TROJAN HORSE

Let's see what's going on in that system.
Go to this site http://www.trendmicro.com/en/home/us/enterprise.htm and do an online scan and delete whatever it finds. Be sure to highlight the drives you want to have searched.
After that could you please go to http://www.majorgeeks.com/download506.html and download AdAwareSE and delete what it finds. Then while using AdAware, click on add-ons and get their plug-in for the VX2 variant, and run that and delete what it finds.
After that go to http://www.majorgeeks.com/download2471.html
and download SpyBot and run that and delete what it finds.
Now go to
http://www.majorgeeks.com/download3155.html and download HiJackThis to its own folder that you create on your C:\ drive.
After it is downloaded open the program and click on the Scan button.
When that is done, click on Save to log.
Post the log that it generates right here so that it maybe viewed and analyzed for problems.
Thanks
Steve

LadyxLavender,

Post up a hijack log and i'll see what's runninng on your system that might be reinfecting your system as soon as Norton's cleans it off.

While your doing that, have you tried any online virus scanners? Just to see what they turn up?

-

Mike.

 

LadyxLavender,

Did you also, at any point an time have a 'hijacked' start or search page?

Mike.

To delete the file manually, boot up into SafeMode,(you don't have to go into Safe Mode to delete files as a rule). To get into SM when the Dell logo appears keep tapping the F8 key and that will lead you to the screen where you can arrow up to Safe Mode and hit enter.
Then find the file and delete it, by right clicking on the file and then chooseing the delete option.

Steve

LadyxLavender,

I'm reviewing it now - some of the entry(s) i'm not familar with and have to research first.

-

When i'm done, i'll post backl it'll be in just a few more minutes. Did you have a browser hijacker in the past? That particular dll is noted to be a CWS parasite.

Mike.

 

Now, let's run HiJackThis, then:

1.  click "Config..."
2.  click "Misc Tools"
3.  click "Delete a file on reboot"
4.  browse to, then double-click on each of the file(s) below, one at a time, if present:

   C:\WINDOWS\ietlbass.dll
   
5.  when prompted to "Reboot Now", after selecting each file, select "No"

---

Now, let's open a command prompt and unregister the dll(s) we're going to remove, by entering the following:

regsvr32  /u  ietlbass.dll

It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to a command prompt to save on the typing.

---

Run HiJackThis and click " Scan", then check(tick) the following, if present:

O2 - BHO: DOMP Class - {4C1B116F-2860-46db-8E6C-B4BFC4DFD683} - C:\WINDOWS\ietlbass.dll

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O4 - Global Startup: RealAudio.exe

Now, with all windows closed except HiJackThis, click "Fix checked".

---

Don't reboot your computer just yet.

Post back a new log.

Mike.

 

LadyxLavender,

Yes, as far as I know. It's a program that reports what's currently running on your system, as well as key areas (like harddrive and registry locations) where malware is known to hide. This gives me (and others) the ability to not only see what's running to determine what you need to do to fix it, but the onboard tools for you to use to help remove some of it. Most all of the things it can do, can also be done manually, but it can be long and drawn out for the person on that end.

---

Download, then unzip to " C:\HJT", the newest version of HiJackThis; version 1.99.0.

-

Let me know if your having a problem using that version to post your log, and i'll link you to the previous version.

Mike.

Message Edited by Midnight Star on 01-11-2005 07:16 PM

Where is the COMMAND PROMPT on the hijackthis?