browser hijacked

[Guest]

can someone help have run spybot finds files fixes the
problem but when i switch off then back on all the files
spybot deleted are back

 

[H Leboeuf]

Get the latest version.
http://www.safer-networking.org/index.php
--

If still no joy then please post the names of the files that are beeing
recreated.

You may decide to get help from this forum, in case it's a new variant.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html
_______________________________________
Source: Mike Burgess http://www.mvps.org/winhelp2002/



Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===

 

[Guest]

use spyboy to remove the programs, then click "recovery"
in spybot and go ahead and check all the boxes shown. then
permanently remove them. that should do the trick

 

[Guest]

-----Original Message-----
can someone help have run spybot finds files fixes the
problem but when i switch off then back on all the files
spybot deleted are back
.
Warning: I'm not good at this stuff, so I'm not positive

if this is the correct solution. I just went through this
yesterday. This is what I had to do, don't know if it is
right or not, but it worked for me. I went to Start -
Run - type "regedit" and hit "ok". Now go to these
registry subkeys and delete them:

HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main\"Start Page"
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main\"Search Page"
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Search\"SearchAssistant"
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Search\"CustomizeSearch"
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Main\"Search Page"
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Main\"Default_Search_URL"
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Main\"Start Page"
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\"SearchURL"
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main\"Search Bar"
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main\"Default_Search_URL"
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main\"Default_Page_URL"
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Search\"SearchAssistant"
HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Search\"CustomizeSearch"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio
n\URL\"DefaultPrefix"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio
n\URL\Prefixes\"home"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio
n\URL\Prefixes\"www"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio
n\URL\Prefixes\"mosaic"

I also had some .dll files that needed deleting too,
Mtwirl32.dll is one of them.