o/t browser highjacked

[Brendan P]

My default msn home-page keeps getting highjacked by another site.

I have ad-aware and spy-bot (search and destroy) in my computer but with no sucessfull results.

 

I think it is in the registry,and all day long i am paitently waiting for our IT guy to get off his lazy A$$ and fix this!

 

Any suggestions are welcomed.

I can't wait for him no-more.

 

HELPPPPPPP

[bryan314]

http://www.mozilla.org/

http://www.mozilla.org/releases/

 

Bryan

[d00d]

What is the ad-ware called Bucket?

[mayday]

I had a program once,think it was called reg clean or somthing like that. made it real easy to clean out the registry with out screwing things up. I have had the same thing happen a couple of times

[Brendan P]

quote:

---

What is the ad-ware called Bucket?

---

it is ad-aware 6.0 by lava soft

 

This usually does the trick but not this time

[Bullines]

I'm with Bryan in the Mozilla camp; go for either this or that.

 

I've seen some spyware on the inlaw's computer that was undetected by both Ad-Aware and Spybot S&D. I tracked down the "funny" process and booted into Safe Mode where I blew away the files and startup Registry entries (not being in Safe Mode caused the files to return). I installed Mozilla on the computer, firmly said "use this from now on" and deleted all shortcuts to IE. They've been spyware-free ever since

[bryan314]

Did you do a virus scan?

 

Spybot recently went to 1.3. If you're running 1.2 try upgradding to 1.3 and rerun.

 

Other than that shoot the IT guy.

 

Bryan

[gcode]

Look in Add-Remove Programs for stuff you don't

recognise. Stuff like "Search Help" "Shopping Helper", "Memory Booster", "Atomic Clock".

Some of the free PopUp blocking toolbars available

for download nowdays bring a lot of friends along for the ride.

Some of them are very difficult to get rid of.

Google "Hijack This!". Its a little download that may help.

[JAMMAN]

Hey you have to update ad-aware just live the virus protection- new "ads" come out often.

 

Mozilla rocks and I now use filezilla also, it kills ws_ftp.

[Bullines]

quote:

---

...I now use filezilla also, it kills ws_ftp

---

 

And here's an interesting article discussing the reasons why people should give up on Internet Explorer. It was even written by a guy with an MCSE (whatever those are worth ).

[Brendan P]

yes i did a virus scan

no problems.

i am running V1.3 spy bot

it keeps coming up with (5) things in the registry but when i go to clean them out,(in the spy bot prog)they keep coming back and my home page is hijacked.

 

I did do an update on ad-aware too...

This sux

 

it guy needs a beating.

[Bullines]

quote:

---

t keeps coming up with (5) things in the registry but when i go to clean them out,(in the spy bot prog)they keep coming back and my home page is hijacked.

---

Make a note of the files or names of the spyware that Spybot mentions. Then boot into Safe Mode and get rid of all traces of it in the Registry and on your hard drive. Maybe to be safe, post what Spybot finds so we can see it, first.

[Brendan P]

Thanks for all the help.

You guys are awesome.

Bullines,I will have to wait on lazy IT guy.

I am not one to be screwing around in the registry,he'll kill me if I screw anything up!

[gcode]

quote:

---

Then boot into Safe Mode

---

What is the procedure for doing this in XP Home

and XP Pro. I was working on my daughter's

severly hijacked computer last week, and the Safe Mode option wasn't availble when I hit F8 during bootup

[Brendan P]

heres what i get in the spy bot program.

 

As i said,when I go to get rid of it,it still comes back....

[Wally]

To restore the registry:

 

1) click the start button and then click "shut down"

2)click restart the computer in "ms-dos mode" and click "yes"

3)change to your windows directory. example:if your windows directory is C:Windows, you would type the following "cd c:windows"

4)type the following commands, press "enter" after one. (note that System.da0 and User.da0 contain the number zero)

 

attrib -h -r -s system.dat

 

attrib -h -r -s system.da0

 

copy system.da0 system.dat

 

attrib -h -r -s user.dat

 

attrib -h -r -s user.da0

 

5) restart your machine.

 

this procedure will restore your registry to its state when you last successfully start your computer.

 

Hope this helps.

[Bullines]

quote:

---

What is the procedure for doing this in XP Home

and XP Pro.

---

Hit the F8 key before the black Windows XP splash screen appears. The choose "Safe Mode" from the resulting menu; definitely NOT "Safe Mode with Networking" when you're troubleshooting spyware.

[Bullines]

Brendan, DSO isn't actually spyware. Spybot is just letting you know of a (surprise surprise) vulnerability in your installation of Internet Explorer. You can either roll up your sleeves and change a few Registry values or download this (since you mentioned that you'd prefer to avoid strolling through the Registry) and run it (with administrative privilages, of course). Isn't having a web browser closely integrated with the operating system a wonderful idea? I wonder how long Microsoft will take to issue a patch for this

 

Then get all the updates available on Windows Update. Then install Firefox or Mozilla. If you don't use an Exchange or Notes server, use either Mozilla Messenger or Mozilla Thunderbird for email. After all of this, you'll see your IT guy a lot less

[Wally]

Bucket Head - the Hkey lines are in your registery. If you don`t know how to get there - do a search on your machine for "regedit" Once you get there find the directorys as you posted them, the first line you posted ends with "1140=W=3" Delete it, the "1140=W=3" and so on for the rest of the lines. Then reboot.

[Brendan P]

ok first of all,

Thank you all for your help.

I did get it to work.

When you click on "registry change" in the spybot prog.

It takes you to the infected spot in the registry.

I then "deleted" these,re-booted computer.

 

Now my home page is MSN.

Also got rid of the annoying pop-up that kept coming up everytime I opened up IE.

 

Wally I am running xp pro,not sure about the dos thing....

 

bullines,I will look into your suggestions thanks to all

Have a great fathers day weekend.

 

 

I need to go boating badddd

[Bullines]

quote:

---

When you click on "registry change" in the spybot prog.

It takes you to the infected spot in the registry.

I then "deleted" these,re-booted computer.

---

That'll do it, too See, the Registry isn't all that scary of a place

[Brendan P]

quote:

---

That'll do it, too See, the Registry isn't all that scary of a place

---

Maybe for you...

I had my fingers crossed the whole time!!!!

IT guy still needs a serious beating......

 

BTW bullines,

What is this DSO link?

What does it do/not do?

[Rekd™]

Brendon, dump IE and go Mozilla. You won't have to worry about this any more..

 

Great link Bullines, Why to dump IE.

[Bullines]

quote:

---

Great link Bullines, Why to dump IE.

---

Sums it all up, doesn't it?

 

quote:

---

BTW bullines,

What is this DSO link?

What does it do/not do?

---

It's just a small app that removes the nefarious Registry entries related to the DSO exploit for you.

 

One more anti-IE rant and then I'm done (for now)...

 

Microsoft, fix the 1 pixel dotted line CSS bug. Argh. I needed to create two separate stylesheets to work around that stupid bug; one for just IE browsers (except IE for MacOS) that uglifies it and then another for every other web browser that renders it correctly Ok, I'm done

[Brendan P]

quote:

---

Brendon, dump IE and go Mozilla. You won't have to worry about this any more..

---

Does this have any effect us being on a network server in our company?

 

I don't really know much about mozilla