finding the hijack culprit

[Will Renkel]

I seem to have been hijacked on my URL completion capability.
Ran AdAware, Spybot and CWShredder - all clean.
Then ran hijackthis, and analyzed it woth http://www.hijackthis.de/index.php?langselect=english

Found a culkprit...


O4 - HKLM\..\Run: [REWARDS NETWORK] C:\Program Files\Rewards Network\brntray.exe

But looking at system, there is no such program.

So how do I find it?

TIA

--
---------------------------------------------------------------
Will Renkel
Wheaton, Ill.
REGISTERD Linux User: 300583

---------------------------------------------------------------

 

[oops!!]

Will,

Disable System Restore.

Delete the contents of your TIF folder, Temp folder and Cookies.

Scan with HJT, select (tick) the nasty entry and click the "Fix checked" button.

Reboot in Safe Mode and delete the folder C:\Program Files\Rewards Network.

Reboot to normal Windows and re-enable System Restore.

That should take care of the problem.

Zee

 

[Jan Il]

Hi Will

The HiJackThis program is a *very* powerful program, and analysis and
corrections should not be performed by those who are not fully experienced.
Making incorrect deletions can cause serious damage to your system. I
strongly urge you to post your log on one of the forums below and let the
experts there review it and instruct you on how to make any necessary
corrections.

HiJackThis Logs
http://forum.aumha.org/viewforum.php?f=30

ComputerCops
http://computercops.biz/forum67.html


If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.

Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

....