My homepage was hijacked. I ran Hijack This and "fixed" the files that were obvious to me that were bogus. My homepage no longer gets hijacked, however, I am still getting plagued by the same pop up ads that started when my pc was first hijacked. Additionally, the IE bar at the top of my screen while browsing turns from blue to gray as do the File Edit View Favorites Tools Help bar just underneath it. Is it possible that I have not "fixed" all the offending files from the Hijack this list or does it sound like something else? I have spybot and ad aware. Thanks- rsm

Post your HijackThis log and I will take a look at it for you. Have a nice day. :) Trpm

Here it is! Logfile of HijackThis v1.97.7 Scan saved at 9:52:36 PM, on 1/10/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Sony\HotKey Utility\HKserv.exe C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe C:\WINDOWS\System32\WLANSTA.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Roxio\GoBack\GBTray.exe C:\Program Files\Roxio\GoBack\GBPoll.exe C:\Program Files\PowerPanel\Program\PcfMgr.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Trend Micro\PC-cillin 2000\PNTIOMON.exe C:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\Fff85.exe C:\WINDOWS\System32\Xej7ALq.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Robert Miller\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.drudgereport.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Microsoft Excel - {17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972} - C:\DOCUME~1\ROBERT~1\APPLIC~1\MICROS~1\Office\Excel10.dll (file missing) O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe O4 - HKLM\..\Run: [JOGSERV2.EXE] C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe" O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe" O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.exe START O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe O4 - HKLM\..\Run: [3PYNCH53#E49GM] C:\WINDOWS\System32\NuzK63G.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: PowerPanel.lnk = ? O4 - Global Startup: Real-time Monitor.lnk = ? O9 - Extra 'Tools' menuitem: Turbo Download (HKLM) O9 - Extra button: Real.com (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Thanks so much! Robert.

rsm, Ok we are going to do this in steps, first off you have Peper and CWS infections and thats not all, we will start with this. Please follow these steps, in exactly that order: Run this uninstaller: http://home.iprimus.com.au/mbuchan/peperuninst.exe When done, use the following tool to delete the files themselves: http://www.mjc1.com/files/mo/drpeper.html Download Drpepertobackup.exe, save to disk, and doubleclick the file; it will self extract to c:\. Find the "C:\drpeper\Find backup and Delete Peper files.vbs" file and double click it. On the first prompt, copy and paste: Xej7ALq.exe .... and hit ok. On the second, paste: NuzK63G.exe and hit ok again. It will find all the files, delete them and will make backups in the same folder. It'll open a text file (Peper.txt) with the list of all files deleted. Save this file as you will want to put it in your next post. Next you need to download and run CWShredder you can find it at this link. http://www.merijn.org/downloads.html After unzipping run and make sure you click on Fix and not Scan only. Then reboot (Not just log off and back on) and rescan and post a fresh HijackThis log. Make sure you do this because you have more to be removed. Have a nice day. :) Trpm

Okay, I have completed the tasks as you described in previous post. Here's the log from Peper.txt: 1/11/2004 10:32:11 PM C:\WINDOWS\system32\Fff85.exe C:\WINDOWS\system32\Gqr9V5vG.exe C:\WINDOWS\system32\JvgMb7R.exe C:\WINDOWS\system32\Powv6Ew8.exe C:\WINDOWS\system32\Xej7ALq.exe C:\WINDOWS\system32\Yrtzf.exe 1/11/2004 10:32:32 PM C:\WINDOWS\system32\NuzK63G.exe C:\WINDOWS\system32\Xqsye.exe C:\WINDOWS\system32\YjuIP.exe And here is my new log file from Hijack this: Logfile of HijackThis v1.97.7 Scan saved at 10:42:27 PM, on 1/11/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Sony\HotKey Utility\HKserv.exe C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe C:\WINDOWS\System32\WLANSTA.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SpyKiller\spykiller.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Roxio\GoBack\GBTray.exe C:\Program Files\PowerPanel\Program\PcfMgr.exe C:\Program Files\Roxio\GoBack\GBPoll.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Trend Micro\PC-cillin 2000\PNTIOMON.exe C:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Robert Miller\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.drudgereport.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe O4 - HKLM\..\Run: [JOGSERV2.EXE] C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe" O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe" O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.exe START O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: PowerPanel.lnk = ? O4 - Global Startup: Real-time Monitor.lnk = ? O9 - Extra 'Tools' menuitem: Turbo Download (HKLM) O9 - Extra button: Real.com (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab I am really appreciating your help. Robert

rsm, Close all browser windows\windows and have HijackThis fix the following by checking the box beside each and clicking on Fix. R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file) X] O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs X] O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup These are optional but recommended to be removed from startup. O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe Next reboot and delete the Updater folder. C:\Program Files\Common files\updater\<< This folder This is a personal opinion but I would uninstall Spykiller it is a POS. You also do not have Spybot S&D installed like you said you did, I would advise installing it and keeping it updated, you can find it at this link. http://security.kolla.de/ Now you need to goto Windows updates and Download Service Pack1 and all critical updates!! Have a nice day. :) Trpm

Agree with Trpm, spykiller is a pos! It is marketed with ads that pop up and hijack. Spybot Search & Destroy and AdAware are the most reputable and best of all they are free!