please help...ready to give up

hi! i've installed & run ad-aware, spybot s&d, spyware blaster, & spywareguard. some problems have disappeared, but i still have a problem of something taking over my ie when i open it (a highjacker i guess?). it makes my homepage change to "about: blank" and it sends several different pop ups telling me "your pc may be infected with spyware". ad-aware seems to take care of the problem - the first time i open ie after i run ad-aware it works fine. then i close ie. then when i open it again the problem is back. so i run ad-aware again & it finds the same 8 objects and the cycle continues. any suggestions?
thanks!

 

Hi jaclac01

Could you please check this link:

https://www.wilderssecurity.com/showthread.php?t=15913

...go to Step 2 (since you've already used Adaware) and post a HijackThis log here.

 

here is my log. thanks for helping!

Logfile of HijackThis v1.97.7
Scan saved at 3:48:17 PM, on 7/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
c:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Owner\My Documents\ad aware & spybot logs\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {CF7F0012-13B2-41C5-8164-404271D9D002} - C:\WINDOWS\System32\epnj.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O10 - Broken Internet access because of LSP provider 'spsublsp.dll' missing
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38182.437650463

 

Could you please download this version of HijackThis ( 1.98 ):

https://www.wilderssecurity.com/supportfiles/HijackThis1980hf.exe

Next:

Copy the contents of the quote box to Notepad.
Name the file Appinit.bat
Save as type All Files
Save on the Desktop.

Double click on Appinit.bat
This will create a file on the desktop named windows.txt
Copy and paste that log here along with a new HJT log (using version 1.98 ).

 

i'm not able to open notepad. i get a message saying the NTVDM CPU has encountered illegal instruction. and if i close it or ignore notepad will not open. i tried to save the quote to word as type all files, but that wasn't an option so i just saved it as word. then nothing happened when i clicked on the appinit.bat on the desk top. what should i do now?

 

That sounds as if your Notepad is corrupted/infected in some way. You have at least two copies of Notepad - they should be 65 KB in size. You'll find them here:

C:\WINDOWS\System32\notepad.exe
C:\WINDOWS\notepad.exe

Open Windows Explorer and navigate to C:\WINDOWS\notepad.exe - doubleclick it and see if it works. If it works, copy the working version of Notepad to C:\WINDOWS\System32. Copies of Notepad can also be found here:

http://www.spywareinfoforum.com/~merijn/winfiles.html#notepad

 

regf




(
Ô ÿÿ ÿÿ §p P §pS H L W A P I . d l l ²%lf hbin  ¨ÿÿÿnk, ˜Ã\Ä
ÿÿÿÿ ÿÿÿÿÿÿÿÿ ø x ÿÿÿÿ 0 @ 0 x  Windows ÿÿÿsk x x
Ô
„¸ È   ¤    
  !  €
  !  ? 
    
    ? 

  

  


  

 Øÿÿÿvk @


fùAppInit_DLLsÖæG¸ÿÿÿC : \ W I N D O W S \ S y s t e m 3 2 \ h l p j k a n . d l l 0  h
Ðÿÿÿvk  

ÀUDeviceNotSelectedTimeoutðÿÿÿ1 5  ( ðÿÿÿ9 0  ë=tÀÐÿÿÿvk  €' 
zGDIProcessHandleQuota"þàÿÿÿvk  €

°ºSpooler2ðÿÿÿy e s
Ñ_å h
à
0 ` ¨ àÿÿÿvk  €

5swapdiskÐÿÿÿvk  

. TransmissionRetryTimeoutàÿÿÿh
à
0 ` ¨ È  Ðÿÿÿvk  €' 
R USERProcessHandleQuota2 ¸ (
Ô

Cr
Crb r o w s e l c . d l l C : \ W I N D O W S \ S y s t e m 3 2 \ b r o w s e l c . d l l (
Ô

éu €
éuS X S . D L L C : \ W I N D O W S \ S y s t e m 3 2 \ S X S . D L L (
Ô   y ` yM S C O R E E . D L L C : \ W I N D O W S \ S y s t e m 3 2 \ M S C O R E E . D L L

Logfile of HijackThis v1.98.0
Scan saved at 9:19:08 AM, on 7/16/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
c:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\My Documents\ad aware & spybot logs\HijackThis1980hf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Owner\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {CF7F0012-13B2-41C5-8164-404271D9D002} - C:\WINDOWS\System32\epnj.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O18 - Filter: text/html - {F63CB716-1B08-4E4B-A876-3970C021F8A6} - C:\WINDOWS\System32\epnj.dll
O18 - Filter: text/plain - {F63CB716-1B08-4E4B-A876-3970C021F8A6} - C:\WINDOWS\System32\epnj.dll

 

Hi again

The malicious file is this one: C:\Windows\System32\hlpjkan.dll

Download CWShredder - don't run it yet:

http://www.spywareinfoforum.com/~merijn/files/CWShredder.exe

Download this file (hiving.zip) and then immediately sign off the internet and stay off until all steps are finished (pull the plug).

http://home8.inet.tele.dk/fbj/hiving.zip

Extract the batch file (hiving.bat) and run it. If you have script blocking enabled you will get a warning. Please allow this to run. The script is just producing a message box. Double click on the batch to run it. After a reboot the super hidden nasty file will no longer be loaded and will be visible. This will end the constant reinstall of about:Blank.

Restart into Safe mode, find and delete this file:

C:\Windows\System32\hlpjkan.dll

If the file is found but can't be deleted!
Create "Container" folder (e.g. C:\junk) Move it there, first:
1.)
-RightClick on it: properties
/Advanced/Security/permissions \
and take ownership giving yourself 'Full control'.
2.)-Right click the "Container" (C:\junk) folder itself. hit properties.
-Go to the security tab and click the advanced button.
-check the box to reset permissions on all child objects.
Hit apply. ok
Delete file+folder.

Once you have successfully deleted the file restart into Normal Windows mode.

Run CWShredder and click "Fix" rather than just "Scan". Once CWShredder has done its job reboot your computer.

Run hijackThis again, scan and post a fresh log here in your next reply.

Also please create a new Windows.txt (using the appinit.bat file you created earlier) and attach it so we can doublecheck.

 

Logfile of HijackThis v1.98.0
Scan saved at 5:02:30 PM, on 7/16/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
c:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Owner\My Documents\ad aware & spybot logs\HijackThis1980hf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE



regf




Pugf hbin  , R E G . E X E *ÿÿÿnk, ¶
H
~kÄ
ÿÿÿÿ ÿÿÿÿÿÿÿÿ À € ÿÿÿÿ 0 @ 0 x  WindowsowseFilesÿÿÿsk € €
Ô
„¸ È   ¤    
  !  €
  !  ? 
    
    ? 

  

  


  

 2 Ðÿÿÿvk  *


ÀUDeviceNotSelectedTimeoutðÿÿÿ1 5  (  p
Ðÿÿÿvk  €' 
zGDIProcessHandleQuota"þðÿÿÿ9 0  ë=tÀàÿÿÿvk  

°ºSpooler2ðÿÿÿy e s
Ñ_åàÿÿÿvk  €

5swapdisk p
¸
ø
( ` Ðÿÿÿvk  è


. TransmissionRetryTimeoutÐÿÿÿvk  €' 
R USERProcessHandleQuota2 àÿÿÿp
¸
ø
( `  Ô
 ä úÿ  ô úÿ  
úÿ  
úÿ  $
úÿ  4
úÿ  D
úÿ  T
úÿ  d
úÿ  t
úÿ  „
úÿ  ”
úÿ  ¤
úÿ  ´
úÿ  ä
úÿ  ô
úÿ   úÿ  úÿ ! D úÿ " T úÿ # d úÿ $ t úÿ % ” úÿ & ¤ Šô ' ´ úÿ ( Ô úÿ ) ä úÿ *  úÿ + $ úÿ , D úÿ - T úÿ . d úÿ / t úÿ 0 „ úÿ 1 ¤ úÿ 2 ´ úÿ 3 Ä úÿ 4 Ô úÿ 5 ô ‹` 6  úÿ 7  úÿ 8 $ úÿ 9 4 úÿ : D úÿ ; T úÿ < d úÿ = „ úÿ > ´ úÿ ?  úÿ @  ‹` A $ úÿ B 4 úÿ C D úÿ D T úÿ E t úÿ F ô úÿ G  úÿ H  úÿ I $ úÿ J 4 úÿ K D úÿ L T úÿ M d úÿ N t úÿ O „ úÿ P ” úÿ Q ¤ úÿ R ò úÿ ÿÿÿÿ  úÿ T úÿ U  úÿ V T úÿ W „ úÿ X ” úÿ Y ´ úÿ Z Ä úÿ [ Ô úÿ \ ä úÿ ] ô úÿ ^ 
úÿ _ 
úÿ ` $
úÿ a 4
úÿ b D
úÿ c T
úÿ d d
úÿ e t
úÿ f „
úÿ g ”
úÿ h ¤
úÿ i ´
úÿ j Ä
úÿ k Ô
úÿ l ä
úÿ m  úÿ n  úÿ o $ úÿ p ô úÿ q  úÿ r  úÿ s $ úÿ t 4 úÿ u D äG v Ô úÿ w D úÿ x Ä úÿ y Ô úÿ z ä úÿ { ô úÿ |  úÿ }  úÿ ~ $ úÿ  4 úÿ € D úÿ T úÿ ÿÿÿÿ Z úÿ ƒ üÿ „  üÿ … p üÿ † ð üÿ ÿÿÿÿ
üÿ ˆ üÿ ÿÿÿÿ À üÿ Š üÿ ‹ üÿ Œ 0 üÿ ÿÿÿÿ @ üÿ Ž úÿ  úÿ  úÿ ‘ $ úÿ ’ 4 úÿ “ Ô úÿ ” T
úÿ • t
úÿ – ”
úÿ — ¤
úÿ ˜ Ô
úÿ ™ ä
úÿ š  úÿ ›  úÿ œ $ úÿ D úÿ ž d úÿ Ÿ t úÿ * „ úÿ ¡ ¤ úÿ ¢ ´ úÿ £ Ä úÿ ¤ ä úÿ ¥ ô úÿ ¦  úÿ § $ úÿ ¨ T úÿ © d úÿ ª ” úÿ « ¤ úÿ ¬  úÿ * $ úÿ ® 4 úÿ ¯ D úÿ ° T úÿ ± d úÿ ² ” úÿ ³ ¤ úÿ ´ ´ úÿ ÿÿÿÿ ¼ úÿ ¶  úÿ ·  úÿ ¸ $ úÿ ¹ 4 # º T úÿ » d úÿ ¼ ¦ ºþ ÿÿÿÿ ¶ úÿ ¾ úÿ ¿  úÿ À  úÿ Á $ úÿ  4 úÿ à D 
Ä ô ä Å 
 Æ D

Ç T
Šý È d
úÿ É t
úÿ Ê ”
‹` Ë ¤
‹` Ì ´
‹` Í Ä
‹` Î  úÿ Ï ä  Ð d ƒ PÑ t @ Ò ” ‹` Ó ä úÿ Ô ô úÿ Õ  úÿ Ö  úÿ × $ úÿ Ø 4 úÿ Ù D úÿ Ú T úÿ Û f úÿ Ü † ƒ Pÿÿÿÿ ” úÿ Þ úÿ ß  úÿ à  ‹` á $ ‹` â 4 ‹` ã D ‹` ä T ‹` å d ‹` æ t ‹` ç „ ‹` è ” ‹` é ¤ ‹` ê ´ ‹` ë Ä ‹` ì Ô ‹` í ä ‹` î ô ‹` ï T
‹` ð d
‹` ñ t
‹` ò „
‹` ó t úÿ ô „ úÿ õ ” úÿ ö ¤ úÿ ÷ ´ úÿ ø Ä ‹` ù Ô ‹` ú T úÿ û d úÿ ü v ‹` ý Ø úÿ ÿÿÿÿ æ úÿ ÿ úÿ
 úÿ

 úÿ 
$ úÿ 
4 úÿ 
D úÿ 
T úÿ 
$
úÿ 
4
úÿ 
d
úÿ
t
úÿ

„
úÿ 
”
úÿ 
¤
úÿ

´
úÿ 
Ô ä 
” úÿ 
¤ úÿ 
² úÿ ÿÿÿÿ ¾ úÿ 
úÿ 
 úÿ 
 úÿ 
d úÿ 
t úÿ 
„ úÿ 
” úÿ 
¤ úÿ 
´ úÿ 
 úÿ ÿÿÿÿ Ò úÿ 
üÿ ÿÿÿÿ  üÿ
þÿ !
 úÿ "
 úÿ #
$ úÿ $
4 úÿ %
D úÿ &
T


does this look ok?

 

Your log is clean - you've done a great job

I should have told you to disable system restore before we started. Since I forgot you'll have to disable system restore now - reboot and enable it again to avoid the risc of recreating the infection by mistake. Instructions can be found here:

http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm

Also, I recommend you read this short article about safer surfing:

https://www.wilderssecurity.com/showthread.php?t=27971

Enjoy

 

everything is working great! thanks so much for the help! may i ask a few questions?

how many of you are there at this site to help us?

why do you all spend your time helping us?

if i wanted to become so knowledgable about computers as to understand all of this, where should i go to learn and how long would it take - would "comp usa" offer these kind of classes? college? technical school?

 

Good to hear that everything works fine.

1. I don't know how many helpers are here at Wilders - not all helpers are active at all time. As you can see from the number of posts I've made, I'm not helping out too often here at Wilders. I have my own forum in Denmark that keeps me busy - however, it's closed for sommer maintenance, which is why I'm here more often these days. A Wilders adminstrator might be able to answer that.

2. Why.... to fight back against those who produce the malware that takes the freedom out of the internet by hijacking our browsers. Hmmm - well to tell you the truth, it's a combination of a lot of things. It's also the satisfaction of solving a problem and getting the acknowledgement afterwards (like you last post). It's rewarding when people appreciate your efforts. And of course a general interest in what computers do, how they work etc.

3. I don't really know "Comp USA". At spywareinfoforum.com and tomcoyote.org forums are set up for learning/teaching. You might want to check "Boot camp" and "Classroom":

http://www.spywareinfoforum.com/index.php?showtopic=34
http://forums.tomcoyote.org/index.php?showtopic=1421

That would be a good place to start. Reading through a lot of threads here at Wilders or in other similar forums will give you an idea about the spyware issue in general and some of the tricks of the trade.

Happy surfing