Re: about:blank SPYWARE... help me!!!
From: paulito (paulito3_at_yahoo.com)
Date: 06/15/04
- Next message: Bernard: "Re: Connecting to localhost"
- Previous message: James: "Re: IIS/Security Seminars?"
- In reply to: rjandacek: "Re: about:blank SPYWARE... help me!!!"
- Next in thread: Ranger: "Re: about:blank SPYWARE... help me!!!"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 14 Jun 2004 22:43:13 -0700
I had the exact same problem. Ad-aware has a fix for it now. Just run it
and get the most recent update (06/14/2004). I ran it and fixed everything.
rjandacek@cox.net (rjandacek) wrote in message news:<a06da062.0406101319.7e719944@posting.google.com>...
> I had the same exact problem and this is how I solved it.
> 1) I determined when (at what time) the machine was infected by
> searching for modified files on that date.
> 2) I then found 2 files created on that date that weren't installed
> with any user interaction (because that user said they didn't install
> any programs on that date)....which I verified. The two files that are
> in question in my case were ipolon.dll and iun6002.exe.
> ipolon.dll was located in C:\windows\system32 (XP Pro is the O/S)
> iun6002.exe was located in the root of the O/S install ( c:\windows)
> I renamed both these files to .old
> I then rebooted into safe mode and reran Spybot S&D and Adaware and
> deleted any results found with these programs....
>
> This seemed to solve the problem, and I hope it helps someone
> else....until this particular problem becomes "well-known" by spyware
> defender's, a manual hack maybe the only choice. --Robert
>
>
>
> meripete <meripete.17l3de@mail.webservertalk.com> wrote in message news:<meripete.17l3de@mail.webservertalk.com>...
> > I booted used the following steps to solve the same problem:
> > 1. Run Adaware 6.0 and delete anything it finds.
> > 2. Boot in Safe Mode (F8 during startup).
> > 3. Deleted a bunch of files that had a time-stamp matching the time
> > when my problems started. For my system, it meant the following files
> > from system32: bhbpk.dll, dwspyvb.dll, fjfklm.dll, imh.dll i think this
> > was the culprit), lcpjl.dll, lihnkmc.dll, mhim.dll, wpa.dbl; from
> > windows: dict.dat, zaebalinah.exe, winh.exe, iun6002.exe.
> > 4. Still in safe mode, I ran Adaware again. It found one more piece of
> > spyware.
> > 5. Ran HijackThis.exe and removed anything that was related to Internet
> > Explorer except google toolbar stuff.
> > 6. Rebooted in normal mode. Launched IE and set my homepage to google.
> > 7. Closed IE and launched it again to see if the home page would revert
> > back to about:blank. Luckily, it didn't.
> > 8. Rebooted and tried closing and opening IE a couple of time to be
> > entirely sure.
- Next message: Bernard: "Re: Connecting to localhost"
- Previous message: James: "Re: IIS/Security Seminars?"
- In reply to: rjandacek: "Re: about:blank SPYWARE... help me!!!"
- Next in thread: Ranger: "Re: about:blank SPYWARE... help me!!!"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|