Mom's Computer Hijacked - A Little Help Please?

Hello, I got here at the suggestion of an IT guy in my company. My mom is just getting into the world of computers and going online. She has a new computer with XP. About a week ago she complained that her homepage changed, all the icons were for porn, etc. I confirmed it was hijacked and did the following: - ran her Norton which cleaned up several viruses she'd never had before. - loaded and ran the latest adaware. - loaded and ran 30-day SpySweeper trial. - loaded and ran that Microsoft beta spysweeper (I forget the name at the moment) After doing this, I was able to redirect her homepage, but SpySweeper continually pops up at startup saying it's trying to load EliteToolbar. Also, if I connect to the net, I get a fake popup that looks like a DOS screen. It says it found several bad sounding files and gives a button to click to "remove" them. I know you can't put a button on a DOS command line, and DOS doesn't open in an IE window, but mom didn't and said she had previously clicked it. I think that's how she got infected. Now, adaware continually finds the same files, and Elite Toolbar tries to load automatically. I went online for an Elite Toolbar fix and found some sites telling me delete a few processes/dlls/files but nothing has worked. Is it safe to say I now resort to HijackThis? If so, am I in the right place for help? I'm not versed in it at all.

Hello Cam2 and welcome to TomCoyote.

Please download HijackThis 1.99.0 from here. Save the file to your desktop.

Double click HijackThis_sfx.exe and select Unzip. When done click "OK".
Close the WinZip self Extractor window.

Navigate to C:\Program Files\HijackThis and double click HijackThis.exe. Scan with HijackThis and post the new log as a reply to this thread.

Hi Alan, Thanks for the response. I needed to get this done pretty quickly and have been working with folks on another forum . . . almost done. Thanks again, and I'll be back should there be future problems.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.