Re: Spyware - wajgy.dll

From: Malke (malke_at_nospoonnotreally.com)
Date: 07/30/04 

Date: Fri, 30 Jul 2004 13:55:06 -0700

shiloh wrote:

> I have Machine running XP Pro, runs real well except there
> is file that is in this machine that I can't remove. It
> sets the browser home page to:
> res://wajgy.dll/index.html#96676
>
> I have not been able to remove it. It totally takes over
> the machine, I get pops ups, if you type in an address
> without the www it takes you to this page.. No utility I
> have tried has removed it, I have gone through the
> registry removing suspicious files and it will not go
> away.
>
> In searching on the net I find no instance of it.
>
> HELP! It is driving me crazy!!!
> Thanks - Shiloh

You have a spyware hijacker. Here are the general steps in removing
viruses and spyware:

Scan with a current antivirus program (meaning a version not earlier
than 2002 and using updated virus definitions). Also, remove spyware
with Spybot Search & Destroy from www.safer-networking.org and Ad-aware
from www.lavasoftusa.com. Be sure to update these programs before
running them. These programs are free, so run them both since they
complement each other. It is best to run antivirus and spyware removal
tools in Safe Mode. You may also want to run CWShredder and HijackThis
from http://aumha.org/freeware.htm. Although CWShredder is no longer
being updated, it will still clean older variants of the CoolWebSearch
malware. Please read the instructions carefully. I also find that a
combination of HijackThis and AboutBuster to be very useful in removing
the type of hijacker you've got. However, skill is required.

Also, make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update. Make sure
you are running a firewall.

Malke 

-- 
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"