I'm having a problem, i've allowed Internet Explorer
URL.How do i now block Internet Explorer URL.

>-----Original Message-----
>I'm having a problem, i've allowed Internet Explorer
>URL.How do i now block Internet Explorer URL.
>.
>i've completed a full scan and it reports that i'm not
infected. but why would i then get a message saying allow
the Internet Explorer Search Bar URL change from its
original URL of
http://www.kvnnfkhbbvtaskdkcwpvpxtcz...kXGlOqDklbUdhR
hFopQ9VseTQYBYEY4ODi14okHSbFOcTs4EqYqNvZANqmLHS.htm to
http://www.elhdcoeywybtxxlj.com/wGZk...bUdhRhFopQ9Vse
TQYBYEY4ODi14okHTgCt76_s3myaNvZANqmLHS.html.

I'M VERY SUSPICIOUS............HELP PLEASE !!!

Hi - Those search entries certainly look like malware, either active or
residual. You can restore your normal search function using my reg file:
Download and run:
http://www.kellys-korner-xp.com/regs...oreSearch2.REG to restore
your default Search functionality and reset your prefixes. You'll have to
manually re-select any Search Customizations you may have had, however.
(Don't let MSAS overwrite ("restore") these with the old malware ones after
you run this .reg file, BTW. )

You can try this also: http://windowsxp.mvps.org/IEFIX.htm


In addition to MSAS, you might want to run some of the other anti-spyware
programs that are available, since it's not clear that your machine is
clean. No single program (or even two or sometimes even three) catches
everything. Take a look at my Blog, Defending Your Machine, addy in
Signature below, and run the various programs there exactly as outlined
there and in order - don't omit any - and see if that helps. Be warned - it
will take a fair amount of time and effort on your part.

When done, go to Start|Run and enter one line at a time (or even easier,
open a DOS box and copy the following in its entirety and then paste it into
the box):

regsvr32 /i browseui.dll
regsvr32 /i shdocvw.dll
regsvr32 /i mshtml.dll
regsvr32 mshtmled.dll
regsvr32 actxprxy.dll
regsvr32 /i urlmon.dll
regsvr32 scrrun.dll
regsvr32 comcat.dll
regsvr32 Oleaut32.dll
regsvr32 /i Shell32.dll
regsvr32 Msoeacct.dll
regsvr32 "C:\Program Files\Outlook Express\Msoe.dll"
regsvr32 msjava.dll
regsvr32 jscript.dll
regsvr32 Olepro32.dll
regsvr32 Hlink.dll
regsvr32 Asctrls.ocx
regsvr32 Inetcpl.cpl /i
regsvr32 Dxtrans.dll
regsvr32 Dxtmsft.dll
regsvr32 Imgutil.dll
regsvr32 Msxml.dll
regsvr32 Msjava.dll
regsvr32 Jscript.dll
regsvr32 Softpub.dll
regsvr32 Wintrust.dll
regsvr32 Initpki.dll
regsvr32 Dssenh.dll
regsvr32 Rsaenh.dll
regsvr32 Gpkcsp.dll
regsvr32 Slbcsp.dll
regsvr32 Cryptdlg.dll
regsvr32 Msjet40.dll
regsvr32 pdm32.dll
regsvr32 Msjtor40.dll
regsvr32 Dao360.dll
regsvr32 Sccbase.dll


with a Return after each .dll. You'll get a message about successful
completion of the re-registration process after each one, then enter the
next (with the DOS box they'll be continuous except for the last one).

If you use Win98x and get an error on Shell32.dll, ignore it. Only the ME,
Win2k and XP versions of windows have shell32 as an object that needs
registering. (For these earlier operating systems, run "regsvr32
shdoc401.dll " instead of "regsvr32 Shell32.dll".) Depending on your
system, you may also get "not found" error messages on some or all of the
last five - if so, ignore them.

Re-start your computer when you've finished.


If these don't help, then you may be infested with something with which
you'll need some HiJackThis forum help.

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadge...8baee6434cfc13

There's a good "How-to-Use" tutorial here:
http://computercops.biz/HijackThis.html

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Place HijackThis.exe or unzip HijackThis.zip into its own dedicated folder
at the root level such as C:\HijackThis (NOT in a Temp folder or on your
Desktop), reboot to Safe mode, start HT then press Scan. Click on SaveLog
when it's finished which will create hijackthis.log. Now click the Config
button, then Misc Tools and click on Generate StartupList.log which will
create Startuplist.txt


Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://forums.spywareinfo.com/

or Net-Integration here:
http://www.net-integration.net/cgi-b...ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx
or Jim Eshelman's site here: http://forum.aumha.org/
or Bleepingcomputer here: http://www.bleepingcomputer.com/
or Computer Cops here: http://www.computercops.biz/forums.html

Register if necessary, then sign in and READ THE DIRECTIONS at the beginning
of the particular site's HiJackThis forum, then copy and paste both files
into a message asking for assistance, Someone will answer with detailed
instructions for the removal of your parasite(s). Be sure you include at
the beginning of your post a description of "What specific
problem(s)/symptoms you're trying to solve" and "What steps you've already
taken."


--
Regards, Jim Byrd, MS-MVP
My Blog, Defending Your Machine, here:
http://defendingyourmachine.blogspot.com/

<(E-Mail Removed)> wrote in message
news:068201c59ab6$f17e5180$(E-Mail Removed)
>> -----Original Message-----
>> I'm having a problem, i've allowed Internet Explorer
>> URL.How do i now block Internet Explorer URL.
>> .
>> i've completed a full scan and it reports that i'm not
> infected. but why would i then get a message saying allow
> the Internet Explorer Search Bar URL change from its
> original URL of
> http://www.kvnnfkhbbvtaskdkcwpvpxtcz...kXGlOqDklbUdhR
> hFopQ9VseTQYBYEY4ODi14okHSbFOcTs4EqYqNvZANqmLHS.htm to
> http://www.elhdcoeywybtxxlj.com/wGZk...bUdhRhFopQ9Vse
> TQYBYEY4ODi14okHTgCt76_s3myaNvZANqmLHS.html.
>
> I'M VERY SUSPICIOUS............HELP PLEASE !!!