Spyware that I CAN't remove

I got some spyware that attacks IE.
If i use other progs for internet i have not problem at all but if I starting IE it commes:
Install window for installation of norton 2002 and efter that crashes my internet connection.
I couldnt fix it // is was using restore function in "winxp home" to get internet work but i cant still use IE. I was trying to fix it with ad-aware and spybot but it was without any result. Reg.Mecaniker could'nt help.

I also tried to reinstall IE but got strange msg "installation has found one newer version of IE on you computer and becouse cannot continue" // installation file was download with firefox directrly from microsoft home page. and i cant use IE to use windows aotoupdate on web :(.

i was trying hijakthis with no result ;(
and in file extension was found also that link to IE was running with several different "rundll32" + more other dlls in line.

i found also some files that creates with random name in system32 katalog and adds to start up // it happend efter IE running (with install progs).
In filesafe mode, network dont working even if I running it with network connection
====my OS====
win xp home "updated"
______________

Pls help me

Hmmm...........

Have you tried running your AdAware and SpyBot in safe mode?

Try running Trend Micro's "Housecall"............that's their online scanner.

You will need to disable the "restore" function before you do any of this to allow the files to be cleaned.

Try going into "add remove programs" in Control Panel and uninstall IE then re-install it.

Good luck

EDIT: Also download the latest CW Shredder and run that in safe mode. Does your AV/Anti Syware tell you what it thinks the malware is?

I tried to do it in failsafe mode with no result and AVs cannt find any virus or spyware :(

and in Add/Remove progs exist no entry for internet explorer that I can use to uninstall it

Quote:

---

and in Add/Remove progs exist no entry for internet explorer that I can use to uninstall it

---

Just download www.mozilla.com/firefox - Firefox and set it as your default browser, and then delete the drive:/program files/internet explorer directory !

or use a program called XPLite to remove IE completely !

©opy®ight: While that is a somewhat good suggestion for future references and whatnot, that wouldn't solve the problem concerning the spyware that is currently attached to his system.

MrBabis: You were saying how you tried hijackthis with no luck? Let us determine that, run hijackthis (whether in normal or safe mode, doesn't matter) and post your logs here. Some of us (myself included) will try to help sort through it and help you out.

Just a note..... it's actually better to see a HJT log run in regular mode. That way we can get all the running processes.

:)

meeeeeee: Good note old friend, I'm still learning about hijackthis and reading their logs to the best of my knowledge. In this case, run it in normal mode (if you can) and post us the logs from there.

It might not be spyware. Can you give a more detailed description
of the symptoms?
:cool:

I was thinking the same thing, perhaps some form of an e-mail worm or something. Definitely provide us with a more detailed description.

I couldnt fix it // is was using restore function in "winxp home" to get internet work but i cant still use IE. I was trying to fix it with ad-aware and spybot but it was without any result. Reg.Mecaniker could'nt help.
______________________________________________________________________________

Does the above statement mean that it leads (the path) is to restore files? If so you will have to disable system restore then use your removal tools to rid your box of the problem.

Quote:

---

Originally posted here by Spyder32
MrBabis: You were saying how you tried hijackthis with no luck? Let us determine that, run hijackthis (whether in normal or safe mode, doesn't matter) and post your logs here. Some of us (myself included) will try to help sort through it and help you out.

---

I traid to remove all entries and reboot PC but when I starting IE it happend agane and some 3 entryes with random name adds efter starting of IE and evrything begin from begining.

I will post process and startup adds + hijak log late

Some Spyware can't be removed with SpyBot or Adaware " ie. newer versions of CoolWebSearch".

If you will, follow the recommendations as per this link and then post a HighjackThis log to the Security forum.

Zupe and Calamity Jane are particularly adept with advanced removal of Spyware!

Quote:

---

some 3 entryes with random name adds efter starting of IE

---

Have a read of this thread and see if this is relivent to your situation..

http://www.antionline.com/showthread...hreadid=261046

sounds like Malware.. but is it viral or parasite..

cheers

BTW: A read of the Spyware/adware forum could help..
also.. the Spybot and Adawre (se) your using have they been fully updated?
same with HJT..v 1.97.7 is the current.. any less and you could be missing things..

(Psssst...1.98.2 is the most current version of HJT: www.downloads.subratam.org/hijackthis.zip )