trojan called COLLECTED.AE hijacking to revOlt.net

Thanks so much for the help I have performed the steps of Read this first a few times but still have this trojan called COLLECTED.AE which is hijacking the start page to revOlt.net. It also continues to write the file "Installer.exe" into c:\documents and settings\local\temp

appreciate any assistance

 

Reboot the machine in safe mode and run this (FREE registration required)

http://www.majorgeeks.com/download.php?det=4281
a-squared (a²) Free edition 1.1

then follow this
http://forums.majorgeeks.com/showthread.php?t=38752
MajorGeeks Support Forums - Hijack This Tutorial And How To Post Your Log File

Do not put HJT in a temp folder, on the desktop , in any folder under documents and settings or run it from an archive. Put it in its' own folder (C:\HJT\) and run it from there.

 

Thanks for the help,

a2 found and removed the following;

c:\program files\Winad client\WinClt.exe
c:\windows\downloaded program files\WinadX.dll

still have COLLECTED.AE problem, Hijackthis log file attached.

Thanks, D

 

Problem solved! Was able to determine that after using hijackthis to fix/delete this suspicious looking entry,

04- HKLM \..\Run: [REEGRUN] C:\index.exe

for right now no longer have trojan COLLECTED.AE

Thanks to the information and support on Major Geeks.Com website!!

Thank God for you guys!

 

well dave from baldwinsville.., I , Jim from clay, say Congrats to a clean machine! stay safe on 481

 

Hey guys,

Not a big deal, but don't forget to delete C:\index.exe

and have HJT fix O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?

If you haven't done so already!

PP