Shoutbox

quote:

---

Originally posted by buzz
http://www.d-a-l.com/help/archive/index.php/t-574.html

this guy and a few others found a way

---

Thanks Buzz... I will try it as soon as I reach home today

you need to also clear your host file in the c:\windows\system32  folder as this can store browser hijack info and prevent the system from completely getting rid of it

then use Ad-aware se to lock the host file

quote:

---

Originally posted by squall_leonhart69r
you need to also clear your host file in the c:\windows\system32  folder as this can store browser hijack info and prevent the system from completely getting rid of it

then use Ad-aware se to lock the host file

---

Good advice. Spybot also has a function that enters addresses for a whole bunch of malware installing sites and tells your computer to look at 127.0.0.1 for them. This includes lop.com, so it's a bit of a pain if you're looking for the uninstaller for a friend, but other than that it's really very convienient. I would really recommend switching to FireFox, Opera, or any other alternate browser because, as I said, they less vulnerable to conventional hijacking methods.

quote:

---

Originally posted by waqastariq

quote:

---

Originally posted by Markus
That's not enough! He has a browser hijacker that keeps changing it's homepage at startup, but it shows about:blank in the addres bar. I've had the same hijacker.

---

Yeah, Finally someone getting me... so any idea what should I be doing?

---

If this is the case, follow these instructions.

1. Start > Run > Type msconfig
2. A box will come up. Click on the startup tab.
3. The ticked files are the ones that run when you first startup your computer.
4. Untick any files that you do not recconise.
5. restart your computer.

Hope that helps

quote:

---

Originally posted by chris4
4. Untick any files that you do not recconise.

---

Recognize you mean .
Just google for all the processes (like atiptaxx.exe [Ati software], navaps32.exe [Norton] and other processes in your Startup list @ MSConfig to see if they are malicious).

By the way waqastariq,
If you don't know what entries to check in HijackThis, please do a scan with HijackThis and attach the log file here. I'll tell you which entries to select and remove/reset

quote:

---

Originally posted by chris4
If this is the case, follow these instructions.

1. Start > Run > Type msconfig
2. A box will come up. Click on the startup tab.
3. The ticked files are the ones that run when you first startup your computer.
4. Untick any files that you do not recconise.
5. restart your computer.

Hope that helps

---

Hey these are only two entries there one is MSN Messenger (I use Plus in office ) and the other is se... just see the attach file to se the full name... I unticked it and restarted but for some strange reson it ticked it self again by itself

What to do????

I have never seen se.dll, but I can tell you it is NOT trustworthy. Uncheck both of them and apply the settings. Anything in your Temp or LocalSettings folder usually isnt trustworthy, and any DLLs or anything beginning with Rundll also has a small chance of being untrustworthy.

I will search for more information about se.dll later, for now, remove it. Also, can you attach a screenshot of the Services tab? (make sure you select 'Hide all microsoft services' before taking the screenshot)

Also, end any tasks called 'RunDll32' in your task manager before unticking it, or it will just reenable itself. I suggest you right click System and click End Process Tree to end all processes before doing this aswell, then using the Task Manager to start msconfig.

quote:

---

Originally posted by ShawnzAlso, can you attach a screenshot of the Services tab? (make sure you select 'Hide all microsoft services' before taking the screenshot)

---

There are NO other 'Services' when I hide all microsoft ones... There was a 'rundll32' when I opened the task manager ended it... here is a screen shot of my WTM

quote:

---

Originally posted by Shawnz
I have never seen se.dll, but I can tell you it is NOT trustworthy. Uncheck both of them and apply the settings. Anything in your Temp or LocalSettings folder usually isnt trustworthy, and any DLLs or anything beginning with Rundll also has a small chance of being untrustworthy.

---

I told you before, I UNTICKED it but after EVERY restart it checks its self back again...

Well im not sure I can help you here but heres the information on se.dll promised to you earlier. Also, try a general Search of your computer for se.dll, you could be lucky

File Name:       se.dll
Description:
    Se.dll is a IE Browser Helper Object of adware SCBar/SearchExe variant. It adds a toolbar to Internet Explorer and generates popup ads while online.

quote:

---

Originally posted by inc_haydn
Well im not sure I can help you here but heres the information on se.dll promised to you earlier. Also, try a general Search of your computer for se.dll, you could be lucky

File Name:       se.dll
Description:
    Se.dll is a IE Browser Helper Object of adware SCBar/SearchExe variant. It adds a toolbar to Internet Explorer and generates popup ads while online.

---

Ok, but how to get rid of it???