Hijacked (WME)

[fishphone]

A relatives computer has been hijacked by a trojan but I don't know which one. His homepage keeps resetting to www.findeverything.com or something similar and unsavoury files keep appearing within the IE favourites folder and on desktop despite being deleted after each startup. Fully updated Norton AV found nothing. Spyware Doctor finds the infections on each scan and deletes them but they again return at next system start. Help please. Am I correct in assuming a full reformat and clean install of Windows will sort this out if no easier way available?

[monkey_1]

Download, install, update and run both Spybot S&D and Adaware...

<font color=orange>Mono</font color=orange>

[josefz]

1. Be sure your anti-virus SW is last updated version (virus database may be freshed daily).

2. Download, install and run both Anti-Spyware:

2.a Spybot - Search & Destroy 1.3 (+ upgrade to 1.3 TX available).

2.b Lavasoft Ad-Aware

Let backup the registry, scan and fix all in red, then restart computer and scan again in both one; maybe it's good idea scanning and fixing in Safe mode.

3. If you haven't already, <a target="_blank" href=http://tomcoyote.com/hjt/>download HijackThis</a>, run it, do a scan, save the log.
Don't fix any without knowing why. After you have the log, you can analyze it Booter's explication (http://www.hijackthis.de/>here</a>.).