Help I'm infected

[stillin1]

I'm running windows XP, broadband with pipex and keep getting my home page hijacked to some porn directory site despite repeatedly selecting google as the home page. Have updated and run AVG and ad-aware 6 to no avail. I have looked for the prog / file and can't find it to delete. HELP!

[Out Of Trim]

stillin1 -

Suggest you also try downloading and running Spy bot and also try Trend Micro's House call.. See Sticky Thread at top of this Forum.

Spy bot apparently can find some items that ad aware can miss and vice versa..

[Wedge]

You have a trojan.

Try all the suggestions on the sticky; but they are not exhaustive and even the most up to date fixes - Adaware/Spybot can't do everything.

Google for a help site, there are some good ones that can help you clean your PC.

When you have fixed it, or before, install a firewall. There are some good free ones online.

[E-Liam]

Hi Stillin,

I've already got a fair idea of what you've got infesting your machine.. the latest variant(s) of CWS (CoolWebSearch), and at the moment we've got just about every security expert on the planet working on a fix, and it's not yet 100%.

Please download 'Hijack This!' from here, unzip, and place it in it’s own folder, (not in the temp folder, or on the desktop) doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, click "Save Log", and copy and paste it in a PM to me.

This will give me a rundown of what’s going on in your PC. I'll be happy to check it over for you. Don’t fix anything yourself yet, as a lot of the stuff on that list will be harmless or required.

Cheers

Liam

A member of the Alliance of Security Analysis Professionals since 2004.

[sprocket]

Gidday E-Liam: Can you tell me why HJT needs to be in its own folder and not on the desktop?

[E-Liam]

Hi Sprocket,

HJT generates backups should something be accidentally deleted and needs replacing. It needs it's own folder in order to do this.

Cheers

Liam