Results 1 to 11 of 11
  1. #1
    Join Date
    Jun 2005
    Location
    Ohio, USA
    Posts
    208

    * ixt0.dll // Browser hijack.

    I somehow got this file on my computer and have deleted it countless times in safemode only ot have it return when I reboot.

    Has anyone else encountered this problem or do you know how to remove it? I've searched several forums and websites of people who had the same problem, but I've not been able to remove it with the instructions listed. Any help would be greatly appreciate. Thank you.
    NuPixel - Custom Web Design & Graphics
    Extraordinary, Not Ordinary
    Web & Graphic Design, HTML, XHTML, CSS, Script Customization & Integration + More!
    Click Today! --> NuPixelStudios.com

  2. #2
    Join Date
    Jul 2003
    Location
    Liverpool, England, UK.
    Posts
    2,561
    Do you mean your computer browser or your web broswer? If its a web browser, what one is it?

    Thanks
    Xcellweb.net - Quality Web Solutions That Work!
    █ Web Hosting | Web Servers | Shoutcast | Domain Names

    Providing High Quality Web Solutions Since July 2002!
    5sterling.com & 9dollars.us - No-frills budget web hosting, VPS, shoutcast and domain names!

  3. #3
    Join Date
    May 2005
    Location
    Planet Earth
    Posts
    813
    Hi,

    if automated software like Ad-Aware or Spybot search & destroy or Windows Defender aren't working it's not over (yet) .


    Here's some basic steps to remove almost any spyware / hijacking program manually.

    - Go to sysinternals.com, and download Process Explorer.
    - Search in Google for HiJackThis download it (it's a program ).
    - Go to lavasoft.com download ad-aware.
    - Install ad-aware + update the spyware definition.

    - Start Process Explorer then View -> Select columns -> Check the image path (gives you the file path of the running program).
    - Write down all the path locations of all processes you don't trust / recognize. (we'll delete them later).

    - Reboot in safemode (highly recommended).

    - Start Process Explorer and kill all suspicious running processes you noted down, if they're coming back, forget them for now.

    - Open regedit and go to: ** be real cautious in the registry, one mistake and you may have to reinstall your computer, however if you stay in the directories listed below you should be just fine even if you make a mistake **
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

    Delete all the keys which are unknown to you (if you aren't sure Google the program's name).

    - Start HiJackThis, click Do a system scan only and uncheck everything suspicious, then click Fix Checked.

    - Ctrl+Alt+Delete, choose task manager, go to processes then kill explorer.exe. Yes the shell will be killed (the windows toolbar will disappear) many spyware are loading themselves through the shell so you must stop it before trying to clean your computer.

    - In the Task Manager, File -> (New task) Run.. -> then find Ad-aware (usually c:\program files\lavasoft\ad-aware.. something like that).

    - Run ad-aware, Full system scan (wait or go make some coffee ), when it's done, click Next, now right click in the list and choose 'Select all objects', then Next again. Ad-Aware may want to restart your computer if it can't delete something, of course you should agree

    - Once restarted your computer should be clean, if it isn't, you may have forgotten something, start all over again.



    FINALLY:

    YES it is a pain in the *** to do it all manually, but if automated cleaning tools can't do the job, you can always follow these steps to manually get rid of all spywares.

    I never found a spyware which wasn't removable using those 'simple' steps.
    (I have a younger sister clicking everywhere on the Web )

    Now it may be the time to install an anti-virus ?

    Happy hunting,

    G
    Last edited by Googled; 10-12-2006 at 12:34 AM.
    PutFile.io ó Disrupting traditional file hosting.
    █ Signup Early and enjoy Unlimited space/bandwidth for your files hosting, Forever!
    █ No Ads.
    █ No Countdowns.

  4. #4
    Join Date
    Jul 2002
    Location
    Tasmania, Australia
    Posts
    34,798
    Did you see this thread at adaware forum?

    http://www.lavasoftsupport.com/index.php?showtopic=1385
    If you donít like the road youíre walking on, start paving a new one.

  5. #5
    Join Date
    Nov 2003
    Posts
    682
    Smitfraud is a bit hard to remove manually unfortunately. Btw Googled- you would want to check the unwanted entries in HijackThis, not uncheck them (HijackThis alone won't get rid of this infection though, it will just keep coming back if you don't remove it fully.)

    Please save or print these instructions before beginning

    Extract SmitfraudFix to your Desktop

    Start your computer in Safe Mode

    From the SmitfraudFix folder on your Desktop, run smitfraudfix.cmd
    Select Option #2 - Clean by typing the number 2 then pressing Enter
    Type Y and press Enter when asked if you would like to clean the registry
    Type Y and press Enter if you are asked if you would like to replace wininet.dll

    Restart your computer and post the the contents of the SmitfraudFix log that pops up
    If the log does not appear, you can find it at C:\rapport.txt

    Run HijackThis and click Do a system scan and save a log file
    Your HijackThis log will open in Notepad. Post the contents of the log here
    Last edited by brendandonhu; 10-12-2006 at 06:52 AM.

  6. #6
    Join Date
    Jun 2005
    Location
    Ohio, USA
    Posts
    208
    Googled // Thank you. I'll try that.

    anon-e-mouse // I've read a thread similar to that, but not that one. Thanks.

    brendandonhu // I'll look into that. Thanks.

    Thank you everyone for your help so far. Much appreciated.
    NuPixel - Custom Web Design & Graphics
    Extraordinary, Not Ordinary
    Web & Graphic Design, HTML, XHTML, CSS, Script Customization & Integration + More!
    Click Today! --> NuPixelStudios.com

  7. #7
    Join Date
    Jun 2005
    Location
    Ohio, USA
    Posts
    208
    Googled // I've done what you suggessted and it APPEARS to have taken care of the issue. Thanks a lot, thank you to everyone.
    NuPixel - Custom Web Design & Graphics
    Extraordinary, Not Ordinary
    Web & Graphic Design, HTML, XHTML, CSS, Script Customization & Integration + More!
    Click Today! --> NuPixelStudios.com

  8. #8
    Join Date
    Nov 2003
    Posts
    682
    This infection leaves files in a lot of folders, you might want to run Smitfraudfix to delete all of them still.

  9. #9
    Join Date
    Jun 2005
    Location
    Ohio, USA
    Posts
    208
    Okay I will. Thank you.
    NuPixel - Custom Web Design & Graphics
    Extraordinary, Not Ordinary
    Web & Graphic Design, HTML, XHTML, CSS, Script Customization & Integration + More!
    Click Today! --> NuPixelStudios.com

  10. #10
    Join Date
    Nov 2003
    Posts
    682
    No problem

  11. #11
    Join Date
    May 2005
    Location
    Planet Earth
    Posts
    813
    My pleasure

    G
    PutFile.io ó Disrupting traditional file hosting.
    █ Signup Early and enjoy Unlimited space/bandwidth for your files hosting, Forever!
    █ No Ads.
    █ No Countdowns.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •