Computer infected with Trojan.clciker.CM

ronnieboy
ronnieboy
in Malware talk

Hello.


I have BD Ver. 10. It's has worked well for me for about 6 months, however, a trojan appears to have passed through. It is strange because I do deep scans almost every day and update as well. It shows no infections at all, but when I log on to my MSN explorer I get an elert saying http://popunder.adsrevenue.net/popup?11818...awex&pop=er is infected with trojan.clicker.cm and has been blocked by BD. Sure enough, my MSN web page has been replaced with a "fire search" web page. I have repeatedly deleted the infected file, but it comes back everytime. I have quarantined it and also deleted it in safe mode. I have seen some references that it could be located in some undeleted Norton anti-virus files. Norton was included in one of the software packages when I built my computer, but I never activated it. It was deleted immediately months ago. Unfortunately, I'm not a software guru. Looking for some help. Please!

Comments

  • Niels
    Niels ✭

    Hi ronnieboy


    Download this removal tool for Norton : http://www.softpedia.com/get/Tweak/Uninsta...oval-Tool.shtml If the trojan has injected some Norton files they will get deleted when you run the uninstaller. Because there are still leftovers when you uninstalled it via the normal way.


    Try also this go to start,my computer,rightclick on my computer and choose properties,system restore,check the option disable system restore on all stations confirm by pressing on apply and ok. You will loose your previous systemrestore points.


    Download superantispyware : http://downloads2.superantispyware.com/dow...AntiSpyware.exe


    Update it and reboot your pc into safe mode. Perform a complete scan.


    Reboot your pc again and perform a deep scan. Post the scan log afterwards or attach it with your next post.


    Regards


    Niels

  • ronnieboy
    ronnieboy

    post-2083-1182006744_thumb.jpg


    Niels, thankyou for your reply and help. I downloaded the Norton removal tool and ran it. Also, I disabled system restore as you suggested. The BD alert still comes up with trojan.clicker.cm when I log on to my MSN explorer web page. The screen is still MSN premium, but the center is blocked out with a different search engine. I don't get any random popups which is good.


    I downloaded the superantispyware program and updated it. I ran it in safe mode through administrator and nothing was found. I rebooted and ran another complete scan. Nothing showed again. I have posted the log as as shown. I also ran BD deep scan again and nothing came up.


    More help would be much appreciated! Thanks.

  • Niels
    Niels ✭

    Hi ronnieboy


    Could you please post the location were BitDefender finds trojan.clicker.cm? I can't view your log because only virus researchers can download attachments in this section. You can try this when you use Internet explorer go to tools, maintain insert applications,choose for insert applications that are used by Internet explorer now search for strange entries en select them and press on disable. I recommend that you also download hijackthis : http://www.spywareinfo.com/~merijn/files/HijackThis.exe Place hijackthis in a separate folder e.g c:/hijackthis Doubleclick on hijackthis and choose do a system scan and save a logfile. Copy the entire logfile into your next post. Because if you upload them here on the forum I can't see it but on other forum sections I can download it.


    Regards


    Niels

  • ronnieboy
    ronnieboy

    Niels,


    Bit defender identifies the infected file as: http://popunder.adsrevenue.net/popunder.ph...blk=1&fc=-1


    Also, I tried accessing internet explorer by double clicking the blue "e" icon and received an error message stating the following:Cannot find 'file///c:/program/msn/msncoreFiles/msn.exe' make sure the path or Internet address is correct. I do get internet service by clicking the MSN "butterfly" icon.


    Here is the hijack log file as shown below:


    Logfile of HijackThis v1.99.1


    Scan saved at 5:13:33 PM, on 6/16/2007


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\ZoneLabs\vsmon.exe


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe


    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe


    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe


    C:\Program Files\Softwin\BitDefender10\vsserv.exe


    C:\WINDOWS\Explorer.EXE


    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe


    C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe


    C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe


    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE


    C:\Program Files\Softwin\BitDefender10\bdmcon.exe


    C:\Program Files\Softwin\BitDefender10\bdagent.exe


    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe


    C:\WINDOWS\CTHELPER.EXE


    C:\Program Files\QuickTime\qttask.exe


    C:\Program Files\iTunes\iTunesHelper.exe


    C:\WINDOWS\System32\svchost.exe


    C:\Program Files\MSN Messenger\MsnMsgr.Exe


    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe


    C:\Program Files\Hewlett-Packard\AiO\hp officejet 5100 series\Bin\hpoant07.exe


    C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe


    C:\Program Files\iPod\bin\iPodService.exe


    C:\WINDOWS\system32\hpoipm07.exe


    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe


    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe


    C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe


    C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe


    C:\Documents and Settings\User\Desktop\iefix\IEFix.exe


    C:\WINDOWS\system32\msiexec.exe


    C:\Documents and Settings\User\Desktop\HijackThis.exe


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\ProgramFiles\MSN\MSNCoreFiles\msn.exe


    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll


    O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray


    O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot


    O4 - HKLM\..\Run: [AsusServiceProvider] C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe


    O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"


    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"


    O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe


    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe


    O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg


    O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"


    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"


    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE


    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"


    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background


    O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe


    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe


    O4 - Global Startup: HPAiODevice(hp officejet 5100 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet 5100 series\Bin\hpoant07.exe


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000


    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204


    O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-3-48.cab


    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll


    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe


    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe


    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)


    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)


    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)


    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)


    Thanks again for your help.

  • Niels
    Niels ✭

    Hi ronnieboy


    When I look at your logfile I can't find any bad entries. But try to delete this folder manually: c:/program/msn/msncoreFiles/msn.exe Because that isn't the default installation location. Try also to clean up your temporary internetfiles. You can do this manually in IE by going to tools,internet options,temporary iinternet files press on remove files and check remove also all offline files. Download also toolbar cop: http://www.majorgeeks.com/download4126.html


    I see that you already have iefix. Run it. Finally go to the registry by doing this: go to start,run,at the run dialog box type regedit press enter and go to this key: HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel You have first to click on the +-icon before HKEY_CURRENT_USER and so on. If you see ResetWebSettings or HomePage entry delete it. Check also these keys:


    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main


    HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main


    HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main


    Check Default_Page_URL and Start Page and see if you find a website that you don't know.


    Regards


    Niels

  • ronnieboy
    ronnieboy

    Hi Niels,


    I can't find c:program/msn/msncoreFiles/msn.exe. I cleaned up temporary internet files including offline files per your direction. I downloaded iefix and ran the program. It asked me to retrieve the EXPLORER.EXE file from my SP2 disk which I did. I checked the HKEY files. I didn't see "resetwebsettings" or "Homepage entry" anywhere. The default_Page_URL start page had the MSN web site on it as well.


    I downloaded tool bar cop. See below for log file:


    Browser Add-on Report generated by ToolbarCop v3.4


    6/17/2007 12:34:52 PM


    --------------------------------------------------------------


    Browser Extension: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL - Enabled - All Users


    Browser Extension: Messenger - {FB5F1910-F110-11D2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe - Enabled - All Users


    Toolbar: &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - %SystemRoot%\system32\Browseui.dll - Enabled - Current User


    Toolbar: &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - %SystemRoot%\system32\SHELL32.dll - Enabled - Current User


    Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (empty) - Enabled - Current User


    BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - Enabled - All Users


    Menu Extension: E&xport to Microsoft Excel - - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 - Enabled - Current User


    Run - Startup: MsnMsgr - - "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background - Enabled - Current User


    Run - Startup: SUPERAntiSpyware - - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe - Enabled - Current User


    Run - Startup: SoundMAX - - "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray - Enabled - All Users


    Run - Startup: JMB36X Configure - - C:\WINDOWS\system32\JMRaidSetup.exe boot - Enabled - All Users


    Run - Startup: AsusServiceProvider - - C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe - Enabled - All Users


    Run - Startup: Ai Nap - - "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe" - Enabled - All Users


    Run - Startup: ATICCC - - "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" - Enabled - All Users


    Run - Startup: SoundMAXPnP - - C:\Program Files\Analog Devices\Core\smax4pnp.exe - Enabled - All Users


    Run - Startup: NeroFilterCheck - - C:\WINDOWS\system32\NeroCheck.exe - Enabled - All Users


    Run - Startup: BDMCon - - "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg - Enabled - All Users


    Run - Startup: BDAgent - - "C:\Program Files\Softwin\BitDefender10\bdagent.exe" - Enabled - All Users


    Run - Startup: Zone Labs Client - - "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" - Enabled - All Users


    Run - Startup: CTHelper - - CTHELPER.EXE - Enabled - All Users


    Run - Startup: CTxfiHlp - - CTXFIHLP.EXE - Enabled - All Users


    Run - Startup: QuickTime Task - - "C:\Program Files\QuickTime\qttask.exe" -atboottime - Enabled - All Users


    Run - Startup: iTunesHelper - - "C:\Program Files\iTunes\iTunesHelper.exe" - Enabled - All Users


    List of running Processes


    --------------------------------------------------------------


    \SystemRoot\System32\smss.exe


    \??\C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\ZoneLabs\vsmon.exe


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\Explorer.EXE


    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe


    C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe


    C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe


    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE


    C:\Program Files\Softwin\BitDefender10\bdmcon.exe


    C:\Program Files\Softwin\BitDefender10\bdagent.exe


    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe


    C:\WINDOWS\CTHELPER.EXE


    C:\Program Files\QuickTime\qttask.exe


    C:\Program Files\iTunes\iTunesHelper.exe


    C:\Program Files\MSN Messenger\MsnMsgr.Exe


    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe


    C:\Program Files\Hewlett-Packard\AiO\hp officejet 5100 series\Bin\hpoant07.exe


    C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe


    C:\WINDOWS\system32\hpoipm07.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe


    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe


    C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe


    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe


    C:\Program Files\iPod\bin\iPodService.exe


    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe


    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe


    C:\WINDOWS\System32\svchost.exe


    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe


    C:\Program Files\Softwin\BitDefender10\vsserv.exe


    C:\Documents and Settings\User\Desktop\toolbarcop\Toolbarcop.exe


    Operating System details


    ----------------------------------------------------------


    Operating System: Windows XP 5.1


    Build: 2600


    Service Pack level: Service Pack 2


    Maybe this will lead to some clues. Thanks for your help.

  • Niels
    Niels ✭

    Hi ronnieboy


    I took a look but I can't find anything malicious. There are some items that aren't necessary. Have you still that problem? Youcan try this also redownload ie: http://www.microsoft.com/windows/downloads/ie/getitnow.mspx And use the repair option.


    Regards


    Niels

  • ronnieboy
    ronnieboy

    Niels,


    Unfortunately, I'm still having problemms. I downloaded the Internet explorer file. After restart, I clicked the intenet explorer "e" icon and it stated " Internet explorer cannot display webpage". I clicked my msn icon and the trojan.clicker.cm came up again as usual......


    I'm ready for radical surgery. Can I reload my OS oftware and remove this problem? I have all of the existing software and at this point of time it will probably be the faster solution. Can you tell me how to delete the original install and re-install it again? Do you think it would solve my "pop up" problem by doing a complete reinstall?


    Thanks again,


    Ronnieboy

  • AndreiASM
    AndreiASM

    A complete OS reinstall should be the last solution. It will clean everything you have on your system partition, including work, documents, programs etc. so make sure to save your work. You must be carrefull because if you have malware in other partitions you can get infected again after a clean reinstall.


    Andrei

  • Niels
    Niels ✭

    Hi ronnieboy


    Uninstall msn completely. Reboot your pc. Perform another complete scan with superantispyware in safe mode. After that perform a deep scan again with BitDefender. Because I think that the virus has attach itself to your msn installation. Are you able to receive mails? If not than you have to download winsockfix: http://www.snapfiles.com/get/winsockxpfix.html Run it press on fix reboot your pc and retry.


    Try this also download dr web cureit!: ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe Download it and let it run in normal mode and also in safe mode. But do not remove vsserv.exe because that is related to BitDefender or anything in the Softwin or BitDefender folder otherwise you have to repair BitDefender. I will wait for a repair or a complete reinstall of your os.


    Regards


    Niels

  • ronnieboy
    ronnieboy

    Niels,


    I plan on deleting MSN completely including the MSN messenger portion. I will then go through the steps suggested above.


    I have one question, however, regarding history files as they relate to the internet explorer. Apparently history files are shared between internet explorer and msn explorer. Are these cleaned out when all temporary internet files are deleted or are they something different? I wanted to make sure that the "history" files are deleted as well and I'm certainly not an expert in these matters. I typically use a registry cleaner after logging off from the internet and a history.ies file always appears even when I log on and log off immediately in that order. Maybe this is normal but just wondereing.


    Thanks.

  • Niels
    Niels ✭

    Hi ronnieboy


    That is a good question. I don't think when you delete the temp files in IE that they also will be cleaned in msn explorer. What options do you have in msn explorer? I ask it because I don't have msn explorer.


    Download ccleaner: http://www.filehippo.com/download/9838386a...32ae2/download/ Do not forget to uncheck yahoo toolbar during installation and use the cleanup function. But run it also in safe mode.


    Regards


    Niels

  • miekiemoes
    miekiemoes
    edited June 2007

    Hi Ronnieboy,


    Cannot find 'file///c:/program/msn/msncoreFiles/msn.exe' make sure the path or Internet address is correct.


    I see from your HijackThislog that the reference to your startpage is set to this:


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\ProgramFiles\MSN\MSNCoreFiles\msn.exe


    which explains why it can't find it, because why would you set a file as a startpage? And in this case, it shows C:\ProgramFiles which should be C:\Program Files... ofcourse it won't be found. Or you use the variable %ProgramFiles% or you use C:\Program Files....


    Anyway, check and fix above entry in HijackThis. That should solve the error when you doubleclick the IE icon.


    Concerning the trojan.clicker.cm alert when you open MSN Explorer. This is a "problem" with MSN explorer startpage itself, since you said you have replaced it with a "fire search" web page..


    Not really sure what you mean by this, but it looks like on that Fire search web page, this popunder is displayed: http://popunder.adsrevenue.net/popunder.ph...blk=1&fc=-1 What you can do here is, block popunder.adsrevenue.net via your host file.


    127.0.0.1 *.adsrevenue.net


    Or it may be better to just download and use the MVPs hosts file:


    http://www.mvps.org/winhelp2002/hosts.htm


    This blocks a lot of unwanted sites including adsrevenue.net

  • Niels
    Niels ✭

    Hi miekiemoes


    Thanks alot for your assistance.


    Regards


    Niels

  • ronnieboy
    ronnieboy

    Niels,


    I deleted as many aspects of MSN as I could in the safe mode. This included msn messenger and msn games as well. Also, deleted all temp. internet files, history files, cookies, etc. before new install........ I have c_cleaner already as I find it very useful. After performing these functions and having a clean copy of msn installer on my flash drive, the msn explorer was re-installed. The trojan is now gone!!!! I performed multiple scans which turned up clean and no registry alerts. It must have been attached to a msn file of some sort. If I was more experienced, then I might have figured this out sooner! It is a good learning experience which will help in the future. I appreciate all of your help. Thankyou Miekiemoes as well for additional feedback which helped. IE now works as well. My kids have parental privacy controls on their emails, hence sometimes they jump on my mine since they know my password. Better change it I say!


    Thanks again very much for your help!

  • Niels
    Niels ✭

    Hi ronnieboy


    I suggest that you also install this free protection so some toolbars,spyware,adware,browser hijackers,... can't install: http://www.majorgeeks.com/SpywareBlaster_d2859.html It will protect Internet explorer as Firefox. Install it and run it press next till you get in the main screen. Go to updates,press on check for updates. Press now on protection under quick tasks press on enable all protection. Glad that I and miekiemoes could help you.


    Regards


    Niels

All Time Leaders

Categories

Defenders of the month