[mattwhite]

I am running:

Dell 3000
Windows XP Home Edition
SP2
Pentium4 CPU 4GHz
1GB Ram
145GB Hard Drive
42GB Free
eTrust anti-virus (provided by Mediacom Cable Modem provider)
Adware 2007
Spybot Search and Destroy
5 Users - All are Administrators. All over 17 yrs.

About 6 weeks ago the computer started acting funny.

While on the internet pages started taking longer to load. This is about the time my son got on-line with Halo for XBox 360. Not networked thru the computer just using a Linksys wireless router.

Sometimes when Users click on Internet Explorer Microsoft Word Installer begins to run. (I already have Word Installed)

It had been a while since running Spybot. When I checked for updates it would not let me download the update. So I uninstalled Spybot and tried to install it again and it would not let me install. (Can't remember the warning) I logged on under my wife's user name and it let me install and run spybot. We have 5 users and her user is the only one that can actually run the spybot program. Adware 2007 will run under any user.

My wife's user is the only one that can now access the Program Files directory. Everyone used to be able to access this directory. When logged on under my user I right click on Program Files directory and click on sharing tab and it says, at the bottom, "All options on this tab are disabled because this folder is used by the operating system"

I there are 13 files that I have tried to delete and it tells me Access denied: Make sure disk is not full or write protected and that the file is not currently in use. These files are Word back up files.

I can not get a system restore point to restore.

Yesterday I ran easy cleaner under each user and removed quite a few registry entries that it said was invalid. I also removed a lot of unnecessary files. Ran Defrag and Error Checking (on reboot).

Sorry I was so long winded. Just trying to give all the info I could.:wave:

Thanks,
Matt

 

[ThorXP]

Re: I think I have been hijacked

Welcome to TSF....

To get Expert Help with malware removal:

I recommend that you read this article… ("Simply, click on the links to be re-directed.)

"Having problems with spyware and pop-ups? - First Steps";
http://www.techsupportforum.com/sec...read-before-posting-malware-removal-help.html

Please follow the instructions very carefully; then, post all the requested logs and information; as instructed, in the
HiJackThis Log Help Forum.
http://www.techsupportforum.com/security-center/hijackthis-log-help/

Please ensure that you create a new thread in the HiJackThis Log Help Forum;
not back here in this one.

When carrying out The 5 Steps,
http://www.techsupportforum.com/sec...read-before-posting-malware-removal-help.html

if you cannot complete any of them for whatever reason, just continue on with the next one until they are all completed.
However,it is extremely important to make mention of the fact that you could not complete any of the steps in your post to HiJackThis Log Help Forum.
http://www.techsupportforum.com/security-center/hijackthis-log-help/

where an Analyst will assist you with other workarounds.

Once done, please be patient, as the Security Team Analysts are usually very busy; one of them will answer your request as soon as they can. .

 

[mattwhite]

Re: I think I have been hijacked

Thanks ThorXP!!

I will follow your instructions.