Posted: 7/17/2004 7:59:57 AM EDT
|
I have a progam or virus that adds a icon for a casino website to my desktop and randomly directs me to that site. If I delete it doesn't come back until I reboot. The icon appears once the start menu programs start. I have tired removing it using norton, adware, and spy hunter. I ran spy hunter overnight and found that my computer had restarted while it was running. Any thoughts? |
|
Yeah.. First piece of advise. Go through your add/remove programs and get rid of any thing that you did not intentionally install. If it mentions tool bar or screen saver get rid of that also. Plus anything along the line of wintools needs to go as well. Next download and run adaware on your system. Make sure that you update first. Before starting adaware scanning and after you have launched the program, bring up the task manager and end task on explorer.exe Next, download hijackthis. Get rid of anything that is not MS or antivirus related. You dont need to have any BHO objects. Look for changes to your hosts file in it as well. Next... Be careful here. go into the winnt folder and winn\system32 folder and sort by modified and get rid of any executables that are within the past week or so. This is a good start. FINALLY, READ BEFORE YOU CLICK ON ANYTHING ON THE INTERNET |
| Well, I usually dont go that far. My ususal recomentation is to extend the right index finger of the person who clicked yes and smartly rap it with a hammer. Of course it irritates the hell out of me because I spend half of every day cleaning up workstations that have been screwed up by these programs. |
|
Also go and get these other 2 programs: www.javacoolsoftware.com/spywareblaster.html Also: www.safer-networking.org/en/index.html Spybot S&D is a good compliment to Adaware. Spywareblaster will help keep stuff from self-installing. Also consider downloading the demo of Trojanhunter: www.misec.net/ And get the manual update here: www.misec.net/trojanhunter/updating/ Unzip the update in the same directory as the main trojanhunter program, and say yes when it asks to replace files of the same name. Run Trojanhunter, and it should remove any Trojans it can. If it comes up with "suspicious UPX-packed files,", they're likely trojan-related, and you can delete them manually. Be careful with Hijack this. Go here and read the instructions/tutorial: www.net-integration.net/tools/hijackthis.html Have you any anti-virus program? Up to date definitions? |