Hi guys,

I recently got a bunch of porn pop-ups when I click on regular links on "normal", non porn pages.
When I google something I occasionally get a "page cannot be displayed" error and the address changes where I found the IP address who's spying on me, e.g.:

http://www.google.com
%00@69.93.145.180/seearch?q=%22colonel+sanders%22

...now I tried CWShredder and Hijackthis with no success, even after deleting temp. internetfiles and cookies that b---tard keeps coming back .....any takers ?

Here's the only line I see in Hijackthis that fits to that (others are my Yahoo-DSL, Norton Systemworks, Firewall etc.)

Thank you so much !!

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com
%00@www.e-finder.cc/hp/ (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.com
%00@www.e-finder.cc/hp/ (obfuscated)

Cheers from the San Francisco Bay
Maxx

A search tells Me you may have these bad entries also.

O2 - BHO: (no name) - {834261E1-DD97-4177-853B-C907E5D5BD6E} - C:\dpe.dll
http://sarc.com/avcenter/venc/data/pf/trojan.startpage.f.html

O13 - DefaultPrefix: www
O13 - WWW Prefix:

....thanks for your reply, but nope, don't have those you mentioned

Cheers from the San Francisco Bay
Maxx

Try Ad-Aware 6 and SpyBot Search & Destroy (linked here: Security Tools)... Install/Update/Run. If you still don't have any luck:

Go ahead and POST YOUR HJT LOG.

<smile>

I get a feeling its not as clean as you might think.

Post if you wish.

GOOD LUCK!

AOSCLAY
PEBKAC, baby

Report Offensive Follow Up For Removal

<smile>
Hi Clay, something else other than that
bho must be causing the problem.

Nice to have you back.

Hey Abs,

My return is still "unofficial"

But I suppose I'm back. :)

At least long enough to get you stuck with a log to read (just kidding).

No sign of Maxximus1974 yet.

I'll check back later

AOSCLAY
PEBKAC, baby

Report Offensive Follow Up For Removal