Problem with IE6 - probably a relic of LOP Spyware

[Steve]

I'm running XP Home edition on a 2.6G Pentium, 160G Hard drive.

I use upto date version of ad-aware and NIS 2004, which seem pretty good at
keeping the machine clean.

However, I had an IE toolbar appear which seemed to be associated with LOP.
After some effort I got rid of the toolbar, but now there is a "relic" left
over. If I enter a URL which is "not found" I still get a screen
advertising loads of links.

This is driving me nuts!

Using Filemon I've found these references which appear pertintent:

22:42:02 IEXPLORE.EXE:2164 OPEN C:\DOCUME~1\STEPHE~1\LOCALS~1\Temp\PartMeal
Global.htm FILE NOT FOUND Options: Open Access: All

and this:

22:42:02 IEXPLORE.EXE:2164 CREATE C:\DOCUME~1\STEPHE~1\LOCALS~1\Temp\Warn
fast.exe SUCCESS Options: OverwriteIf Access: All

If I rename the \temp\ folder to an alternative IE6 works properly.

However, I cannot find the two files referenced above in the folder.

This thing is also sneaky.

Here is the URL that pops up in IE when I enter a bad URL (www.warco.co.uk
is not available just now so returns an error):

C:\Documents and Settings\my name\Local Settings\temp\PartMeal
Global.htm#http://www.warco.co.uk/

But if I have an explorer window open pointing at this \temp\ folder IE6
shuts down!

NIS 2004 isn't reporting a problem on a full system scan in safe mode and
neither does ad-aware.

ANy help appreciated

Best Regards

Steve

 

[WinGuy]

Hi, Steve. Your question might best be placed in the following newsgroup:
microsoft.public.security.virus
They're real familiar there with the kinds of problems like you are having.

 

[Steve]

Hi, Steve. Your question might best be placed in the following newsgroup:
microsoft.public.security.virus
They're real familiar there with the kinds of problems like you are having.

Thanks for the pointer, much appreciated.

Best Regards

Steve