Zyklon -B wrote:
Recently I have been hounded by this search assisstant hijacker, and a
related one called Shopping wizard. It has disabled MS explorer,
amongst other things. Also seems to be able to manipluate Spybot.
They both show up in the "add/remove" control panel and lead to an
URL with no .isu file they cannot be uninstalled. Oh, and here's
where it gets really nasty, I reinstalled XP, and there it was again,
in the Windows directory, just a collection of .dll's and an .lex
file. The file folder cannot be deleted, or if you are successful,
wait 5 seconds and it respwans. Is this some MS programmer's "Easter
Egg"? By the way Norton does not catch it in a virus sweep. I tied
the file to these .exe's using fileAlyzer:
wuauclt.exe,lsass.exe,smss.exe,alg.exe, and I suspect it also has
claws in a few others. Can you help?

As you have seen, this parasite is a particularly nasty one. I would not
recommend trying to get rid of it without some expert one-on-one help.

Go to the following URL and download the Hijackthis.zip file. Expand the zip
file and run setup to install the program.

http://aumha.org/downloads/hijackthis.zip

Next, go to this website and click on the Register link at the top of the
page (Free). Read the
"Announcement: INSTRUCTIONS FOR POSTING HJT LOGS HERE" at the top of the
topics list
and follow the instructions.

AumHa Forums:
http://forum.aumha.org/viewforum.php?f=30

Run a scan with Hijackthis and copy the log results. Paste the log to the
Hijackthis forum, in a new thread, including the details of the problem.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User