Hi PCHF,
looking at a friends comp today, mainly for an internet connection fault, I came across the following: protect stand which I am led to believe is a variant of trojan/s, its hijacking the browser and taking it to its home page.

Thankfully she did not click on any continues etc.

The comp has five users, each with their own log on, I have only found this to be happening on one particular user, the rest seem fine.

I have had a look on the net and found sites with instructions to remove it, but, my faith lies with u guys .
Unfortunately access to the comp is limited at present, so response back may be slow.

Whilst going through the procedure of removing it, would I need to log onto the specific user where the problem lies.

Thankyou

Cart

I'd suggest logging on as Administrator to do what is necessary.
If it's XP Pro, press CTRL+ALT+DELETE twice when it's asking which user
if it's XP Home, you'll need to go into safe mode.

Other than that...follow the prework link in my signiture for the security team to look at
Chances are, if there's 1 infection...there's 20

Thanks GaRHaR,
I will do prework and post accordingly.

I to fear there are more,sorry mate.

The post will be probably be couple days apart, unless she surrenders her comp to me, no need to hurry with responses as if the good lady sees me with one more comp cluttering the lounge up, well.Lucky she is an understanding person lol.

Thanks
Cart

No problems

If it helps, mention to her that she risks infecting her friends computers via email if it goes on much longer

it's worked for a few people here in Perth a few times especially at work.

Hi guys,
quick question before I actually start prework for this protectstand.

There no prob doing the safe mode scans etc, but as this comp has four users, when I do HJT would I do it on the user that shows the problem.

Thankyou

Cart

Yea, best to do it under the one that has the problem.

The way i understand how HJT works, is it ignores everything...clean, bad, users...
But I could be wrong

Garhar do you have to login as and administrator to access all of the folders?