[ChaunceyBell]

The first time I noticed something amiss, a couple of weeks ago, was when

Yahoo Shopping took me to the site of a German subsidiary of Yahoo, and I no

longer could get to Yahoo shopping in English. Over the last several days, at

some moment shortly after starting up XP, IE first says it is looking for

proxies (the Internet Options are set for never dial a connection and

Automatic Detection of Settings), and then IE starts looking for URLs with

numbers like 72.3.228.81 (this is one of the actual numbers that appears),

which do not seem to have anything to do with, nor do they yield the sites I

asked for.

I use Comcast cable as my primary ISP.

I have followed all of the procedures listed in the G2G opening instructions,

viz CleanUp, AdAware, CWShredder, SpyBot, Ewido, Trojan Hunter, etc. My

Windows is up to date, and I have been using McAfee Virus and three Spam

programs: Microsoft's, AdAware, and Spybot religiously for a long time.

I also did the Panda Activescan, and will attach the results of that here.

You will see that Panda caught three viruses that everything else had missed.

I ran TrojanHunter after it, so perhaps Panda beat TH to the punch.

Meanwhile, I still am watching IE get hijacked by something, and have one

more important symptom: MS Office Word has lost all of its formatting menus.

When I say format the style of a document, the menu on the right side of the

document no longer has any formats in it. I have done a repair of MS Office

from the master disks, with no effect.

I will be very grateful for any help you can give me.

The Activescan report:


Incident

Status Location







Adware:adware/startpage.amb

Not disinfected C:\Documents and

Settings\Administrator\Favorites\Health






Spyware:Cookie/Ask

Not disinfected C:\Documents and

Settings\Administrator\Cookies\[email protected][1].txt






Spyware:Cookie/WebtrendsLive

Not disinfected C:\Documents and

Settings\Administrator\Cookies\[email protected][2].txt






Spyware:Cookie/Ask

Not disinfected C:\Documents and

Settings\Administrator\Cookies\[email protected][1].txt






Spyware:Cookie/WebtrendsLive

Not disinfected C:\Documents and

Settings\Administrator\Cookies\[email protected][2].txt






Potentially unwanted tool:Application/Processor

Not disinfected C:\Documents and

Settings\Administrator\Desktop\smitRem\Process.exe






Potentially unwanted tool:Application/Processor

Not disinfected C:\Documents and

Settings\Administrator\Desktop\smitRem.exe[Process.exe]






Potentially unwanted tool:Application/Processor

Not disinfected C:\Documents and Settings\Administrator\Local

Settings\Application Data\Microsoft\CD Burning\smitRem.exe[Process.exe]




Virus:W97M/Thus.A

Disinfected Vision Archives\GM\RE: essig ltr [Comment]

\essig ltr 6-5-00GF3.doc




Virus:Trj/Downloader.TC

Disinfected C:\Documents and Settings\Administrator\My

Documents\Personal\Politics\Bush Presidency\Mosh.html




Virus:Trojan Horse

Disinfected C:\Documents and Settings\All

Users\Documents\CB Old Docs 20040204\FAMILY\NICO\AORAGE.EXE

Attached Files

•  hijackthis_20060123.txt   7.58KB   68 downloads

[Advertisements]

Hello and welcome to geeks to go,
go to the malware forum and they'll help you out there. Post a HJT log and create a new topic at the following URL. http://www.geekstogo...o-Here-f37.html. and be sure to look over this URL before posting a log so that someone can help you out quicker http://www.geekstogo..._Log-t2852.html
thanx
James

[james_8970]

Hello and welcome to geeks to go,
go to the malware forum and they'll help you out there. Post a HJT log and create a new topic at the following URL. http://www.geekstogo...o-Here-f37.html. and be sure to look over this URL before posting a log so that someone can help you out quicker http://www.geekstogo..._Log-t2852.html
thanx
James

[ChaunceyBell]

I have reposted this in the Malware forum as requested by James.
Now I'll try to find out how to close out this topic....

[ScHwErV]

Ask and ye shall recieve.