not 127.0.0.1 in my hosts file.

Gerard

 

Thanks for all your replies. I'll post over at one of the other boards and see what they say.

Have a great day!

BeenBit

 

Hi,

Any update on this issue i have also been infected with this.

 

beenbit and saltysalty

have you guys tried using superantispyware to remove the infection?

http://www.superantispyware.com/

download the free version and run it in safemode. this thing removes winfixer, spyfalcon, and more. i've personally used it to get rid of spyware quake on my friends machine.


ps beenbit, i tried to go to the website you mentioned to see if it would infect my machine, but nothing happens. has the page been taken down?

 

My experience was that, after AVG-detection, i immedately went to the location of the files and delete them. I also check start up entries in Spybot S&D, advanced mode/tools/startup programs for unknown or malicious entries. There shouldn't be so much entries you don't know about, and you can check those entries easily on its location. Delete only if you are SURE.
Then close everything, reboot without System Restore set on. Disable System Restore: Start/Programs/Accessories/System Tools/System Restore - on the left pane, Settings tab System Restore, check disable box. Reboot.
Problem solved? Succes.