Hi guys, I recently got a bunch of porn pop-ups when I click on regular links on "normal", non porn pages. When I google something I occasionally get a "page cannot be displayed" error and the address changes where I found the IP address who's spying on me, e.g.: http://www.google.com %00@69.93.145.180/seearch?q=%22colonel+sanders%22 ...now I tried CWShredder and Hijackthis with no success, even after deleting temp. internetfiles and cookies that b---tard keeps coming back .....any takers ? Here's the only line I see in Hijackthis that fits to that (others are my Yahoo-DSL, Norton Systemworks, Firewall etc.) Thank you so much !! R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com %00@www.e-finder.cc/hp/ (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com %00@www.e-finder.cc/hp/ (obfuscated) Cheers from the San Francisco Bay Maxx

A search tells Me you may have these bad entries also. O2 - BHO: (no name) - {834261E1-DD97-4177-853B-C907E5D5BD6E} - C:\dpe.dll http://sarc.com/avcenter/venc/data/pf/trojan.startpage.f.html O13 - DefaultPrefix: www O13 - WWW Prefix:

....thanks for your reply, but nope, don't have those you mentioned Cheers from the San Francisco Bay Maxx

Try Ad-Aware 6 and SpyBot Search & Destroy (linked here: Security Tools)... Install/Update/Run. If you still don't have any luck: Go ahead and POST YOUR HJT LOG. <smile> I get a feeling its not as clean as you might think. Post if you wish. GOOD LUCK! AOSCLAY PEBKAC, baby

<smile> Hi Clay, something else other than that bho must be causing the problem. Nice to have you back.

Hey Abs, My return is still "unofficial" But I suppose I'm back. :) At least long enough to get you stuck with a log to read (just kidding). No sign of Maxximus1974 yet. I'll check back later AOSCLAY PEBKAC, baby