Donatella wrote:
> a pc with win 98 is infected with a spyware that shows internet pages
> while working.
> It creates in the %temp% folder the file "se.dll" and it has another
> dll in windows/system with variable name.
> I removed it twice, finding the dll, removing with hijackthis every
> link to this dll and se.dll, but the spyware returns after one or two
> days when you use explorer, what have i left?
> The pc has zone alarm and avast antivirus, antivirus has deleted a
> virus called "trojan startpage" but now it doesn't find any other
> virus.
>
> Thanx

Please print this out and follow *ALL* these directions carefully and
_completely_.

This is a CoolWebSearch (CWS) hijack infection and is hard to remove.

*Note:* Every time you reboot the files multiply and change names.
This process is like exterminating cockroaches.

Close all browser window then click start disinfection.
You may have to reboot the system after it completes.
http://www.trojaner-info.de/cgi-bin/...i?file=sphjfix

Empty the %temp% folder frequently

If this does not work then please download the tool called about:buster from
http://www.downloads.subratam.org/AboutBuster.zip
or
http://www.majorgeeks.com/download4289.html

Unzip it to your desktop.

Run aboutbuster.exe and click Update, click OK, click Start and let it
remove what it finds.
(The system must be on-line to Update)
You may have to run this a couple of times to have it remove all it finds.

Download the latest v1.99.1 version of HijackThis to use and post your new
log here after you have followed all directions:
http://tools.radiosplace.com/hijackthis.zip
or
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

*Important:* Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on
C: then right click and select New then Folder and name it HJT.

Move HijackThis.exe into this folder as you do not want the HijackThis
backup logs in the Temp folder that should be cleaned out periodically or
all over your Desktop.

When you run HijackThis from C:\HJT folder by double clicking on it and have
it "Fixed checked" it will create a backup file of modifications to use if
restore is necessary.

Post a HijackThis log after you have completed the directions in this
support forum:
http://forums.maddoktor2.com/index.php?showforum=17

Install the prevention protection below and *help your friends from being
infected on the Internet.*

"An ounce of prevention is worth a pound of cure."

Remove the infections and install the prevention protection on *ALL* User
Account IDs.

Empty the Recycle Bin frequently.

Run CleanUp! as the Temp folders should be cleaned out periodically as
installation programs and hijack programs leave a lot of junk there.
http://cleanup.stevengould.org/
Then reboot to let it clean out what it found.

Download Windows Prefetch Clean and Control then run it and clean the
Prefetch monthly.
http://www.majorgeeks.com/download2495.html

Defrag the hard drive regularly especially after CleanUp!

By the way, in order to improve Internet Explorer (IE) performance the
Temporary(TIF)should be cleaned out periodically.
Also, it is a good idea to limit the size of the TIF to 10MB for performance
sake.
In IE go to Tools then Internet Options then Settings and move the slider
down to 10MB.

Download and install WinPatrol.
http://www.winpatrol.com

*Note:* WinPatrol is more comprehensive than TeaTimer.
Go to Spybot S&D and disable TeaTimer in the Tools Resident area.

Browser settings for increased security:
http://bshagnasty.home.att.net/browsersettings.htm

Install IE-SPYAD then run the install.bat in the ie-spyad folder and
SpywareBlaster then *keep them up to date* as today's Internet is full of
nasty infections.
https://netfiles.uiuc.edu/ehowes/www...ce.htm#IESPYAD
http://www.bleepingcomputer.com/forums/tutorial53.html
http://www.javacoolsoftware.com/spywareblaster.html
--
YoKenny
Keep your Security software up to date at CoU
http://www.dozleng.com/updates/index.php?&act=calendar