Get Rid of Search Assistant/Toolbars?

peter_the_piper

Why not go to them and ask if you can get their help without going onscreen. You would not be the first I'm sure. They seem to be very understanding.

Fran

I have Mozilla - the problem is with Internet Explorer.

I can't get Housecall because as soon as I go onto IE everything goes haywire and I just tried again and there is an error so I can't get it.

Every single minute a box pops up from Spybot asking whether I want to deny or accept a registry change. If I don't react to it I can't do anything. Should I turn off Spybot so I can think straight?!! :P

I found out yesterday that I have PWSteal.Trojan, and followed Symantec removal instructions and deleted 51 files in safe mode that it listed, but when it came to the last thing which was to remove an entry from the registry, it wasn't listed. I restarted computer but the whole thing is still here.

Is there anyway of finding out what I'm infected with using the Mozilla browser?

I couldn't get onto the forum suggested for some reason, I tried yesterday.

sra

I can get onto the forums just fine with firefox - Maybe your bug is blocking you ??? ???

To be notified of reg changes you must have spybots teatime protection on. I don't use this - I can't remember why I don't. Maybe it conflicts with another system.

If you are worried about harmful changes being made you can backup the registry. Spybot can do this but I can't for the life of me find out how to restore ir afterwards with it.

If your problem was deleting a lot of files that come back at startup them my final thought is
msconfig.Its a long process so maybe you should look at its help files and see if you think it looks helpful.

Click RUN on the start menu and type msconfig in the box that appears and then OK. If you click help you'll find a little guide to the process that guides you through step by step.

peter_the_piper

You can simulate I.E in firefox0.9.3 by using an extension. Might be worth using this to fool the bug. Go to http://ieview.mozdev.org/ down load and close browser. Reopen and you should find it when you put the curser onto a blank piece of the page,press right button and it should be at the bottom of the drop down list. It will say view this page in I.E maybe then you could get to the page. Let us know how you get on.

Fran

Well I thought I'd cracked it, got SpySweeper as recommended by daytona_nev - thanks d_n, and Norman finally picked up a trojan which was W32/Keenval.F and it was in C:\Programme Files\Kazaa\PerfectNavUninstall.exe and C:\WINDOWS\browserextras\pn\remove.exe (in case that's of interest or use).

But......

Having had a break from trying to sort it out for 2 days, I've just turned on the computer and the b***** popups are still coming from Spybot and it's still trying to mess with and change the Internet Explorer settings all the time.

Do I need to do something else in relation to that trojan or could it be something else again which nothing's detected so far? Norman quarantined it.

peter_the_piper

Sorry, run out of ideas, really think you need the experts in on this. Hope you get it sorted soon.

StrikeEagle

Fran you need to download Hijackthis, like aussielle said ages ago. Otherwise we cant see what's happening on your pc. It will show us certain key areas of your registry and the contents so we can look for anything dodgy causing your problems.

Open Hijackthis.

Press 'Scan', Bottom left of screen.

Press 'Save Log' Bottom left of Screen.

Popup comes up, save file wherever.

Notepad opens. Go Edit (top of notepad), click Select All, Go Edit, click Copy. Close Notepad.

Close Hijackthis. Then Reply to this message, and Press CTRL + V on your keyboard when typing your reply.

Fran

Thanks to everyone who has replied.

Ausielle/Strikeagle - Thanks for info. Hijackthis could not be downloaded using Mozilla, I had to use IE. Then there was an error downloading, so I had to use another site for the download.
Unbelievable-Yes I can feel your sympathetic feelings, it's a nightmare isn't it?!
sra555- CWSshredder didn't work. Thanks for the link.
duncanc-I use Mozilla most of the time but do use Internet Explorer occasionally, which is where the problem is.
Peter_Piper- I can't get onto the site you gave the link for.

I have only just managed to get the hijack log and have posted on the SpywareInfo site. (I haven't posted the log as I'm not happy about posting publicly the processes I use on my computer.)

I have registration problems with the DAL forum.

aussielle

Fran,

Have you got rid of the trojan?

If not, give this a go

Fran

Thanks ausielle,

I think I got rid of that trojan but will have a look in case.

My main problem is W32/Keenval.F and I can't find any information on this variant of the Trojan, must be a new one.