What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need Help Please - Nameserver Redirect - I Can't Fix It!

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello, and thank you, in advance, for your help.

Basically, both Explorer & FireFox are acting weird. If I misspell a domain name or go to a non-existent website like gkljhjhaslkjgdlk.com, I get a message that the domain name gkljhjhaslkjgdlk.com is either misspelled or does not exit (well that's nice). But then I get redirected to sometimes a regular pay per click landing page or sometimes a real nasty porn one (I'm thinking my teenage son help get me this virus).

I can't seem to get to Amazon.com at all even through Google. I think the Hijackers are trying to insert an affiliate code in some way to get paid and Amazon maybe caught on and is redirecting all such requests to a generic help page where I just get stuck in a loop!

Anyway, I'm still on dial up internet with ISP.com on this home computer and when I do a HijackThis log, this one specific line, O17 - … NameServer = 85.255.116.60 85.255.112.203 is there ONLY WHEN I"M ONLINE. When I get off it goes away. And I've tried repeatedly to have HijackThis fix it. But the nameserver redirect just comes back when I go online.

CounterSpy, AdAware SE & a two-month old (expired) version of Ewido find nothing wrong.

Please Help Me!

My HijackThis Log is:
————————————————————————————————
Scan saved at 12:03:20 PM, on 10/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\Program Files\Task Solutions\Checklist 3.0\Checklist.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HiJack This\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.google.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKCU\..\Run: [Checklist] "C:\Program Files\Task Solutions\Checklist 3.0\Checklist.exe" -min
O4 - Startup: Shortcut to zlclient.exe.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A3EF189-FD86-4D22-9DC2-FE90072B8554}: NameServer = 85.255.116.60 85.255.112.203
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
————————————————————————————————
Post #2
hi



Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts.
You will be asked to reboot your computer; please do so.
Your system may take longer than usual to load; this is normal.
Once the desktop loads post the text that will open (report.txt) and a new Hijackthis log in the forum please.
Post #3
Hi illukka, Thank you, thank you, thank you for trying to help me with this problem! I ran Fixwareout as you suggested with the following results log: ————————————————————————- Fixwareout ver 1.003 Last edited 8/11/2006 Post this report in the forums please Reg Entries that were deleted … Microsoft ® Windows Script Host Version 5.6 Random Runs removed from HKLM … PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»» Searching by size/names… »»»»» Search five digit cs, dm and jb files. This WILL/CAN also list Legit Files, Submit them at Virustotal Other suspects. Directory of C:\WINDOWS\system32 »»»»» Misc files. »»»»» Checking for older varients covered by the Rem3 tool. ————————————————————————- And my latest HijackThis log is: ————————————————————————- Logfile of HijackThis v1.99.1 Scan saved at 6:26:49 AM, on 10/24/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe C:\Program Files\Task Solutions\Checklist 3.0\Checklist.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\HiJack This\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.google.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe O4 - HKCU\..\Run: [Checklist] "C:\Program Files\Task Solutions\Checklist 3.0\Checklist.exe" -min O4 - Startup: Shortcut to zlclient.exe.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{8A3EF189-FD86-4D22-9DC2-FE90072B8554}: NameServer = 85.255.116.60 85.255.112.203 O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe ————————————————————————- In addition, I left my computer on last night (but off the internet) and woke up to Windows Security Alerts telling me that I have a "shell hook" imbedded in Explorer trying to execute a program and do I want to allow it. Obviously, I answered no. But, I've never seen that message before and, while I don't understand it completely, it doesn't sound good. :(
Post #4 last edited
hi

open hijackhtis, click do a system scan only
checkmark this entry:

O17 - HKLM\System\CCS\Services\Tcpip\..\{8A3EF189-FD86-4D22-9DC2-FE90072B8554}: NameServer = 85.255.116.60 85.255.112.203

then close all other programs, including the one you're reading now, except hijackthis
and click fix checked

reboot

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

reboot

next:

download AVG Anti-Spyware from HERE and save that file to your desktop.
This is a 30 day trial of the program
  • Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
  • On the main screen select the icon "Update" then select the "Update now" link.
    • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
    IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
  • Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
  • AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all actions"
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
  • Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.
a very big NOTE:
i see no traces of any kind of antivirus protection. here is a link to a free antivirus program:
http://www.free-av.com
download and install it, i recommend doing a scan with it too

when you return, post a fresh hiajckthis log and the avg antispyware report here
Post #5
Hi, Thank you, again. Your instructions were very clear and easy to follow. My internet connection is sooo slow right now that it took quite a while to download these programs you suggested. But I did everything step-by-step per your instructions. First, the good news. At the end, the anti-virus program (AntiVir PE Classic) removed two viruses: The Trojan horse TR/Expl.Java.Bytvery; and EXP/Byteverify.S.1 The bad news is that the AVG Anti-Spyware could not find anything. And, even after AntiVir PE Classic removed those two viruses, that O17 line with the redirected nameservers reappears on the HighjackThis log the second I get back on the internet (I'm on dial-up). You've been so patient, illukka, any further ideas / options? Here are the logs: ————————————————————————- AVG Anti-Spyware - Scan Report ————————————————————————- + Created at: 2:58:58 PM 10/24/2006 + Scan result: Nothing found. ::Report end ————————————————————————- The new HijackThis Log is as follows: ————————————————————————- Logfile of HijackThis v1.99.1 Scan saved at 3:09:38 PM, on 10/24/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe C:\Program Files\Task Solutions\Checklist 3.0\Checklist.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HiJack This\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = www.google.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe O4 - HKCU\..\Run: [Checklist] "C:\Program Files\Task Solutions\Checklist 3.0\Checklist.exe" -min O4 - Startup: Shortcut to zlclient.exe.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{8A3EF189-FD86-4D22-9DC2-FE90072B8554}: NameServer = 85.255.116.60 85.255.112.203 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #6
hi

Download and Save Blacklight to your desktop (choose "I ACCEPT" then click "DOWNLOAD" on the website).

Double-click blbeta.exe then accept the agreement, click > "Scan" then > "Next".

You'll see a list of all items found. There will also be a log on your desktop with the name "fsbl.xxxxxxxxxxxxxx.log" (the xxxxxxxxxxxxxx stand for numbers).

Copy and paste this log in your next reply. Don't choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe"
Post #7
Hey illukka,

I downloaded the Blacklight program as you suggested and ran it twice, just to make sure. Unfortunately, it did not seem to find anything.

I'm in a real pickle because this Compaq computer came with no OS system disks (even though it does have the Microsoft COA sticker). So I really can't just wipe out the hard drive and start over at this point. So any hints / programs / ideas / prayers would be GREATLY appreciated. *Gets on eBay and starts looking for Windows XP disks*

However, I'm certainly not willing to give up yet. I believe that the key has to be in the fact that ONLY when I connect to the internet, the O17 Nameserver redirect line shows up in HijackThis. When I get off the internet and immediately run HijackThis, the O17 Nameserver line disappears ALL BY ITSELF.

What do you think?


——————————————————————–
The on-screen readout from Blacklight:
———————————————————————
Scan targets:
Hidden processes
Hidden files and folders

Status:
Scan complete.
No hidden items found.
———————————————————————
The actual log as written to the desktop is a bit different:
———————————————————————
10/24/06 23:48:37 [Info]: BlackLight Engine 1.0.47 initialized
10/24/06 23:48:37 [Info]: OS: 5.1 build 2600 (Service Pack 2)
10/24/06 23:48:37 [Note]: 7019 4
10/24/06 23:48:37 [Note]: 7005 0
10/24/06 23:48:45 [Note]: 7006 0
10/24/06 23:48:45 [Note]: 7011 1188
10/24/06 23:48:45 [Note]: 7026 0
10/24/06 23:48:46 [Note]: 7026 0
10/24/06 23:48:54 [Note]: FSRAW library version 1.7.1020
10/24/06 23:57:16 [Note]: 7007 0
Post #8
hi


fix that 017 line again. then:

lets check some settings on your system.
  • Enter your Control Panel and double-click on Network Connections
  • Then right click on your Default Connection
    • Usually Local Area Connection for Cable and DSL
  • Left click on Properties
  • Double-Click on the Internet Protocol (TCP/IP) item
  • Select the radio dial that says Obtain DNS Servers Automatically
  • Press OK twice to get out of the properties screen and reboot if it asks
post a new hjt log when done :)
Post #9
:D Well, I think you fixed it! :D

Those two Ukraine nameservers were specified exactly where you told me to look in the Network Connections area.

That line O17 line still shows up in HijackThis but ONLY when I'm on the internet and with different nameservers now. When I disconnect, and immediately run a HijackThis log, it goes away. Is that normal on dial-up?

At least the nameserver IP addresses are in the US: http://www.dnsstuff.com/tools/whois.ch?ip=[removed]

My internet connection seems much, much faster now, and when I misspell a website's name, it doesn't take me over to some porn directory page. Firefox just comes up saying that it can't find the website like normal. And I can finally go to Amazon.com like normal (okay - maybe I go there too much :) ).

I'm still scanning every few hours to make sure that nothing pops up… but I think you fixed it! :thumbup:

You are a gentleman, scholar and wizard all rolled into one, illukka!

Thank you for your persistence, knowledge and clear communication skills. I owe you at least a fine dinner if you ever hit Orange County, California!

Thank you, again! :wavey:
Post #10
hi

great :)


Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

    You can find instructions on how to enable and reenable system restore here:

    Managing Windows Millenium System Restore

    or

    Windows XP System Restore Guide

    Reenable system restore with instructions from tutorial above

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

here are some additional utilities that will enhance your safety
  • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
  • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
    Using Winpatrol to protect your computer from malicious software
also remember to keep your java updated, see this topic for instructions

http://forums.spybot.info/showpost.php?p=1…amp;postcount=2
Post #11
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI