Re: Unwanted Web Site

From: Michael D. Alligood (mdalligood_at_bellsouth.net)
Date: 07/26/04 

Date: Mon, 26 Jul 2004 19:00:32 -0400

You can try downloading Spybot and Ad-aware, but honestly I do not think it
will fix all the problem. Pest Patrol is excellent and normally detects and
deletes pretty much everything. If you feel comfortable with the instruction
below, it will rid your friends PC of IESP.MHT

1. Shutdown Internet-Explorer, go to your Taskmanager and kill all processes
named IEXPLORE.EXE
2. Delete this Files:
C:\WINDOWS\system32\IEsp.mht
C:\WINDOWS\system32\msadocm32.dll
C:\WINDOWS\system32\sqlpool.dll

3. Change the Following Registry-Key to "about:blank" (without quotes)
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

4. Run regedit.exe and delete the following Registry Keys,or Run Hijackthis
and Scan and fix ONLY these entries if they exist:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF
285}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{0B519E07-7824-4adc-8890-93D5EABBF285}
or execute
reg.exe delete
HKLM\SOFTWARE\Classes\CLSID\{0B519E07-7824-4adc-8890-93D5EABBF285}

5. Delete the Value {0B519E07-7824-4adc-8890-93D5EABBF285} from
HKEY_CLASSES_ROOT\ADODB.Comand\CLSID\ 

-- 
Best of luck!
Michael D. Alligood
MCSA, MCP, CCNA, A+,
Network+, i-Net+, CIW A, CIW CI
"Jon_Dear" <Jon_Dear@comcast.com> wrote in message
news:mO-dnVSdqrlRF5jcRVn-rw@comcast.com...
> I just left an old friend (81) where I was trying to get his Win XP
computer
> working properly.  Somehow,  a malicious program has taken charge of his
> Internet Explorer, and every time he tries to get on the internet, he is
> sent to a Porn site. The only way we could get out of this was to click
> Ctl-Al-Del and bring up Task manager. His home page was Yahoo. When I
click
> on Tools/Internet Options/General/. the address in the home page box reads
> "C:\Windows\System32\IESP.MHT.  I looked in Exporer and located the
> file.After I got home, I checked my XP computer and there is no such file
> name in the folder.On his computer  I typed in the Home Page Box the
address
> for Yahoo, clicked on apply, and it took a long time to change the home
page
> address. However, after closing the tools dialog box, and reopening it, we
> were right back where we started.Anyone have any experience in something
> like this? Does anyone have the above file in their Windows/System32
Folder?
> I am  tempted to go to System Restore and go back 30 days to restore the
> system as it used to be.
> Any help will be appreciated.
>
> Jon
>
> P.S.  Has anyone tried Google popup blocker?
>
>
Quantcast