[roningreneadier]

Hey guys, thanks for all the good info. I've got a friend that has a malware prog that either sends him to about:blank, or http://www.systemupdate.net when he opens up IE. Norton can't find or fix it, and Spybot finds it an fixes it for that first session. Sounds like an adprot.exe I got a while back messing with hkey settings and all. Any thoughts or advice in finding/figuring out where it's residing? I can't find it just sniffing around his comp for a 1/2 hour. Thank you.

[Advertisements]

Welcome to Geekstogo, I am lovethepirk and I will be assisting you.

Please run full scans with Ad-Aware SE as follows:
(If you already have Ad-Aware SE 1.06, you can skip the installation steps. If you don't, please uninstall your old versions and install the new ones from the links below.)

Full Ad-Aware Scan
Please download Ad-Aware SE) and install it. If you already have Ad-Aware SE, please configure it as indicated below. (Note that Ad-Aware SE is free for non-commercial, non-governmental, and non-educational use.) If you have a previous version of Ad-Aware, please install Build 1.06r1.

1) Run the Webupdate feature. (Click on the Globe icon, Click connect, Click OK, Click Finish.)

2) Set up the Configurations (Gear wheel at the top) as follows:

• General Button > Safety & Settings: Check (Green) all three.
• Tweak Button > Cleaning Engine > UNcheck "Always try to unload modules before deletion".

3) To start the scan, Click > "Scan Now"

• Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
• Select "Search for low-risk threats"
• Select "Perform full system scan"
• Click Next

4) When the scan has completed, select Next.

• In the Scanning Results window, select the "Scan Summary" tab.
• Check all objects found in the Critical Objects tab that you wish to remove
• Click Next, Click OK.
• Restart the computer

Please do this.
Download 'Hijack This!'. http://www.spywarein.../HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\ or your desktop, double click HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.

Regards,

LTP

[lovethepirk]

Welcome to Geekstogo, I am lovethepirk and I will be assisting you.

Please run full scans with Ad-Aware SE as follows:
(If you already have Ad-Aware SE 1.06, you can skip the installation steps. If you don't, please uninstall your old versions and install the new ones from the links below.)

Full Ad-Aware Scan
Please download Ad-Aware SE) and install it. If you already have Ad-Aware SE, please configure it as indicated below. (Note that Ad-Aware SE is free for non-commercial, non-governmental, and non-educational use.) If you have a previous version of Ad-Aware, please install Build 1.06r1.

1) Run the Webupdate feature. (Click on the Globe icon, Click connect, Click OK, Click Finish.)

2) Set up the Configurations (Gear wheel at the top) as follows:

• General Button > Safety & Settings: Check (Green) all three.
• Tweak Button > Cleaning Engine > UNcheck "Always try to unload modules before deletion".

3) To start the scan, Click > "Scan Now"

• Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
• Select "Search for low-risk threats"
• Select "Perform full system scan"
• Click Next

4) When the scan has completed, select Next.

• In the Scanning Results window, select the "Scan Summary" tab.
• Check all objects found in the Critical Objects tab that you wish to remove
• Click Next, Click OK.
• Restart the computer

Please do this.
Download 'Hijack This!'. http://www.spywarein.../HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\ or your desktop, double click HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.

Regards,

LTP