Orpington Astronomical Society

Random Rambling Ruminations => PC Helpline => Topic started by: Fay on Jul 14, 2012, 18:01:03

Title: Partner37.mydomainadvisor
Post by: Fay on Jul 14, 2012, 18:01:03
I often cannot open my web links, via SGL, PAIG or UKAI. instead a page comes up with the above info at the top.

I have done full scans etc, nothing came up, wondering if the problem could be with my web provider. Any clues?

Thanks
Title: Re: Partner37.mydomainadvisor
Post by: Mike on Jul 14, 2012, 18:22:17
Fay this is a virus. It's known as a Browser Hijacker. Whatever virus protection you are using has obviously let it through. Get rid of it and use another and do a full system scan.

Title: Re: Partner37.mydomainadvisor
Post by: Fay on Jul 14, 2012, 19:01:33
I have done a full scan with SPYBOT & the paid version of AVG. Have also downloaded Malware Bytes. nothing was found. do you think the problem could be with my webspace provider, or is it definitely with me?
Title: Re: Partner37.mydomainadvisor
Post by: Mac on Jul 14, 2012, 23:58:51
Manual Guide to Remove/Uninstall Partner37.mydomainadvisor Completely
Step1. Stop Partner37.mydomainadvisor process: press Ctrl+Shift+Esc to start Windows task manager and check abnormal process

random.exe(the Partner37.mydomainadvisor process is changing everytime)

Step2. Remove all Partner37.mydomainadvisor files listed here:

%AppData%\[random].exe
%ProgramFiles%\LP\[random].tmp
%ProgramFiles%\LP\[random].exe
%Windows%\system32\[random].exe
%System%\drivers\[RANDOM CHARACTERS].sys
Step3. Get rid of Partner37.mydomainadvisor registry entries listed here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\CustomizeSearch=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\[random]
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell =[random].exe
HKEY_CURRENT_USER\Control Panel\Desktop\ForegroundLockTimeout = [random]
Please be advised that manual removal of Partner37.mydomainadvisor is a cumbersome process and if you haven't sufficient expertise in dealing with program files, process, .dll files and registry entries, it may lead to mistakes damaging your system. Therefore, To make sure completed deletion, it is recommended to contact online expert for tech support.
Title: Re: Partner37.mydomainadvisor
Post by: Mac on Jul 14, 2012, 23:59:01
Have Fun.
Title: Re: Partner37.mydomainadvisor
Post by: Ian on Jul 15, 2012, 00:18:09
Fay, sometimes Malware can hide itself from scanners if it's running. I would follow Mac's instruction to see if can find the malware process (the one with the random name), stop the process in task manager and then try running your antivirus or malware bytes again. That might be able to remove it without you having to manually edit the registry.
Title: Re: Partner37.mydomainadvisor
Post by: Mac on Jul 15, 2012, 19:01:07
Just a thought, start the pc in safe mode and then stop all the processes that are running, then run your malware scanner,

Mac.
Title: Re: Partner37.mydomainadvisor
Post by: Fay on Jul 15, 2012, 19:22:12
Thanks for your help, I will have to think if I am confident to go into the depths!

Title: Re: Partner37.mydomainadvisor
Post by: JohnP on Jul 15, 2012, 20:28:15
Fay is this on your desktop or new laptop?.. Have you been downloading dodgy files again...?
Title: Re: Partner37.mydomainadvisor
Post by: Fay on Jul 15, 2012, 20:32:11
desktop.  I only get it erratically on some of my weblinks.