Nasty Little Trojan

Damn, I can't remember the name of it - I'm typing this at home, and the thing was on my work computer. AVG picked it up as a warning, but didn't pull the thing itself. Basically, it hijacked IE and Firefox, giving me a Cod Microsoft Page towards 'AntiSpyware.com' and put up a recurrent little VB Box with the message Hehehehehehe! which popped up over everything every ten seconds.
I ran AVG 8 - then Downloaded MalwareBytes - ran both of them - NOTHING! So I googled the details, and found a forum which had tales of a similar infestation - followed someone's advice on which registry keys to eradicate, uninstalled WinRar - turned off system restore, rebooted, ran Trend's HouseCall - turned system restore back on - and it seemed to have gone - BUT - for the rest of the day, Google kept warning me that something was attempting to hijack the browser, so I think there may be a trace left. Housecall, weirdly finished in about fifteen seconds, so I'm not sure what was going on there - I will run everything again on monday when I get in to work, and see what occurs - Wise Disc and Registry Cleaner, Windows Defender, and all the others. I'll also trawl the registry and get rid of any WinRar evidence. ZipGenius was recommended to me, so I will eradicate WinRar forever

That sounds like Trenderdia. I have cleaned several of these. One of the moderators here does not like us to post links to fixes at other sites, so I will just add that running HostsXpert may help.

Download HostsXpert
http://www.funkytoad.com
* And Save it to your Desktop
* Rt Click Hoster.zip->>Extract all->>Extract it to your Desktop (or your C:\ drive)
* Open The Hoster folder->>Double Click HostsXpert.exe
* When the program Opens Click The "Restore MS Hosts File" button in the left pane.
* Then select "Restore Original Hosts" when prompted.
* Close the Hoster program when complete
* Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

If I were you, I'd stay away from Registry Cleaners.
Here are some good discussions on those:
http://aumha.net/viewtopic.php?t=28099
http://www.whatthetech.com/2007/11/25/do-i-need-a-registry-cleaner/
http://billpstudios.blogspot.com/2007/04/do-i-need-registry-cleaner.html

Good luck in keeping your work computer clean.
Regards,
Bugbatter

Thanks Bugbatter. I think you are right - Trenderdia rings a memory bell. And I recall that one of the fix instructions was to replace the Hosts file, which I did by copying the one from my Laptop.
Very interesting threads re: Registry Cleaners - must admit, I have never had the slightest trouble with them - Registry First Aid, CCleaner - Wise - and a couple of others - but in future, I think I may take it under advisement....

Your comment that, "One of the moderators here does not like us to post links to fixes at other sites", deserve a reply.

You are mistaken, and your comment is misguided.

These forums are available for all members to help each other with their knowledge and expertise, and if that includes links to articles or advice on other web sites, such posts are always welcome. But only as the post and the links apply to the problem being discussed. Blatant advertising is prohibited, and soliciting members to leave CNET and join other forums is not allowed.

While suggesting to members they use specific software, and providing the links to that software is quite acceptable if it helps resolve problems, if a member has any sort of affiliation with that software, or with the web site, products or services, that member must clearly state their connection or affiliation. Continuous reference to such software, products or services will be treated as spam.

If you have run into difficulties with other Moderators because of links you provide in your posts, then you need to reconsider the content of your posts.

We will continue to monitor members' posts for any content that contravenes Forum Policy, and treat them accordingly. Your link to Forum Policy is in the left hand sidebar.

Mark

Mark, on this forum I posted a link to a fix for a Windows Update redirect that was being handled at a HijackThis forum. My post was deleted. The fix was for an identical problem that an OP here was having trouble with. If I remember correctly, the fix was not one of mine, and was at a site that has no advertising and no soliciting for donations. I am a member at many security sites.
For future reference, here are most of my affiliations:
https://mvp.support.microsoft.com/profile=59F83A39-27B1-4D11-8472-0CB3C9E4D49C
Shall I not post links to fixes or articles at any of these sites, including Dell and Microsoft?

The page is still there - http://www.wintechaiitm.org.cn/winrar.htm
it's masquerading as a C.Net page - I wish I could send a quantum torpedo right back at them, the rotten lot. Who are these morons? Do they sit in their rooms congratulating themselves at putting one over on the enormous anonymous human race? Is it a social inadequacy thing?
More important, can someone shut this site down? - Dear C.Net. this site is not doing your brand name any favours

in the CNET forums and I'm sure he will let the appropriate people know. I don't know if they can do anything about it or not but at least they know now. Thanks for reporting it.

I have contacted the appropriate team and they are in the process of removing that ad.

Thanks again!
-Lee