Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

adware\spyware removal [RESOLVED]


  • This topic is locked This topic is locked

#16
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
What you just removed was a "Trojan"

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

First we need to make all files and folders VISIBLE:

Go to start>control panel>folder options>view (tab)
*choose to "show hidden files and folders,"
*uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
*Close the window with ok
*All hidden files will now be visible

Please RUN HijackThis.
. Click the SCAN button to produce a log.

Place a check mark beside each one of the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php
O4 - HKLM\..\Run: [msnethlp32.exe] msnethlp32.exe
O4 - HKLM\..\Run: [SysMemory manager] c:\windows\system32\mdms.exe
O4 - HKLM\..\Run: [_Cat1] C:\WINDOWS\nmmst.exe
O21 - SSODL: Web Event Logger - {7CFBACFF-EE01-1231-ABDD-416592E5D639} - C:\WINDOWS\System32\Hgbmpagj.dll (file missing)



Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window and Reboot Your System in Safe Mode

How to use the F8 method to Start Your Computer in Safe Mode

*Restart the computer.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.


Using Windows Explorer, locate the following files/folders, and DELETE them (if they are present):

msnethlp32.exe<===You will have to search for this one
c:\windows\system32\mdms.exe
C:\WINDOWS\nmmst.exe
C:\WINDOWS\System32\Hgbmpagj.dll

Exit Explorer, and REBOOT BACK INTO NORMAL MODE

Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everything looks now.

Regards,

Trevuren

  • 0

Advertisements


#17
bookwrm

bookwrm

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
Completed fix per your instructions. Did not find 3 of the files (in safe mode).

c:\windows\system32\mdms.exe
c:\WINDOWS\nmmst.exe
c:\WINDOWS\System32\Hgbmpagj.dll

These files were not there.

Ran HJT and here is the scan:

Logfile of HijackThis v1.99.1
Scan saved at 5:44:50 PM, on 7/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Spyware Nuker 2004\swn2.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TV Now] C:\Program Files\HPQ\Notebook Utilities\TvNow.exe /RK
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Spyware Nuker] C:\Program Files\Spyware Nuker 2004\swn2.exe /h
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


Thanks for your help.
  • 0

#18
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
Your log looks clean. I would like to have all your system checked too.

Please do an online scan with Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Standard
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Trevuren
  • 0

#19
bookwrm

bookwrm

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
Ran Kaspersky web scan. Here are the results:


KASPERSKY ANTI-VIRUS WEB SCANNER REPORT
Friday, July 22, 2005 21:15:43
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky Anti-Virus Web Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 23/07/2005
Kaspersky Anti-Virus database records: 131613
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 24558
Number of viruses found: 13
Number of infected objects: 41
Number of suspicious objects: 0
Duration of the scan process: 1845 sec

Infected Object Name - Virus Name
C:\Documents and Settings\Rebekah Mosora\Local Settings\Temp\13C9.tmp Infected: Trojan-Proxy.Win32.Agent.fw
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\03E47384 Infected: Trojan.Java.ClassLoader.h
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\06CE7257 Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0B13657D Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0C5E4A0B Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0C6D0BF5 Infected: Trojan.Java.ClassLoader.h
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\0F4F2FEE Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\137A7808 Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1B78247F Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\1DAF0F80 Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2A726571 Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\2AC0744D Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\32C027E9 Infected: Trojan.Java.ClassLoader.d
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\381E154F Infected: Trojan.Java.ClassLoader.d
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\409A59E7 Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\48855335 Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49B06C54.exe Infected: not-virus:Hoax.Win32.Renos.f
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\49C7123B.exe Infected: not-virus:Hoax.Win32.Renos.f
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\4E421FC9 Infected: Trojan-Downloader.Win32.Ani.b
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\52FA100C Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\625B1D2E/GetAccess.class Infected: Trojan.Java.ClassLoader.c
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\625B1D2E/InsecureClassLoader.class Infected: Exploit.Java.Bytverify
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\625B1D2E/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\625B1D2E/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\625B1D2E Infected: Trojan-Downloader.Java.OpenConnection.v
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\62CE5AB1 Infected: not-virus:Hoax.Win32.Renos.f
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\62D758A6/index.htm Infected: Trojan-Downloader.VBS.Psyme.ac
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\62D758A6 Infected: Trojan-Downloader.VBS.Psyme.ac
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\62DB02A2 Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\62E40098/exploit.htm Infected: Trojan-Downloader.VBS.Psyme.ac
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\62E40098 Infected: Trojan-Downloader.VBS.Psyme.ac
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\631C1CFF Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\6BE848DC Infected: Trojan.Java.ClassLoader.d
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7089524C Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\70CF628C Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\728B2BE3 Infected: Trojan.Java.ClassLoader.h
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\732F70AA Infected: Exploit.HTML.Mht
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\736D0E66 Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\73703863 Infected: Trojan.Win32.Krepper.aj
C:\Program Files\Norton Internet Security\Norton AntiVirus\Quarantine\7E043442 Infected: Trojan.Win32.Krepper.aj
C:\WINDOWS\system32\msnethlp32.dll Infected: Trojan-Proxy.Win32.Agent.fw

Scan process completed.
  • 0

#20
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
EXCELLENT

1. DELETE the following file:C:\WINDOWS\system32\msnethlp32.dll

2. If it won't go, delete it in Safe Mode.

3. Please advise so we can continue.


Trevuren
  • 0

#21
bookwrm

bookwrm

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
I deleted the file c:\windows\system32\msnethlp32.dll in normal mode.
Will it return if the computer restarts or is it permanently gone?
  • 0

#22
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
I am not trying to be funny here but REBOOT and find out.

Trevuren
  • 0

#23
bookwrm

bookwrm

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
I already tried it and it is gone.
  • 0

#24
bookwrm

bookwrm

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
Does this mean my notebook is clean?
  • 0

#25
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
Congratulations, your log shows that your SYSTEM IS CLEAN

There are a few things you must do once you are completely clean:

1. Reset and Re-enable your System Restore to remove bad files from the backup that Windows makes as no program is able to clean those files:

TO DISABLE SYSTEM RESTORE
1. Right-click "My Computer", and then left click "Properties".
2. Left click on "System Restore Tab"
3. Check box beside "Turn Off System Restore"
4. Left click on "Apply"

TO ENABLE SYSTEM RESTORE
1.Remove check mark from "Turn Off System Restore"
2.Click on "Apply"

2. Cleanup the leftovers. Download CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.


3. Finally, Re-hide your System Files and Folders to prevent any future accidents.


Here are some tips to reduce the potential for spyware infection in the future:

Make sure you keep your Windows OS current by visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

I strongly recommend installing the following applications:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
To protect yourself further:
  • Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
And also see TonyKlein's good advice
So how did I get infected in the first place? (My Favorite)

Regards,

Trevuren

  • 0

Advertisements


#26
bookwrm

bookwrm

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
I followed instructions and ran cleanup. Thanks for your advice about the spyware removal programs. I was going to ask you about that. This is my daughter's notebook and I didn't get a chance to put any programs on it. Her first time on the Internet, she got hit with this problem. Thanks so much for all your help. I will spread the word about this forum. You guys are great!
  • 0

#27
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
You are very welcome


Trevuren
  • 0

#28
Trevuren

Trevuren

    Old Dog

  • Retired Staff
  • 18,699 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP