Lost Google Toolbar and Redirected IE :(

[Bluto]

Hi all....

Somehow I managed to get some kind of scumware loaded onto my system.

I have a fairly clean, XP Home box with IE 6.0, with Spybot, Ad-Aware, and ZoneAlarm loaded on it. I also am using the Grisoft AVG Antivirus software. I update each of these about once per 2 week intervals. I have run them all, at least twice......

......but.....

.....somehow my home page is being redirected to here: http://a-search.biz/?wmid=1010

Be careful with that....I don't know how poisonous it is!

Anyway....I have checked my home page in tools/options/advanced it is as I have set it....my home page. What hapens is, when I launch a new page from say, the start menu the page opens and quickly gives an "Action Canceled" notice, and then launches to the link I gave above. The it displays a dialog about my 'current settings prohibit ActiveX from running'.

I am unable to re-install the Google toolbar. I ahve tried to re-install it 2-3 times now and it will not take. The folder for it is still alive, but something is catching it and preventing it from being active.

I've looked thru the Registry & the Windows folder.......couldn't find anything obvious....looked thru the Programs folder.....there is a mysterious file called "pl.exe" that I have not seen before. I have deleted it 2-3 times, but it keeps coming back. So that is a clue. Ad-Aware found, and removed a registry entry. I thought that would do it, but apparently it has not.

On the Taskbar is an entry, like what a minimized program would look like when it's sitting there, but it will not open or maximize. Its title is just "about:blank Trusted Start Page".

I have looked in "msconfig" for entries listed there, but there is nothing. This is a tuffie! I can't figure this one out, and I do not (apparently) have te tools to tackle this one!

I have also tried a couple online scanners...with ZA turned off.....and nothing. :brokenheart:

Anyone know how I can get rid of this demon from hell!? :evil:

Thanks

 

[mechBgon]

Try your anti-spyware scans while in Safe Mode. Keep in the back of your head:

1) how the heck did I let this thing in the door, or if it wasn't me, who did it and who's their next of kin :evil: (you might want to upgrade to WinXP Pro and set up Limited-class accounts for yourself and each other user if you can't pin down where it got in from, especially if your computer has multiple users. Reserving the Administrator powers for those occasions where you need them is a huge preventive measure.)

2) reinstalling Windows doesn't take that awful long, if it turns into a major battle

3) and Schadenfroh has a spyware/virus removal & prevention thread pinned at the top of the Software forum here, if you haven't looked at it yet.

 

[Schadenfroh]

Post your hijackthis log, instructions on how to post it in sig. i will get a solution to you ASAP as soon as i have your log.

 

[Bluto]

mech.....

Thanks for the ideas! I will look at the link(s) you mentioned, and hope for the best I guess.

bluto

 

[Bluto]

shadenfroh....

I have the log file, but I'm afraid I don't know, or am too tired, to catch on to what "sig" is. Let me know and I will post the file where ever you want me to post it.

I don't see any ways to attach it, but I could cut and paste it from the notepad text that came up after saving it.

I apreciate your trying to help!

bluto

 

[Schadenfroh]

sig refers to this link

http://forums.anandtech.com/me...6173&enterthread=y