anyone get hit with thesten.com BS
 

Got this spyware hack from thesten.com. Nasty shit! Can't get rid of it. deleted from registry, all files with the name, checked my startup programs etc.

WTF - is this a rebuild?

Who's spreading it?

Whois gives the usual noname....

no

What's it doing? Going to thesten.com? If it is, you just remove your hosts file! :Graucho

jDoG

I have found that it is in DNSerr.dll in winnt, iedll.exe in windows media player, loader.exe in windows media player, and wmplayer.exe. When ever any of these executes it infects the registry again.
I used windows explorer to search for any file containing thesten and dnserr. It takes a long time but at least it ids the files.

Also, these things infect the hosts file in winnt and the hosts file in system32/drivers/etc with bad ip addresses. You need to delete the bad addresses or it will redirect IE and here you go again.

Nope, never heard of it.
WG