Browser Hijacked - Anti-Spyware Software Ineffective

[Martin Murray]

Some months ago, my XP system was infected by a spyware program (inet
something, I think) and I spent a few days cleaning my system using
Lavasoft's Ad-Aware. In the end, I got rid of the spyware, but one
after-effect remained - every time I booted my system a browser would open
automatically. I supposed this was caused by the spyware as a defensive
measure to keep it alive. Anyway, my system seemed clean so I left it
alone.

Now about a week ago I got infected with Wincomm and InternetOptimizer. I
uninstalled both of those and have run Ad-Aware and XoftSpy and
RegistryMedic etc. and most of the components get deleted, but every time I
reboot the browser opens up, as mentioned above, and there is a popup window
that was brought in by WinComm/InternetOptimizer.

First question: How can I stop this browser from opening automatically on
boot?

Second question: How can I get rid of whatever stub of code is hooked in
that is restarting this blankety-blank spyware?

Thanks in advance for any help!

Martin Murray

 

[Frank Saunders, MS-MVP]

Some months ago, my XP system was infected by a spyware program (inet
something, I think) and I spent a few days cleaning my system using
Lavasoft's Ad-Aware. In the end, I got rid of the spyware, but one
after-effect remained - every time I booted my system a browser would
open automatically. I supposed this was caused by the spyware as a
defensive measure to keep it alive. Anyway, my system seemed clean
so I left it alone.

Now about a week ago I got infected with Wincomm and
InternetOptimizer. I uninstalled both of those and have run Ad-Aware
and XoftSpy and RegistryMedic etc. and most of the components get
deleted, but every time I reboot the browser opens up, as mentioned
above, and there is a popup window that was brought in by
WinComm/InternetOptimizer.
First question: How can I stop this browser from opening
automatically on boot?

Second question: How can I get rid of whatever stub of code is hooked
in that is restarting this blankety-blank spyware?

Thanks in advance for any help!

Martin Murray

First eliminate any scumware.
See
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated with the program's update function
before every use, even when just downloaded. There's also a lot more to do
than just those two programs. CWShredder is also available here:
http://www.kellys-korner-xp.com/regs_edits/cwshredder.zip
**Post your HijackThis log to
http://forums.spywareinfo.com/ or the Spyware forum at
http://forum.aumha.org/ for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.

If nothing there helps, please post back to this thread.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/