hijacked browser: "pjxam.dll"

[Mike T.]

My son got home from college, and I assume he took the
browser to some sort of adult page or something. Now the
default for IE (6.0) has been taken over by the address,
"res://pjxam.dll/index.html#96676" . This has happened
before. Last time I Googled the address and found the
solution. I find nothing this time, and can't remember what
I did last time. I'm running WinME through a router, and
with a combination of Norton AV, Spybot, STOPzilla, and
additional firewalling. Apparently none of this prevents
the hijacking, and none of it chases it down. Anyone got
the answer?

Thanks and regards.
mt

 

[KAS]

Your machine may be/is infected with spyware/malware. Go
get copies of Ad-Aware and Spybot (both free) and run them.
That should clean your machine.

You might want to consider using a different browswer such
as Firefox, Opera, etc. They all have built-in pop-up
blocking so the ads which install this stuff on your system
don't even appear.

Another option might be to get Googles Toolbar which also
has built-in pop-up blocking.

 

[H Leboeuf]

You have a nasty CoolWebSearch variant.

You will need this removal tool.
More: Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
More: Removal tool: http://www.spywareinfo.com/~merijn/files/CWShredder.exe

CWShredder - Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47

IMPORTANT:
Before trying to remove spyware, download a copy of LSPFIX from
the URL below - some malware may kill your internet connection when it is
removed, this program will enable you to regain your connection.
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is Win2k or
XP)

Important: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051
--

If this fails then get help from the experts.

Go to http://www.spywareinfo.com/~merijn/files/hijackthis.zip
Download "Hijack This!" [freeware] Latest version is 1.98.

Unzip the Download file in a NEW FOLDER that you can create before you start
the download.
DO NOT install in your Desktop folder.
DO NOT use any of the TEMP folders that are presently in your computer.
Double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/



Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===