Spyware Or Trojan???

[canman 0]

When I boot my win2k system and opened I/E the only favorite I had was "LINKS". I looked in all folders and found the Favorite folder in my C:\Winnt folder. I went into the regisrty and found in Users/Software/microsoft/windows/current version/explorer/ shell folders that the favorites has changed to :\winnt\Favorites. When I typed in the correct path it will recreate itself every time I open I/E. I have tried Hijack, Spybot,Ad-Aware, Spy Doctor, and Spy Sweeper. Nothing helps. I did get it to stop redirecting the favorites one time but now in the C"\ root I get a %USERPROFILE%\ self generated folder on bootup and it has the same results. The only favorite in I/E is Links. All my favorites are in Documents and settings. I am really lost on this one send help please.

 

 

[adamvjackson 0]

Sounds like a corrupt user profile more than anything else.

[canman 0]

How can I tell if my profile is corrupt? I only use one profile but it might be worth a shot to logon as another user.

 

Thanks

[adamvjackson 0]

I'm not sure if there is a definative way to check for profile corruption, you could try logging in as another user, and check for similar activity.

[canman 0]

Thanks, Still have the problem but I will now keep an update user profile.

 

[canman 0]

Thanks, I make a ghost image every two weeks but this time I didn't have any reason to open I/E so I copied over a known good image with a unknown bad one. Oh well this is one to put in th ecookie jar for future use. I will NEVER delete a known image with a new one until everything is working. But I did better on a recovery then it sounds like you did. Luckly I had an 8-04 image that all I had to do was install everything from then to today. I am still interested if anyone has ever figured this I/E hijack thing.