Hello all,- I'm new to this forum and generally a newbe when it comes to combating malware.- But I've found this investigation of why my browsers been running slow and redirecting my searches an interesting and exciting exercise.- I think that I've discovered (using a HiJackThis scan) that I have a BHO "browser hijacker" on my system.- It's in the C:\WINDOWS\system32 directory and it's a "read-only" file called alrsv.dll- What's interesting is that there is a \alrsvc.dll (note the "c") file in the same directory that I'm pretty sure is valid.- At about the same time this started, I noted that there was a new task tray popup message re: "Warning, your system may be infected"- Reading an entry posted by Blair, I noted that all my symptoms are very similar to the "Trojan.Win32.LinkReplacer" and "IE Defender". - I even noted that the "yellow-shield" icon used by "IE Defender" is the the same as what's popping up in my system tray.- So, I think I'm onto something here and I'd appreciate your help.- I did not want to use the "ShadowPuterDude" fix that Blair recommened as the file names are different.- But the issues seems very similar.- Question, How do I get rid of the "alrsv.dll" file on my system that I think is malware?Thanks in advance,jrdemanHey,- I figured it out myself.- I was able to delete the WINDOWS\System32\alrsv.dll file.- That wasn't as easy as it sounds as the file didn't give me (as the user) any rights (even though I had rights to the parent folder).- Sneaky little b@$t@rd.- I tried several possible solutions (renaming, editing, ending processes, Using MSCONFIG, Safe Mode, System Restore, combofix) but no joy.- Finally I was able to access my system thru a "Recovery" mode at startup.- I used MS-DOS to navigate to the folder and deleted it using the DOS delete command.- Glad I took the time way back when to learn alittle DOS!- It seems I've regained control of my browser.- Attached is the HiJackThis log (in Notepad format) if anyone cares to look at it.- I'm going to look at this further as I'm sure that I've still got some "cleanup" to do.- But I feel pretty good about what I accomplished.jrdeman

Attachments: