money.cafreedom.com

[matt]

i have none of those programs you mentioned, and i am keeping it blocked.  what trojan/keylogger scaning software should i use?

[2k dummy]

I recommend The Cleaner. It is not freeware but can be downloaded for a 30 day free trial. $49.95 if you you decide to keep it after the trial period.

[matt]

i also ran a scan with that it too came up empty  :-/

[Raptor]

Have you bothered going to the URL?

what do you want to find here?

Doesn't even set a cookie.

I think you should scan your entire system to the fullest extent using different spyware and virus scanners and configuring them all to scan each file and folder.

[dl65]

matt.....Go to the link below.....it will explain all of the entries and will direct you to various places so you can check each item.
http://computercops.biz/HijackThis.html
I just had a quick look at your log and it doesn't appear to be complete .......did you neglect to post all of it ?
BTW , you asked about your enties 1 and 3

O2 - BHO: (no name) - {11CEFA27-5AE9-46CB-B791-738C242B4761} - E:\WINDOWS\system32\6ji.dll  ......this entry looks odd .....

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
This entry is normal and ok

perhaps you should check out all of your log entries after reading the explanation link .

let us know
dl65  

[merlin_2]

firewall PeerGuardian as well its seems? run my old mate the best there is>http://removespyware.net/ratings/spy-sweeper.htm  and sorry to jump into this post....

[matt]

i have gone to the website, through firefox and saw "what do you want to find here", figured that couldnt be good, i downloaded spysweapers, it found something on my D: (secondhard drive), but i still get the trying to connect to money.cafreedom.  

that was my full hijack this file, sense i reinstalled windows i've kept all internet explorer things blocked with my firewall.


here is screenshot of the actuall firewall popup:
http://www.msu.edu/~rosemat2/images/money.htm

and of my hijackthis log:
http://www.msu.edu/~rosemat2/images/hijack.htm


not that that will help, but could this be in a different sectoin of my hd, i've been scanning all:

C: is a fat32 i've used for storage between linux and xp.  i currenlty have no linux on my system.  it is usually on D: which is a second 6 gb harddrive.  my E: is my xp ntfs harddrive.

[matt]

AHH HAAA!!! its fixed


it was that first entry in hijack this:

O2 - BHO: (no name) - {11CEFA27-5AE9-46CB-B791-738C242B4761} - E:\WINDOWS\system32\6ji.dll

i went to http://computercops.biz/HijackThis.html , and did a search on it, it came up with no responce so i deleted it, and that did it.  

THANKS FOR ALL THE HELP!!!!!  

[matt]

*censored*!
no its not, when i delted it from hijack this it went away, how ever when i restarted my computer it came back!, i re-deleated it from hijack this, and uninstalled peer gardiean, then rebooted and it came back, agian , what could be adding it everytime i reboot?

[dl65]

matt......have you had a look in .....
WINDOWS\system32\6ji.dll to see if its there and then manually remove it ....
Keep looking its hiding in there somewhere .

let us know
dl65  

[matt]

im looking in my E:\WINDOWS\system32, i selected show hidden folders too, im not finding it, could it be in my temp file somewhere?  im still looking but cant seem to find it.  ive done a windows search too.

[merlin_2]

it maybe lurking in the reg...disable system restore and delete it again...and to be sure disconnect your pc from the net..

[matt]

i dont have system restor set up, how do i go about disabling it

[Raptor]

Right click My Computer -> Properties -> System Restore (tab) Disable it on all partitions/HDD's.

[matt]

i undid it, rebooted still had it, allowed it then undid it agian, and rebooted, still have it