It Just Will Not Die!

[{%shellshock%}]

Image Resized
Image Resized
[img]http://img49.exs.cx/img49/8787/spy.jpg' width='200' height='120' border='0' alt='click for full size view'>
Iv try'd every spyware removel i can think of.The only thing that seem's to get rid of it is Hijackthis but a few day's later i just come's back.Eny help please.

[[B][O][T]]

Use the search....there's lots of topics about this.
And don't use IE

BOT

[{%shellshock%}]

Thanks for your help.

[sparsely]

Originally posted by [B
[O][T],9 July 2004 - 12:43]Use the search....there's lots of topics about this.
And don't use IE   

BOT

FIREFOOOOOOXXXXXXXXXX!!!!!!!

[Ariel_001]

Originally posted by {%shellshock%}@9 July 2004 - 13:37
Image Resized
Image Resized
<a href=&#39;http://img49.exs.cx/img49/8787/spy.jpg&#39; target=&#39;image&#39;>Image Resized
Image Resized
[img]http://img49.exs.cx/img49/8787/spy.jpg' width='200' height='120' border='0' alt='click for full size view'></a>
Iv try&#39;d every spyware removel i can think of.The only thing that seem&#39;s to get rid of it is Hijackthis but a few day&#39;s later i just come&#39;s back.Eny help please.

ok..

I beleve Hijackthis has the option to show a log of your computer`s state of something like that. Can you post it?

[{%shellshock%}]

Logfile of HijackThis v1.97.7
Scan saved at 12:06:12 PM, on 7/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:&#092;WINDOWS&#092;System32&#092;smss.exe
C:&#092;WINDOWS&#092;system32&#092;winlogon.exe
C:&#092;WINDOWS&#092;system32&#092;services.exe
C:&#092;WINDOWS&#092;system32&#092;lsass.exe
C:&#092;WINDOWS&#092;system32&#092;svchost.exe
C:&#092;WINDOWS&#092;System32&#092;svchost.exe
C:&#092;Program Files&#092;Common Files&#092;Symantec Shared&#092;ccSetMgr.exe
C:&#092;Program Files&#092;Common Files&#092;Symantec Shared&#092;ccEvtMgr.exe
C:&#092;WINDOWS&#092;system32&#092;spoolsv.exe
C:&#092;Program Files&#092;Executive Software&#092;Diskeeper&#092;DkService.exe
C:&#092;Program Files&#092;Norton AntiVirus&#092;navapsvc.exe
C:&#092;WINDOWS&#092;System32&#092;nvsvc32.exe
C:&#092;Program Files&#092;Norton AntiVirus&#092;SAVScan.exe
C:&#092;WINDOWS&#092;system32&#092;slserv.exe
C:&#092;WINDOWS&#092;wanmpsvc.exe
C:&#092;WINDOWS&#092;System32&#092;MsPMSPSv.exe
C:&#092;WINDOWS&#092;Explorer.EXE
C:&#092;Program Files&#092;Internet Explorer&#092;iexplore.exe
C:&#092;Documents and Settings&#092;robert&#092;Desktop&#092;Files&#092;Hold&#092;Hijack&#092;HijackThis.exe

R1 - HKCU&#092;Software&#092;Microsoft&#092;Internet Explorer&#092;Main,Search Bar = file://C:&#092;DOCUME~1&#092;robert&#092;LOCALS~1&#092;Temp&#092;sp.html
R1 - HKCU&#092;Software&#092;Microsoft&#092;Internet Explorer&#092;Main,Search Page = file://C:&#092;DOCUME~1&#092;robert&#092;LOCALS~1&#092;Temp&#092;sp.html
R1 - HKCU&#092;Software&#092;Microsoft&#092;Internet Explorer&#092;Search,SearchAssistant = file://C:&#092;DOCUME~1&#092;robert&#092;LOCALS~1&#092;Temp&#092;sp.html
R1 - HKLM&#092;Software&#092;Microsoft&#092;Internet Explorer&#092;Main,Search Bar = file://C:&#092;DOCUME~1&#092;robert&#092;LOCALS~1&#092;Temp&#092;sp.html
R1 - HKLM&#092;Software&#092;Microsoft&#092;Internet Explorer&#092;Main,Search Page = file://C:&#092;DOCUME~1&#092;robert&#092;LOCALS~1&#092;Temp&#092;sp.html
R0 - HKLM&#092;Software&#092;Microsoft&#092;Internet Explorer&#092;Search,SearchAssistant = file://C:&#092;DOCUME~1&#092;robert&#092;LOCALS~1&#092;Temp&#092;sp.html
R1 - HKCU&#092;Software&#092;Microsoft&#092;Internet Explorer&#092;Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {9964B2EF-BEA6-4B88-940D-A27310F9BF3B} - C:&#092;WINDOWS&#092;System32&#092;pcl.dll
O9 - Extra button: Related (HKLM)
O9 - Extra &#39;Tools&#39; menuitem: Show &Related Links (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shock...ash/swflash.cab

[Ariel_001]

Ok there are some thing that would worry me for sure.....

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html

All that points to your %temp% folder and is all the same file. Delete it

Also this would worry me...

BHO: (no name) - {9964B2EF-BEA6-4B88-940D-A27310F9BF3B} - C:\WINDOWS\System32\pcl.dll

[Rastapopoulos]

Yes what Ariel said, delete them all.

[muchspl2]

[[B][O][T]]

lol yeah, it&#39;s getting more and more common now....

Use Firefox and You&#39;ll be safe

BOT