Redhead DJ -
Big issue of late. See here:
About the res://<random>.dll/<random>.html#<random> Infection
http://forums.spywareinfo.com/index.php?showtopic=8847
Read closely the bottom of the above page:
<paste>
It appears that ad-aware is cleaning the files etc but not deleting the
registry entries associated with the clean...
....DO NOT reboot your computer until you receive a response as the files
change as soon as you reboot. If you receive no response and you have
rebooted - Post a new HijackThis log into your current message...
<paste/>
Further helpful programs and ideas here:
"Check for Spyware" suggestions:
First, install the respective programs and then update them immediately, so
that they have the current versions, and definitions. Read the Help Files
and
Tutorials. Run them one at a time. With Ad-Aware you may have it generally
clean whatever it finds. The same applies for CWShredder. Spybot S&D
requires special attention (listed below), as does HijackThis (Only more so.
Details listed below) The programs are listed in order of their general
strength, safety, and purpose. It is perhaps best to install and run these
in this order of appearance. All are freeware programs, but if you are
pleased with the results and quality of the utilities, donations to the
respective Authors are cheerfully accepted.
Ad -Aware
http://www.lavasoftusa.com/support/download/
Ad-Aware Tutorial (might help if you look through this)
http://www.bleepingcomputer.com/forums/index.php?showtutorial=48
CWShredder (cleans all Cool Web Search malware)
http://www.majorgeeks.com/download4086.html
CWShredder Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47
Spybot S&D
http://www.safer-networking.org/index.php?page=download
Spybot Tutorial (Must Read)
http://www.safer-networking.org/index.php?page=tutorial
Other tutorials for Spybot S&D (Also must read)
http://www.bleepingcomputer.com/forums/index.php?showtutorial=43
http://tomcoyote.com/SPYBOT/index1.php
http://tomcoyote.com/SPYBOT/index2.php
This item below is designed to *prevent* installation of malware and the
like by comparing known CLSID's of these "bad guys" with what is in its
definitions. It doesn't remove anything, nor will it fix anything that is
already in your PC. Rather, it will prevent installation or re-installation
of the item once it has been removed either manually, or by the use of
another program which will perform the duty of removing the spyware.
SpywareBlaster (prevents installation of spyware, Trojans, etc.)
http://www.javacoolsoftware.com/spywareguard.html
SpywareBlaster Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=49
SpywareGuard (companion program to SWB, above)
http://www.javacoolsoftware.com/spywareguard.html
SpywareGuard Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=50
If you use Spybot S & D, be sure to clean *ONLY* the items displayed in
*RED*. DO NOT clean any items displayed in Black or Green at this time.
Lastly there is HijackThis. Hijack this is a very powerful, last resort type
of program which is generally best used in conjunction with help from those
who deal with the findings of the log created by the HijackThis scan. It
does nothing in the scan itself; it merely says what is in and running on
your PC. The items must be checked-marked to be "cleaned". You must
know *exactly* what you are checking-off before you proceed.
If you don't, you can quite possibly disable many useful and vital functions
of your PC. Remember; read the Tutorials, and seek help at SpywareInfo
Forums, Net-Integration, or TomCoyote forums for safety's sake.
HijackThis
http://www.spywareinfo.com/~merijn/downloads.html
If the preceding site is down, you may get HijackThis from Major Geeks
(amongst other sites as well)
Hijack This (from Major Geeks)
http://www.majorgeeks.com/download3155.html
HijackThis Tutorials **(MUST READ)**
http://www.spywareinfo.com/~merijn/htlogtutorial.html
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42
http://hjt.wizardsofwebsites.com/
Where to seek help with your HijackThis scan log
SpywareInfo Forums
http://forums.spywareinfo.com/
other help forums for HijackThis:
Net-Integration
http://forums.net-integration.net/index.php?c=19
TomCoyote
http://forums.tomcoyote.com/index.php?showforum=27
More general info on Spyware, Malware, and other undesirable unwanted
spyware, etc:
Jim Eshelmans WSC Aumha site:
http://aumha.org/a/parasite.htm
more details from Jim and his site
http://www.aumha.org/a/quickfix.htm
His quick scan for parasites (scripting must be enabled for this to work)
http://www.aumha.org/a/noads.htm
Bugs, Glitches, and Stuff-Ups; Sandi Hardmeiers help site
http://inetexplorer.mvps.org/Darnit.htm
A free on-line Trojan scanner
GFI
http://www.windowsecurity.com/trojanscan/
PestPatrol on-line scan
http://www.pestscan.com/home.asp
HTH -
--
LuckyStrike
(e-mail address removed)
--------------------------------------------------------------------
Redhead DJ said:
I've gone through just about everything per some of the posts here in
trying to get rid of this web page which is hijacking my IE. What it looks
like is that the IE page is auto-defaulting back to
res://hxbyc.dll/index.html#96676. Something seems to be cycling around and
setting this page back. Ideas on how to get into an .ini or some other file
to destroy it ??
