Java hijack? Search engines re-directed?

[slomotion]

Originally Posted by Trekka

Oh, and - probably related - none of the system restore dates from before the beginning of the infection will restore. They are indicated as existing, but after clicking on them and then "restore" nothing happens. I tried that early on and in the last day.

Try doing this from the command prompt in safe mode:

How to start the System Restore tool by using the safe mode option with the Command prompt in Windows XP

[AnchorageGuy]

Biggest problem with System Restore in Windows is that most of the time it does not work.

[SeaKing]

I used the last know good option from the F8 menu and got lucky I guess. Didn't have to try system restore.

I had dumped all cookies and temp internet files as well as removing Firefox before the use of "last known good". There was nothing in the host file to cause the redirect.

[FrankZ]

Originally Posted by SeaKing

I used the last know good option from the F8 menu and got lucky I guess. Didn't have to try system restore.

I had dumped all cookies and temp internet files as well as removing Firefox before the use of "last known good". There was nothing in the host file to cause the redirect.

You will also want to check your DNS server setup. Some trojans add an entry so you resolve through them.

[CharlieCobra]

I had one that actively changed the registry until it locked me out. I went back in with my backdoor Admin acct and nuked it with AVG. It was very nasty and learned/adapted on the fly.