spyware finds, deletes, reloads at the reboot.

[Sheena]

I have downloaded the program successfully. It runs scans
and finds

_ DelFin.Media Viewer Adware (2 Signatures)

c:\ winnt\atlxi.exe

c:\wint\msqw32.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurentVersion
\Run atlxi.exe

-Adware.Search Page Adware

File name: rhgqu.dll

Filepart C:\winnt\rhgqy.dll

c:\winnt\system32\qqorn.dll
c:\winnt\system32\lqact.dll
File size: 66560 Bytes

File MD5: 855ad6871d55aOf22094bcf7340cb7p

-Antivirus Gold

c:\documents and settings\administrator\local setting\te



I have the program remove all of these, which it
does...spyware program prompts you to reboot, I do so
immediately and it reloads al this stuff back up.



My Internet Explorer page has been changed as well. I go
into Spyware program and it will allow me to change all
the Internet Explorer pages to whatever I want but it will
not allow me to change the default so it opens back up to
the adware about:blank with all sort of less than savory
sites. It also keeps reloading porn site in my
favorites...I delete them and it reloads every time we
reboot. I run the scan and delete and it reloads at the
boot. Can you please help???

Sheena (e-mail address removed)

I have run Adware Professional
Microsoft Spayware Beta 1
Spybot Search and Destroy
and they all do the same thing find the problem delete it
and it comes back at the reboot or (spybot) tells you it
can not remove it. HELP!!

 

[plun]

Hi Sheena

Try this:

First houseclean your PC with CCleaner and remove all temporarily junk.
www.ccleaner.com

Quick tour:

http://www.ccleaner.com/help/tour1.asp

Also include Lavasofts Adaware to your spyware protection.
http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022-10399602.html?tag=list

Install Adaware and start > "Check for updates".

Restart in safe mode, press F8 during reboot just before Windows
flag screen appears.

Scan again with MSAS and Adaware, choose fullscans.

Restart

If this fails take help from Aumha.org

http://www.aumha.org/a/quickfix.htm HijackThis forum in step 6.

 

[plun]

Hi again

Sorry, you already have Adaware but try the other steps and
safe mode is important.

--
plun



plun explained :