* I did find spoolsrv32.exe. Deleted as instructed.

I discovered that a file called systr.dll had been added to my c:\windows\system32 directory. Evidently this is the bad boy. I had to go into...

* Once again I dod not find these probhlems. The only entry in the registry that I found among your list was "SystemTray"="SysTray.Exe".

Thanks, though.

*I following all of these instructions. However, none of this applied. The machine currently runs executables and none of those improper registry entries were there.

I'll move on to the next one....

OK, done. Here's the new log:



Logfile of HijackThis v1.99.1
Scan saved at 6:55:25 PM, on 3/3/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)...

I upgraded to version 1.99.1. The log from that is below. Still seeing "hotoffers" URL after fixing. Still being hijacked. A search of my registry shows "http://www.hotoffers.ionfo/024/" as the IE...

thank you --> note

I have a machine that has been invaded by the same "Hotoffers.com" hijack that has been a problem for a couple of other members. Their problems were resolved by Crunchie (thread 16204) and CaperJack...