[ Outline ] · Standard · Linear+ Help with some problems

[Songi]

Hey Mates, i'm having a few problems with my computer i was hoping that you guys would be able to help me.

First problem is my homepage stays blank. no matter how many times i change it, it always goes back to being blank. I've tried to manually change it, i tried looking in the registey, tried running spyware software, and nothing cept of a format and reinstall seems to work.

Second problem it seems that my computer really likes to slow down from time to time. some of the times a simple webpage will take up all my cpu resourses. and if i even dare try to open two websites it crashes internet explorer.

third when i use spybot search and destory it finds some spyware and then deletes it, but it says that some can't not be deleted, try again at windows boot up. so i try again and all the spyware is back again.

thats all i can think of at the moment. its just a real pain. i tried checking for viruses and i deleted all the ones that i had, but nothing i do seems to get rid of these problems. any help would be greatful.

[artzelda]

try this

Click on the link below to download CWshredder
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Run the program and let it do it's thing. Make sure to click on "Fix" and not scan only.

Then run hijack this (http://www.thespykiller.co.uk/)

First thing to do is Make a folder on your hard drive, like c:\hjt and move hijackthis.exe into a folder, don't run it from your temporary internet files.


Run HJT again and check:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {6EEA0809-1F57-4638-863D-CFEF3545BEEC} - C:\WINDOWS\System32\ljble.dll


Close all applications and browser windows before you click "fix checked".


Include this one if it's not valid.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://vip-fld-pxy:8080/fieldceproxy.pac

Then:

Restart in safe mode.

Open My Computer. Go to Tools, Folder Options and click on the View tab. Make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files". Now click "Apply to all folders"
Click "Apply" then "OK"

Now using Windows Explorer delete the following.

C:\WINDOWS\System32\ljble.dll --> file

Reboot and post another HJT log.

This post has been edited by artzelda: Apr 11 2004, 06:41 PM