hijacked internet explorer windows
Discussion
A) Get firefox when it's all fixed!
B) Google Spybot Search and destroy, install it, update it and run it. You may need to restart in safe mode and run it again (Press F8 when it's booting) to properly clean the machine.
C) If that doesn't work we'll try running HijackThis and getting rid of it manually (nervous of saying by hand!
) using the log files.
B) Google Spybot Search and destroy, install it, update it and run it. You may need to restart in safe mode and run it again (Press F8 when it's booting) to properly clean the machine.
C) If that doesn't work we'll try running HijackThis and getting rid of it manually (nervous of saying by hand!
) using the log files.BliarsGoing said:
A) Get firefox when it's all fixed!
B) Google Spybot Search and destroy, install it, update it and run it. You may need to restart in safe mode and run it again (Press F8 when it's booting) to properly clean the machine.
C) If that doesn't work we'll try running HijackThis and getting rid of it manually (nervous of saying by hand!) using the log files.
It affects Firefox as well. B) Google Spybot Search and destroy, install it, update it and run it. You may need to restart in safe mode and run it again (Press F8 when it's booting) to properly clean the machine.
C) If that doesn't work we'll try running HijackThis and getting rid of it manually (nervous of saying by hand!
) using the log files.Spybot S & D won't find it (I tried)
Ad-Aware won't find it (I tried) - thats Free & Pro versions.
You cannot get rid of it manually.
GregE240 said:
BliarsGoing said:
A) Get firefox when it's all fixed!
B) Google Spybot Search and destroy, install it, update it and run it. You may need to restart in safe mode and run it again (Press F8 when it's booting) to properly clean the machine.
C) If that doesn't work we'll try running HijackThis and getting rid of it manually (nervous of saying by hand!) using the log files.
It affects Firefox as well. B) Google Spybot Search and destroy, install it, update it and run it. You may need to restart in safe mode and run it again (Press F8 when it's booting) to properly clean the machine.
C) If that doesn't work we'll try running HijackThis and getting rid of it manually (nervous of saying by hand!
) using the log files.Spybot S & D won't find it (I tried)
Ad-Aware won't find it (I tried) - thats Free & Pro versions.
You cannot get rid of it manually.
Sounds like the sort of critter you need to be sat in front of the machine to fix.
Charlie, do me a favour mate: check your c:WindowsSystem32 folder:
(you may wish to sort the folder by DATE - I found it a little easier to find when my laptop became infected)
There may be a file there called "QOPNO.DLL"
If so, there will be a file there called "ONPOQ.INI", around 565K in size.
You won't be able to delete the .DLL file but the .INI file can be deleted. If you do so, it re-generates almost immediately?
There are also some random named files created almost daily that are around 45K in size - you can delete these as they are harvest files that the .DLL generates.
Can you look for that for me mate?
(BTW - you cannot delete the .DLL as it is called by the WinLogon service - Winlogon.exe - this means you can't even delete the bastard in Safe Mode)
Next step to follow!!
Greg
(you may wish to sort the folder by DATE - I found it a little easier to find when my laptop became infected)
There may be a file there called "QOPNO.DLL"
If so, there will be a file there called "ONPOQ.INI", around 565K in size.
You won't be able to delete the .DLL file but the .INI file can be deleted. If you do so, it re-generates almost immediately?
There are also some random named files created almost daily that are around 45K in size - you can delete these as they are harvest files that the .DLL generates.
Can you look for that for me mate?
(BTW - you cannot delete the .DLL as it is called by the WinLogon service - Winlogon.exe - this means you can't even delete the bastard in Safe Mode)
Next step to follow!!
Greg
Yeah, kind of. Charlie needs to download & run the VundoDelete file from here:
http://forums.mcafeehelp.com/viewtopi
This utility got rid of mine.
EDIT: looked at that thread Rob - it suggests that its called by Explorer.exe which is wrong - its called by WinLogon - at the time I thought "I'll run cmd.exe, kill the explorer.exe process & zap it that way - didn't work
http://forums.mcafeehelp.com/viewtopi
This utility got rid of mine.
EDIT: looked at that thread Rob - it suggests that its called by Explorer.exe which is wrong - its called by WinLogon - at the time I thought "I'll run cmd.exe, kill the explorer.exe process & zap it that way - didn't work
Edited by GregE240 on Wednesday 11th October 11:32
Did it find anything?
I found thr qopno.dll myself by rearranging the System32 folder by date, checked the file properties and found nothing, which got me suspicious. Tried Googling "qopno.dll" and got back some results suggesting it was a trojan of some sort.
Well, hope it worked for you, Charlie.
I found thr qopno.dll myself by rearranging the System32 folder by date, checked the file properties and found nothing, which got me suspicious. Tried Googling "qopno.dll" and got back some results suggesting it was a trojan of some sort.
Well, hope it worked for you, Charlie.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff