Adware & Trojan Protection?

[Jeremy]

I'm having a major problem with Browser Helper Objects and
Trojans infecting my browser and wreaking havoc on my
internet experience. It seems like I have a new one of
those suckers every week.

I previously had a bookmarkerE virus that creates a file
called "cpan.dll" in the Windows\System32 directory.
Every time I load up my computer, I found an unpleasant
search site with nasty links as my Home page. In
addition, I would find nasty links in my favorites.
Fortunately, I could find some help with Norton Antivirus
and Symantec's help site. I removed the file and all the
registry files manually, and use the antivirus program to
check all my files.

Now, I have a new one. And the problem is that I can't
find anything on the net that references this particular
bug. The site it links me to is "mypoiskovik.com", which
I think is some kind of Russian site. As usual, there are
all sorts of changes to my registry.

So, I have a couple of ideas.

One, when I get this crap fixed, I need to backup my
registry so that I can instantly fix the problem.

Two, I'm looking for advice on some kind of program to
block the trojans from changing my registry, adding
favorites, or changing my home page. It would seem like
someone would have figured out how to make a program to
put a LOCK on the home page AND your favorites list.

Maybe I'm just inept and there's something I can do with
the browser itself.

But I really need to figure out what file is associated
with this trojan so that I can remove it for good. I try
to remove the registry entries, which occur in the same
old places; but they pop back up. I'm sure there's a file
there somewhere just like "cpan.dll," but I can't find it.

I suppose I could scan some of the Windows directories for
the dates that certain files were created on the system;
but I'm not sure which directories to look besides the
system directory.

Any Ideas?

Please e-mail me at (e-mail address removed)

 

[dave]

safer-networking.org spybot ,download,update,scan,and
remove wares. and on the advanced mode you can lock out
your homepage. not sure if this bugger might be using
activex also. do a search on google for "mypoiskovik.com"
.....and in ie,tools,options,advanced,uncheck both'enable
install on demand' ,apply

 

[Jeremy]

I figured it out, and it was actually quit simple.

This dastardly fiend of spyware installs a program in the
documents and settings/all users/start
menu/programs/startup directory called "winlogon.exe".

It's obvious what these jackholes were trying to do.
With a program by the same name of the
REAL "winlogon.exe" that resides in your system32
directory, you have to have BOTH programs in your system
processes, there's no way to delete it (using
conventional methods).

Of course, all I had to do was start in safe mode, delete
the file, empty recycle bin, and reset my IEx defaults.
Then, I just changed my home page back to yahoo.

Relatively easy, once you know what you're doing. I
suspect this one is relatively new, because NONE of the
anti-spyware, such as spybot, adaware, xcleaner, or
norton anti-virus could find the damn thing.

Thank god for forums on the internet. I found a guy that
had the same problem and had written about it two days
ago.

Watch out for "mypoiskovik.com" and the
fake "winlogon.exe"! I bet it hits more people in the
coming weeks.