mczplwp
01-21-2005, 07:49 PM
I had a box in today with the dreaded badstreeturl.com junk on it. This piece of crap will change your time server and give you pop-ups . It uses a dropper to reinstall itself after you get rid of it's 2 loaded files. The mothership appears to be a file called lu.dll in the windows folder. I used spybot to get rid of it and it came back. I watched it reload itself in Hijack This! Safemode then Spybot. Open the listed programs in Spybot and drill down with windows explorer to the files listed. Manually delete them then tell Spybot to do it's thang! Follow with AdAware. It found 7 registry entries left behind. Bam!
Oh yeah you need to reset the time server. Control panel, date&time, internet time. Press the carrot to reveal all available time server's. The microsoft server is safe. XP gets real cranky if the time stamp is off. Window's Update won't work for starter's.
I had this before several month's ago on a ME box.
It took awhile to beat because I couldn't find any info on it. Has anyone else seen this one?
mczplwp
Oh yeah you need to reset the time server. Control panel, date&time, internet time. Press the carrot to reveal all available time server's. The microsoft server is safe. XP gets real cranky if the time stamp is off. Window's Update won't work for starter's.
I had this before several month's ago on a ME box.
It took awhile to beat because I couldn't find any info on it. Has anyone else seen this one?
mczplwp