my friends msn keeps sending people links while she's talking to them. it linkso joyiex.com and other sub directoies of that site. it also hijacked her IE browser. she's on xp service pack 2. she said she clicked on an email, but she could be full of it, who knows.

can anyone help? i tried MSantiapywar and adaware, and hijack this but nothing worked. it was back upon restarting

this one seems tricky. any help is appreciated.

Hya robstradamus , welcome to PCHF.

Can you first scan her pc with Ewido and then post a hijackthis log? (please upload it as a txt file)


Please download ewido Security Suite [*]Install ewido security suite [*]When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu." [*]Launch ewido, there should be a big "E" icon on your desktop, double-click it. [*]The program will prompt you to update click the "OK" button [*]The program will now go to the main screen

You will need to update ewido to the latest definition files.
[*]On the left hand side of the main screen click update [*]Click on Start

The update will start and a progress bar will show the updates being installed.? After the updates are installed, exit ewido.

Once the updates are installed do the following:
[*]If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.
[*]Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Then, run ewido.
[*]Close all open windows/programs/folders.? Have nothing else open while ewido performs its scan!
[*]Click on scanner [*]Click on Settings[*]Under "How to scan" all boxes should be selected [*]Under "Possibly unwanted software" all boxes should be selected [*]Under "What to scan" select scan every file [*]Click OK[*]Click on Complete system scan [*]Let the program scan the machine
[*]If ewido finds anything, it will pop up a notification.? NOTE:? We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one.? If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, AOL, pcAnywhere and the game "Risk" have been flagged.? In particular, watch for alerts that have the word "Heuristic" in them - if you recognize the file name as "friendly," these may actually be false positives) select "none" as the action.? DO NOT check "Perform action with all infections."? If you are unsure of an entry, select "none" for the time being.? I'll see that in the log you will post later and let you know if ewido needs to be run again.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report.
[*]Click Save report [*]Save the report to your desktop [*]Exit ewido


Please post the ewido log with the HJT log.