Re: Browser Hijacked - Any Help Appreciated!!

Hi AG :-)

First, Go to Start> Run and type CMD
In the command window type
netsh winsock reset

Then download and install BHODemon from
http://www.definitivesolutions.com/bhodemon.htm
Your problem may be caused by a bad BHO.

Be aware, your Anti-Virus won't detect all types of warez, Trojans, malware,
worms, etc and neither can other adware or spyware related programs such as
AdAware and SpyBot. They don't have the proper definitions. So even if you
run it and nothing shows up, it does not mean your system is clean. It
takes a series of programs to fully clean your machine. Some very aggressive
and damaging variants of malware can replicate themselves repeatedly, or
mutate, if not removed properly. Follow the steps here:

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm

Then visit these two sites to test for parasites and help basic cleaning:
On-Line Check
http://aumha.org/a/noads.htm
and
Quick-Fix Protocol.
http://aumha.org/a/quickfix.php

Also download and install HiJackThis -
This will show i f you have any other nasties on your system, , what kind
and where.

How to download and install HiJackThis:
http://www.majorgeeks.com/HijackThis_d3155.html

Please DO NOT post your log to this newsgroup. It is important that you go
to one of the HiJackThis Support Forums below and allow the experts there
to analyze it for you.:
AumHa HiJackThis Forum
http://forum.aumha.org/viewforum.php?f=30
or HJT - CastleCops
http://castlecops.com/f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html
to allow the experts there to evaluate your log and advise you of any
necessary steps to clean your system.
(Note: You will have to Register before posting on these Forums. Please
follow all posting instructions carefully to avoid having your log deleted
or ignored. All responders are volunteers and they are very busy, so please
be patient.)

Please post a link back here to your log at the fourm where you posted it so
that we can follow your progress.

Hope this helps.

Jan :)
MS MVP - Windows IE [DTS/AumHa]
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm


\> Hello. I've picked up a nasty piece of spyware which redirects Google
searches to premium search sites. Also, when I initially run Internet
Explorer 6, it will somtimes pop up with an error message that says
that lexplore has caused an error in <unknown>, which is clearly the
spyware masking it's name/file extension. I have tired spybot, adaware,
spysubtract, AVG virus scan, Panda Virus Scan, and a few others, and
nothing has cleaned it. Hijack This came up with one item that looked
suspicious, I deleted it, but the problem came back. It appears that
this <unknown> program continues to boot upon start up - I caught it
doing so by doing a ctl-alt-del every few seconds to see what was
loading. HOWEVER, it appears to be masking it's identity in msgconfig.
I've run a program which lists all start up programs, but I'm not sure
I've found anything there either.

I've seen other users post about similar problems. Has ANYONE recorded
the specific file locations/start up names of the spyware I've got on
my system? It's a pretty nasty one, it seems.

ANY help would be appreciated.

Thanks again!



.