Moved to seperate thread. Read the announcements called **READ BEFORE POSTING**
I too have the same problem as the original poster. I have done everything in this thread to a "T" but with no success. I am using AboutBuster, CWShredder, Adaware, and Hijack this.
Anything I check and "fix" with HijackThis does nothing. It just comes back. I went into regedit and anything I did was undone right away. Usually I can get rid of this crap, but not this time.
2. Download Ad-aware from here. Open the Ad-aware program and near the bottom click the Check For Updates link. This will open the update manager. Follow the prompts to update your Ad-aware Reference File. Close Ad-aware for now, we will use it later.
3. You may want to print out these instructions for further reference when completing the following steps.
4. Make sure your PC is configured to show hidden files
Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"
5. Next, go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.
6. Then reboot your PC into Safe Mode. If you don't know how to do this, see here for further instructions.
7. Restart Hijack This and put a checkmark next to the following entries:
Then delete the following files and folders:
C:\WINNT\system32\ipog32.exe
C:\WINNT\system32\syspd32.exe
C:\WINNT\system32\syscy32.exe
C:\WINNT\system32\winlc32.exe
8. Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.
9. Scan with Adaware and let it remove any bad files found.
10. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure that Temporary Files, Temporary Internet Files and Recycle Bin
11. Reboot to normal mode
12. Finally, pay a visit to Housecall. Scan for and remove any infected files found on your system.
Post a fresh HijackThis log and the AboutBuster report back here please. (Please ensure you include the whole log, including the top bit)
I cannot get digfilt.dll to go away for anything. Housecall couldnt delete it because "it was running", I couldnt manually do it, and with HijackThis, it just continues to pop back up. In fact, both O18's listed in HijackThis log i posted are continuing to come back.
For now it seems gone, to be honest I'm afraid to open my internet explorer from the desktop. Last time it seemed to be gone for about 2 openings, then it came back slowly, with my homepage getting stuck at about:blank, then being at about:blank and having the popups and crap.
I'll try to just walk away from the computer until I'm told I'm fine.
Download the attached zip and
Extract the vbs to the desktop. You will use it shortly. If you
have script blocking enabled you will get a warning when you try to run this script. Please allow it to run. It is going to remove a nasty service
Extract the vbs to the desktop.
----------------------
Copy the bold print to Notepad.
Name the file go.reg
Save as Type All Files
Save on the desktop
Double check to see that the service was removed. Go to start >Run and type Services.msc
Press enter.
Look on the list for a service named Security Agent. It should not be there. But this is a double check. Let me know what you find and if you got the Service Stopped message when you ran the script.
Run HijackThis again and post the new log in your next reply in this same topic.
--------------------
fwki
vktd