Ht - Ie Super-spider Again And Again...

Please help. My primary business computer security is compromised with the Super-Spider redirect. I've tried everything I can from the posts, but it keeps coming back. This is definitely not good. Will donate to the site. Thank you - Steveneedshelp in Mpls.

I'll follow a fix moderator Yellowhammer recommended for XxXPoison_GirlXxX on 8/1/04 for her orginal post "dayam Superspider" First he recommended "FINDnFIX" to run "iLOGI.bat" and post the results. Here's mine: »»»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»» Microsoft Windows XP [Version 5.1.2600] »»»IE build and last SP(s) 6.0.2800.1106 SP1-Q328389 The type of the file system is NTFS. C: is not dirty. Mon 02 Aug 04 15:35:12 3:35pm up 0 days, 1:05 »»»»»»'Dos devices'… Location Type Name/Units Attributes ====================================================== XXXX:XXXX CHAR NUL 1000000000000100 02DD:0000 CHAR XMSXXXX0 1010000000000000 0070:0024 CHAR CON 1000000000010011 0070:0036 CHAR AUX 1000000000000000 0070:0048 CHAR PRN 1010100011000000 0070:005A CHAR CLOCK$ 1000000000001000 0070:006C CHAR COM1 1000000000000000 0070:007E CHAR LPT1 1010100011000000 0070:0090 CHAR LPT2 1010100011000000 0070:00A2 CHAR LPT3 1010100011000000 0070:00B4 CHAR COM2 1000000000000000 0070:00C6 CHAR COM3 1000000000000000 0070:00D8 CHAR COM4 1000000000000000 ====================================================== »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. You must know how to ID the file based on the filters provided in the scan, as not all the files flagged are bad. Ex: read only files, s/h files, last modified date. size, etc. The filters provided should help narrow down the list, and hopefully pinpoint the culprit. Along with that,registry scan logged at the end should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove without attempting to confirm it's nature! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» At times there could be several (legit) files flagged, and/or duplicate culprit file(s)! If in doubt, always search the file(s) and properties according to criteria! The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder »»»»»»»»»»»»»»»»»»***LOG!***(*updated 8/02)»»»»»»»»»»»»»»»» »»»*»»»*Use at your own risk!»»»*»»»* Scanning for file(s)… »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ……… »»Locked or 'Suspect' file(s) found… »»»»» (*2*) »»»»»…….. »»»»» (*3*) »»»»»…….. C:\WINDOWS\SYSTEM32\ bridge.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K d2kpax.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K jac.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K msxslab.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K nv4_disp.dll Tue Mar 23 2004 9:04:00p A…R 4,274,560 4.07 M nvcod.dll Tue Mar 23 2004 9:04:00p A…R 32,256 31.50 K nvcodins.dll Tue Mar 23 2004 9:04:00p A…R 32,256 31.50 K nvcpl.dll Tue Mar 23 2004 9:04:00p A…R 3,309,568 3.16 M nview.dll Tue Mar 23 2004 9:04:00p A…R 1,335,296 1.27 M nvinstnt.dll Tue Mar 23 2004 9:04:00p A…R 131,072 128.00 K nvmctray.dll Tue Mar 23 2004 9:04:00p A…R 46,080 45.00 K nvnt4cpl.dll Tue Mar 23 2004 9:04:00p A…R 241,664 236.00 K nvoglnt.dll Tue Mar 23 2004 9:04:00p A…R 4,874,240 4.65 M nvrsar.dll Tue Mar 23 2004 9:04:00p A…R 200,704 196.00 K nvrscs.dll Tue Mar 23 2004 9:04:00p A…R 143,360 140.00 K nvrsda.dll Tue Mar 23 2004 9:04:00p A…R 151,552 148.00 K nvrsde.dll Tue Mar 23 2004 9:04:00p A…R 163,840 160.00 K nvrsel.dll Tue Mar 23 2004 9:04:00p A…R 163,840 160.00 K nvrseng.dll Tue Mar 23 2004 9:04:00p A…R 147,456 144.00 K nvrses.dll Tue Mar 23 2004 9:04:00p A…R 163,840 160.00 K nvrsesm.dll Tue Mar 23 2004 9:04:00p A…R 172,032 168.00 K nvrsfi.dll Tue Mar 23 2004 9:04:00p A…R 143,360 140.00 K nvrsfr.dll Tue Mar 23 2004 9:04:00p A…R 167,936 164.00 K nvrshe.dll Tue Mar 23 2004 9:04:00p A…R 196,608 192.00 K nvrshu.dll Tue Mar 23 2004 9:04:00p A…R 151,552 148.00 K nvrsit.dll Tue Mar 23 2004 9:04:00p A…R 167,936 164.00 K nvrsja.dll Tue Mar 23 2004 9:04:00p A…R 172,032 168.00 K nvrsko.dll Tue Mar 23 2004 9:04:00p A…R 172,032 168.00 K nvrsnl.dll Tue Mar 23 2004 9:04:00p A…R 159,744 156.00 K nvrsno.dll Tue Mar 23 2004 9:04:00p A…R 147,456 144.00 K nvrspl.dll Tue Mar 23 2004 9:04:00p A…R 147,456 144.00 K nvrspt.dll Tue Mar 23 2004 9:04:00p A…R 155,648 152.00 K nvrsptb.dll Tue Mar 23 2004 9:04:00p A…R 159,744 156.00 K nvrsru.dll Tue Mar 23 2004 9:04:00p A…R 155,648 152.00 K nvrssk.dll Tue Mar 23 2004 9:04:00p A…R 147,456 144.00 K nvrssl.dll Tue Mar 23 2004 9:04:00p A…R 155,648 152.00 K nvrssv.dll Tue Mar 23 2004 9:04:00p A…R 147,456 144.00 K nvrstr.dll Tue Mar 23 2004 9:04:00p A…R 151,552 148.00 K nvrszhc.dll Tue Mar 23 2004 9:04:00p A…R 147,456 144.00 K nvrszht.dll Tue Mar 23 2004 9:04:00p A…R 77,824 76.00 K nvshell.dll Tue Mar 23 2004 9:04:00p A…R 454,656 444.00 K nvwddi.dll Tue Mar 23 2004 9:04:00p A…R 36,864 36.00 K nvwdmcpl.dll Tue Mar 23 2004 9:04:00p A…R 1,617,920 1.54 M nvwimg.dll Tue Mar 23 2004 9:04:00p A…R 1,019,904 996.00 K nvwrsar.dll Tue Mar 23 2004 9:04:00p A…R 233,472 228.00 K nvwrscs.dll Tue Mar 23 2004 9:04:00p A…R 233,472 228.00 K nvwrsda.dll Tue Mar 23 2004 9:04:00p A…R 245,760 240.00 K nvwrsde.dll Tue Mar 23 2004 9:04:00p A…R 253,952 248.00 K nvwrsel.dll Tue Mar 23 2004 9:04:00p A…R 278,528 272.00 K nvwrseng.dll Tue Mar 23 2004 9:04:00p A…R 237,568 232.00 K nvwrses.dll Tue Mar 23 2004 9:04:00p A…R 278,528 272.00 K nvwrsesm.dll Tue Mar 23 2004 9:04:00p A…R 270,336 264.00 K nvwrsfi.dll Tue Mar 23 2004 9:04:00p A…R 249,856 244.00 K nvwrsfr.dll Tue Mar 23 2004 9:04:00p A…R 270,336 264.00 K nvwrshe.dll Tue Mar 23 2004 9:04:00p A…R 229,376 224.00 K nvwrshu.dll Tue Mar 23 2004 9:04:00p A…R 262,144 256.00 K nvwrsit.dll Tue Mar 23 2004 9:04:00p A…R 270,336 264.00 K nvwrsja.dll Tue Mar 23 2004 9:04:00p A…R 176,128 172.00 K nvwrsko.dll Tue Mar 23 2004 9:04:00p A…R 163,840 160.00 K nvwrsnl.dll Tue Mar 23 2004 9:04:00p A…R 262,144 256.00 K nvwrsno.dll Tue Mar 23 2004 9:04:00p A…R 249,856 244.00 K nvwrspl.dll Tue Mar 23 2004 9:04:00p A…R 245,760 240.00 K nvwrspt.dll Tue Mar 23 2004 9:04:00p A…R 270,336 264.00 K nvwrsptb.dll Tue Mar 23 2004 9:04:00p A…R 266,240 260.00 K nvwrsru.dll Tue Mar 23 2004 9:04:00p A…R 262,144 256.00 K nvwrssk.dll Tue Mar 23 2004 9:04:00p A…R 245,760 240.00 K nvwrssl.dll Tue Mar 23 2004 9:04:00p A…R 249,856 244.00 K nvwrssv.dll Tue Mar 23 2004 9:04:00p A…R 245,760 240.00 K nvwrstr.dll Tue Mar 23 2004 9:04:00p A…R 249,856 244.00 K nvwrszhc.dll Tue Mar 23 2004 9:04:00p A…R 135,168 132.00 K nvwrszht.dll Tue Mar 23 2004 9:04:00p A…R 139,264 136.00 K system32.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K 72 items found: 72 files (5 H/S), 0 directories. Total of file sizes: 28,113,280 bytes 26.81 M unknown/hidden files… C:\WINDOWS\SYSTEM32\ bridge.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K d2kpax.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K jac.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K msxslab.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K system32.dll Sun Aug 1 2004 9:48:36p ..SHR 0 0.00 K 5 items found: 5 files, 0 directories. Total of file sizes: 0 bytes 0.00 K »»»»» (*4*) »»»»»……… Sniffing………. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\BRIDGE.DLL Sniffed -> C:\WINDOWS\SYSTEM32\D2KPAX.DLL Sniffed -> C:\WINDOWS\SYSTEM32\JAC.DLL Sniffed -> C:\WINDOWS\SYSTEM32\MSXSLAB.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NV4_DISP.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVCOD.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVCODINS.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVCPL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVIEW.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVINSTNT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVMCTRAY.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVNT4CPL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVOGLNT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSAR.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSCS.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSDA.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSDE.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSEL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSENG.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSES.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSESM.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSFI.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSFR.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSHE.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSHU.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSIT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSJA.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSKO.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSNL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSNO.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSPL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSPT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSPTB.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSRU.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSSK.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSSL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSSV.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSTR.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSZHC.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVRSZHT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVSHELL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWDDI.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWDMCPL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWIMG.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSAR.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSCS.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSDA.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSDE.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSEL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSENG.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSES.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSESM.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSFI.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSFR.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSHE.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSHU.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSIT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSJA.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSKO.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSNL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSNO.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSPL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSPT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSPTB.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSRU.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSSK.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSSL.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSSV.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSTR.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSZHC.DLL Sniffed -> C:\WINDOWS\SYSTEM32\NVWRSZHT.DLL Sniffed -> C:\WINDOWS\SYSTEM32\SYSTEM32.DLL SNiF 1.34 statistics Matching files : 72 Amount in bytes : 28113280 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(*5*)»»»»» »»»»»(*6*)»»»»» »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size… No matches found. No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»Size of Windows key: (*Default-450 *No AppInit-398 *fake(infected)-448,504,512…) Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 486 »»Dumping Values…….. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ sn95o5tb3wm3yw.tlb HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = sn95o5tb3wm3yw.tlb DeviceNotSelectedTimeout = 15 GDIProcessHandleQuota = REG_DWORD 0x00002710 Spooler = yes swapdisk = TransmissionRetryTimeout = 90 USERProcessHandleQuota = REG_DWORD 0x00002710 »»Security settings for 'Windows' key: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: (NI) ALLOW Read BUILTIN\Users (IO) ALLOW Read BUILTIN\Users (NI) ALLOW Read BUILTIN\Power Users (IO) ALLOW Read BUILTIN\Power Users (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access BUILTIN\Administrators (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access BUILTIN\Administrators (IO) ALLOW Full access CREATOR OWNER Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: Read BUILTIN\Users Read BUILTIN\Power Users Full access BUILTIN\Administrators Full access NT AUTHORITY\SYSTEM »»Member of…: (Admin logon required!) User is a member of group TANDEM-V5416X4N\None. User is a member of group \Everyone. User is a member of group BUILTIN\Administrators. User is a member of group BUILTIN\Users. User is a member of group \LOCAL. User is a member of group NT AUTHORITY\INTERACTIVE. User is a member of group NT AUTHORITY\Authenticated Users. »»»»»»Backups created…»»»»»» 3:35pm up 0 days, 1:06 Mon 02 Aug 04 15:35:35 A C:\FINDnFIX\keyback.hiv –a– - - - - - 8,192 08-02-2004 keyback.hiv A C:\FINDnFIX\keys1\winkey.reg –a– - - - - - 305 08-02-2004 winkey.reg *Temp backups… . .. keyback2.hi_ winkey2.re_ C:\FINDNFIX\ JUNKXXX Mon Aug 2 2004 3:32:38p .D… 1 item found: 0 files, 1 directory. »»Performing string scan…. 00001150: ? 00001190: N vk & f AppInit_ 000011D0:DLLs G s n 9 5 o 5 t b 3 w m 3 y w . t l b 4 00001210: vk @ UDeviceNotSelectedTimeout 1 5 @ 00001250: 9 0 | vk ' zGDIProcessHandleQuota" 00001290: vk Spooler2 y e s n ` 000012D0: vk =pswapdisk vk P R 00001310:TransmissionRetryTimeout ` H vk 00001350: ' SqUSERProcessHandleQuota . <| e V u t' 00001390:> u"j Y M e t j l 3 M j X^d V d =| 000013D0:i =|^ c <| d QQSVW e u Au ^, S L =| 3 SP F 00001410:F F F w E ~( F t G G Sj P F . ! =|w 00001450: G Sj P x F / =|w G$Sj P [ F G F G ~( 00001490: F t G( G) F | | f G.P G*P G+P F P G/P 000014D0: G,P G-P F$P M _^d [ M ? j j h# <| wc 00001510: x E V u F e h =| | =| |v s | F V $v 00001550: M ^d D$ V F =| s F V ^ . <| b V u 00001590: t' > u"j Y M e t j R 3 M j X^d <| 000015D0: b x E V u F e h =| | =| u 6s ———- WIN.TXT fùAppInit_DLLs֍æGÐÿÿÿs ————– ————– $011C8: AppInit_DLLs $01227: UDeviceNotSelectedTimeout $01277: zGDIProcessHandleQuota $01310: TransmissionRetryTimeout $0135E: SqUSERProcessHandleQuota ————– ————– sn95o5tb3wm3yw.tlb ————– ————– REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="sn95o5tb3wm3yw.tlb" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 ———— Dos mem debug… Segment Size Owner Type Vectors ======================================================= 020D 020C0 IO SYSTEM DATA 041A 00A20 COMMAND PROGRAM 22 23 24 2E DA 04BD 00070 MSDOS FREE 04C5 00440 COMMAND ENVIRONMENT 050A 00370 MSDOS FREE 0542 00840 LMEM PROGRAM D8 05C7 9A380 MSDOS FREE ======================================================= 

Hi and welcome to the forum.

Step # 1

Please download and run CWShredder. Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

http://www.majorgeeks.com/download4086.html

Step #2

Then please boot to safe mode (tap f8 while bios loads) the scan with hijackthis again and put a check besdie these lines and choose FIX.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://super-spider.com/hp.htm?id=543

O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\l7waov0er2x4.dll

O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll
O4 - Global Startup: winlogin.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O20 - AppInit_DLLs: sn95o5tb3wm3yw.tlb

Then while still in safe mode delete this file. How to show hidden files >>> http://www.xtra.co.nz/help/0,,4155-1916458,00.html

winlogin.exe<<PLEASE NOTE Notice this bad file has an i where the real file has an o which can be seen here >>> winlogon.exe. Do not delete the file with the O but the one with the i or you will not be able to logon anymore.

REBOOT

Please do a scan here >>> http://www.spywareinfo.com/xscan.php

Reboot and post a new HiJackThis log.

Looks good How is it running? Any issues?

Ok you ready for the fireside chat?

If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. In my signature below is also a tutorial on how to harden IE, a good read and very helpful to stop these things in the future. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on.

Safe Surfing.

Man - who ARE you guys? You're lifesavers! Are you from the planet Krypton? Amazing - just when things looked the blackest, you saved the day. Its VERY heartening to know there's guys out there like you looking out for the rest of us… Screw Kerry and Bush, I'm voting for you! Thanks again. Steve - Mpls.

No problem glad we could help.

I am glad that we were able to help! I am closing this topic now, but if you need it reopened, please send an email to the following link(Click for address) with the Subject line of the email "Reopen".
To receive a response, please include in your email: the user name used in the post, details of why you need it reopened, and a valid link to the post.

Emails with bad links to the post, emails that are not from the original poster, and emails that do not have "ReOpen" as the subject line, will be deleted without being opening.

Please start a New Topic if this is not your thread. Thank-you for your co-operation.