What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser Hijacked

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Thanks in advance for your help.Thanks to my daughter :angry: I now have had my browser hijacked.Managed,somehow,to restore my homepage yesterday.Worked fine even after restarting computer several times.Then the daughter got on and,once again my homepage has been changed.
Here is my Hijack This log:

Logfile of HijackThis v1.97.7
Scan saved at 3:09:28 PM, on 11/27/2004
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\ROLAND\VSC32\VSC32CNF.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\WIRELESS\CLIENT MANAGER\CMAGS.EXE
C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
C:\PROGRAM FILES\802.11 WIRELESS LAN\WLANMONITOR.EXE
C:\NEW FOLDER\HIJACKTHIS.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EarthLink Network, Inc
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\6mprt11a.slt\prefs.js)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN4\YCOMP5_5_7_0.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {2C5175A2-ADF3-4F57-AB70-BA90FD60A383} - C:\PROGRAM FILES\IESEARCHTOOLBAR\0.8\IESEARCHTOOLBAR.DLL (file missing)
O2 - BHO: (no name) - {A9BB4279-4060-11D9-B6D5-00026632DEBE} - C:\WINDOWS\SYSTEM\EPLL.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN4\YCOMP5_5_7_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "c:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KodakCCS] C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Webkeys Prowler] "C:\PROGRA~1\WEBKEY~1\PROWLER.EXE"
O4 - Startup: Wireless Client Manager.lnk = C:\Program Files\Wireless\Client Manager\CMAGS.EXE
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: Configuration & Monitor Utility.lnk = C:\Program Files\802.11 Wireless LAN\WlanMonitor.exe
O4 - Startup: SpySubtract.lnk.disabled
O4 - Startup: Kodak EasyShare software.lnk.disabled
O4 - Startup: KODAK Software Updater.lnk.disabled
O4 - Startup: Office Startup.lnk.disabled
O4 - Startup: Internet Answering Machine.lnk.disabled
O4 - Startup: Microsoft Find Fast.lnk.disabled
O4 - Startup: Webshots.lnk.disabled
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…ymmapi_0727.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Macromedia Shockwave Director Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7917.1886921296
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/d/4…0367/wmavax.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://www.contentwatch.com/audit/includes…uditControl.cab
Post #2
Not a nice one. But I think we can get rid of it.

There is a newer of HijackThis1.98.2 Download it here
Please scan with this version be for posting again.

If you are on a network or have a full-time connection to the Internet, such as a DSL or cable modem, disconnect the computer from the network and Internet. Disable or password-protect file sharing, or set the shared files to Read Only, before reconnecting the computers to the network or to the Internet. Because this worm spreads by using shared folders on networked computers, to ensure that the worm does not re-infect the computer after it has been removed, Symantec suggests sharing with Read Only access or by using password protection.
Download FxAgentB.exe from HERE and save it to your desktop. After downloading, double-click the FxAgentB file to run it and the program will scan your entire hard drive - this may take a while. When it is done, it will generate a log file called FxAgentB.log - save that information as you will need to paste it here later. Reboot when done.

Next click HERE to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1. Reboot when done.

Then click HERE to download Ad-Aware SE and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Click "Start", select "Perform Full System scan" and "Next" to start the scan. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done, rescan with HijackThis and post a new log here, together with the FxAgentB log.
Post #3
Ok……..ran CWSHREDDER this afternoon and got rid of the hijacker.I have since downloaded FIXAGENTB and this is my log. Symantec Backdoor.Agent.B Removal Tool 1.0.1.2 process: FXAGENTB.EXE, thread: FF07BF89 (terminated) c:\WINDOWS\SYSTEM\D3DFNBC.DLL: (will be deleted on next reboot) The Backdoor.Agent.B removal was successful. The system will delete 1 Backdoor.Agent.B files from your PC on next reboot. Here is the report: 1 file(s) could not be deleted. They will be deleted on next reboot. The total number of the scanned files: 24421 The number of deleted files: 0 The number of viral processes terminated: 0 The number of viral threads terminated: 1 The number of registry entries fixed: 0 The tool initiated a system reboot. Will next download latest version of HIJACK THIS and post the new report to see what has changed. MANY THANKS Pete
Post #5
Here is latest HIJACKTHIS log

Logfile of HijackThis v1.98.2
Scan saved at 8:11:54 PM, on 11/27/2004
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\ROLAND\VSC32\VSC32CNF.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\WIRELESS\CLIENT MANAGER\CMAGS.EXE
C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
C:\PROGRAM FILES\802.11 WIRELESS LAN\WLANMONITOR.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\NEW FOLDER\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EarthLink Network, Inc
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\6mprt11a.slt\prefs.js)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN4\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: IE Search Toolbar Helper - {2C5175A2-ADF3-4F57-AB70-BA90FD60A383} - C:\PROGRAM FILES\IESEARCHTOOLBAR\0.8\IESEARCHTOOLBAR.DLL (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN4\YCOMP5_5_7_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "c:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KodakCCS] C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Webkeys Prowler] "C:\PROGRA~1\WEBKEY~1\PROWLER.EXE"
O4 - Startup: Wireless Client Manager.lnk = C:\Program Files\Wireless\Client Manager\CMAGS.EXE
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: Configuration & Monitor Utility.lnk = C:\Program Files\802.11 Wireless LAN\WlanMonitor.exe
O4 - Startup: SpySubtract.lnk.disabled
O4 - Startup: Kodak EasyShare software.lnk.disabled
O4 - Startup: KODAK Software Updater.lnk.disabled
O4 - Startup: Office Startup.lnk.disabled
O4 - Startup: Internet Answering Machine.lnk.disabled
O4 - Startup: Microsoft Find Fast.lnk.disabled
O4 - Startup: Webshots.lnk.disabled
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0819.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0819.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…ymmapi_0727.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://www.contentwatch.com/audit/includes…uditControl.cab
O18 - Filter: text/html; charset=iso-8859-1 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-2 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-3 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-4 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-5 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-6 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-7 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-8 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-9 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1250 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1251 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1252 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1253 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1254 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1255 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1256 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1257 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1258 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-874 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=koi8-r - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=koi8-ru - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=ibm852 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=cp866 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=utf-7 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=utf-8 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-1 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-2 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-3 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-4 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-5 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-6 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-7 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-8 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-9 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1250 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1251 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1252 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1253 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1254 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1255 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1256 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1257 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1258 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-874 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=koi8-r - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=koi8-ru - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=ibm852 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=cp866 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=utf-7 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=utf-8 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O21 - SSODL: eplrr9 - {8A042600-0BC9-11D9-B6D4-98416010B270} - C:\WINDOWS\SYSTEM\eplrr9.dll (file missing)
Post #7
Close all Browser and Program Windows and have HijackThis fix the following.
Do this by checking the box beside each and then clicking on Fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

O2 - BHO: IE Search Toolbar Helper - {2C5175A2-ADF3-4F57-AB70-BA90FD60A383} - C:\PROGRAM FILES\IESEARCHTOOLBAR\0.8\IESEARCHTOOLBAR.DLL (file

O18 - Filter: text/html; charset=iso-8859-1 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-2 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-3 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-4 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-5 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-6 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-7 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-8 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=iso-8859-9 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1250 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1251 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1252 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1253 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1254 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1255 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1256 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1257 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-1258 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=windows-874 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=koi8-r - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=koi8-ru - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=ibm852 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=cp866 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=utf-7 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html; charset=utf-8 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-1 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-2 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-3 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-4 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-5 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-6 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-7 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-8 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=iso-8859-9 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1250 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1251 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1252 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1253 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1254 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1255 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1256 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1257 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-1258 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=windows-874 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=koi8-r - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=koi8-ru - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=ibm852 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=cp866 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=utf-7 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)
O18 - Filter: text/html;charset=utf-8 - {E8D62140-5A0E-11D2-83B2-00609710F880} - (no file)

O21 - SSODL: eplrr9 - {8A042600-0BC9-11D9-B6D4-98416010B270} - C:\WINDOWS\SYSTEM\eplrr9.dll (file missing)
Then Download System Security Suite. Extract it from the zip file into a folder.
http://www.igorshpak.net/software/3ssetup104.zip
Under "items to clear" click all. Then click "clear selected items"

Reboot and Rescan with HJT and post a new log here.
Also please describe how your computer behaves at the moment.
Post #8
To answer and earlier question……I ran HIJACKTHIS first followed by CWSHREDDER….then finally FIXAGENTB.
Here is the most recent log(after removing what you suggested) from HIJACKTHIS

Logfile of HijackThis v1.98.2
Scan saved at 8:57:55 PM, on 11/27/2004
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\ROLAND\VSC32\VSC32CNF.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\WIRELESS\CLIENT MANAGER\CMAGS.EXE
C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
C:\PROGRAM FILES\802.11 WIRELESS LAN\WLANMONITOR.EXE
C:\WINDOWS\DESKTOP\NEW FOLDER\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EarthLink Network, Inc
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\6mprt11a.slt\prefs.js)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN4\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN4\YCOMP5_5_7_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "c:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KodakCCS] C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Webkeys Prowler] "C:\PROGRA~1\WEBKEY~1\PROWLER.EXE"
O4 - Startup: Wireless Client Manager.lnk = C:\Program Files\Wireless\Client Manager\CMAGS.EXE
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: Configuration & Monitor Utility.lnk = C:\Program Files\802.11 Wireless LAN\WlanMonitor.exe
O4 - Startup: SpySubtract.lnk.disabled
O4 - Startup: Kodak EasyShare software.lnk.disabled
O4 - Startup: KODAK Software Updater.lnk.disabled
O4 - Startup: Office Startup.lnk.disabled
O4 - Startup: Internet Answering Machine.lnk.disabled
O4 - Startup: Microsoft Find Fast.lnk.disabled
O4 - Startup: Webshots.lnk.disabled
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0819.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0819.DLL
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…ymmapi_0727.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://www.contentwatch.com/audit/includes…uditControl.cab
Post #9
Well Pete nice clean up. :thumbup:
Please read through the ideas and free software listed below that will help to keep your computer clean.
Some of these you may already have installed or may have done already.

Install a firewall.ZoneAlarm FREE

Ensure that an Antivirus is updated weekly and running. You only need one.
AVG antivirus from Grisoft is a very good FREE antivirus program.

Make sure you have the latest critical updates from windows update.

SpywareBlaster will prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.

IE-SPYAD puts over 4000 known 'bad' sites into your IE restricted zone so that they cannot install malware on your PC.

Google toolbar has a very good built in popup blocker with a nice search bar. To provide privacy, select disable advanced features when installing.

Check your system for latest virus definitions with an online virus scan every week or two.
TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan

Check your system for latest trojan definitions with an Online trojan scan also every week or two.

And also see this link for additional security information.
So how did I get infected in the first place?

Please consider using Firefox
http://texturizer.net/firefox/index.html

Please read this

Post back if you need any more help.
Post #10
THANK YOU so VERY MUCH…………I'm still learning about these things….not afraid to try stuff.Very glad to have this forum around…….will keep it in my Favorites………now to just free up some hard drive space. Pete
Post #11
Glad we could help :D

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI