Hi, i just got a new Dell notebook and am already infested with this problem. I can't remember what I installed but i was frantically surfing around the net installing a whole bunch of applications.

I think the sysprotectionpage is the most obvious one, I do not think anything else is there as I have run Ad-aware 1.06, S&D 1.4, cwshredder and a couple other online tools several times to no respite from this sypware.

HJT log attached. any help would be greatly appreciated.

Hello and welcome to Techspot.

You have the Smitfraud infection.

Go HERE and follow the instructions carefully.

Then go HERE and do likewise.

Post a fresh HJT log after doing the above.

Regards Howard :wave: :wave:

problem gone ( i think)

Hi,

I dont have sysprotectionpage as homepage anymore so thats a relief. Hope all the other spyware has gone too. attaching rapport and HJT logs.


Thanks a lot!

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html


Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www1.ap.dell.com/content/default.aspx?c=nz&l=en&s=gen

O20 - Winlogon Notify: winbjt32 - C:\WINDOWS\SYSTEM32\winbjt32.dll

O21 - SSODL: furnariidae - {89e4aaba-3b21-49b3-b922-8ca35193c68e} - C:\WINDOWS\system32\zlara.dll (file missing)

Click on the fix checked button.

Close HJT.

Run HJT again, but this time click on the config button, followed by the misc tools button. Click on the delete file on reboot button and browse to C:\WINDOWS\SYSTEM32\winbjt32.dll. Click on the winbjt32.dll file and click open. You wil be prompted to restart your computer, click yes.

Once your computer has rebooted, turn system restore back on and post a fresh HJT log.

Regards Howard

Followed Instructions...here you go

Excellent.

Have HJT fix this entry.

O20 - Winlogon Notify: winbjt32 - winbjt32.dll (file missing)

Click on the fix checked button and close HJT.

Once you`ve done that, your HJT log is clean.

Regards Howard

done!

Cheers! thanks a lot mate!