[TonyKlein]

Check and have Hijack This fix the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina=file:///C:/Program%20Files/MS-Connect/Portal/portal.html

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [system32] config32.exe
O4 - HKLM\..\Run: [WebScan] C:\PROGRAM FILES\ACCELERATION SOFTWARE\ANTI-VIRUS\DEFSCANGUI.EXE -k
O4 - HKLM\..\Run: [MS-Connect] C:\WINDOWS\SYSTEM\WEB.EXE
O4 - HKCU\..\Run: [tm] wndcmd32.exe

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) -
O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx

After rebooting, delete config32.exe and web.exe as explained before, and also do a Find Files for, and delete the wndcmd32.exe file.

Cheers,

[TonyKlein]

BTW, you need to install a decent antivirus!

Cheers,

[mrfergy52]

i did all you suggested but,

hijack did not find or fix
04-HKLM\..\Run:[system32]config32.exe

when i searched files :
config32.exe - did not find
web.exe - found but would not let me delete, said "was being used by windows"
wndcdm32.exe - did not find

when i start up, i am still getting the "?" icon in system tray(bottom right corner of my screen) and when pointer rolls over it, the popup says "show start page" "disconnect"(which i did, and it does cancel my connection to isp) "update" "exit"
i am afraid to pick any of what might happen(re-infect or something)

i just bought/installed norton a/v 2003

[IMM]

Regarding the ones you didn't find. Set your computer up so that you can see hidden files. In windows explorer (notIE) use Tools > Folder Options - under the View tab check "view all files" under 'Hidden Files' and uncheck the box next to 'Hide File Extensions for known File types' then click the "Like Current Folder" button.

Regarding the one you couldn't delete because it was in use - reboot to SAFE mode and delete it then or put a check beside
O4 - HKLM\..\Run: [MS-Connect] C:\WINDOWS\SYSTEM\WEB.EXE
in Hijack This and choose to Fix the item - then reboot.

[Gordon7000]

Hi mrfergy52,

I notice from your HT log that you're running GoBack. If you didn't disable it while you were working on these problems, don't use any of GoBack's Restore Points as these will contain copies of your old, deleted, malware. After a few days, delete any and all of GoBack's Restore Points which were produced before or on the date of your successful repair. (Keep only those dated after the successful fixes.) When you've deleted the old Restore Points, reboot your PC and create a new manual Restore Point. After this, you can set GoBack to record Restore Points automatically again.

Regards, Gordon

[mrfergy52]

I will start this posting with:

1) A Thank you
2) An Apology

I want to express a very heartfelt THANK YOU!!!!!!!!!!
To these members: TonyKlein, IMM, and Gordon7000 for all of their help/advice/suggestions with my former problem of an
unwanted "porn page/portal" appearing on my system.

I want to apologize to the same 3 members, for the length of
time between my postings!!!! I have ALS, sometimes, no matter
what my head/heart/body have scheduled, the disease over
rides, and sets a schedule of it's own. This is the first I've been
able to get to the computer, but, I'm back on my wheels and ready to go!

My e-mail address is mrfergy@kconline.com and I will certainly
reply to any message! If you look at my avatar, I am like it, big, dumb, and spaced! I have only learned (very little, I might add)
about the internet/email/forums etc., etc. since my retirement, and have really enjoyed the whole expirience tremendosly!
Any suggestions welcome as far as, is there any software available to "block" porn? I have Norton AntiVirus 2003, I thought that was the best available.

Again, THANK YOU!
mrfergy@kconline.com

[gwsdll]

Very Simple Fix.

Just visit http://www.globalwebsearch.com/faq.html and download uninstall.zip and bottom of page.

That's it!