Hijacking
 

Somehow I have gotten a program that hijacks my home address and adds an
icon on my desktop. The icon says "sexdial" and when I click on it I go to
www.casinopalazzo.com. I have used Adaware and Spybot but still have the
same problem. Oh yes, the thing automatically pops up every 20 minutes or so
and opens a new browser window to the casinopalazzo. I have found the
address, but I don't know how to delete it. The address is "C:\Program
files\Internet Explorer\Iexplore.exe"http://www.casinopalazzo.com. I have
Windows 98 SE. Any help will be greatly appreciated.

Bob

Re: Hijacking
 

Bob Brister wrote:
> Somehow I have gotten a program that hijacks my home address and adds
> an icon on my desktop. The icon says "sexdial" and when I click on it
> I go to www.casinopalazzo.com. I have used Adaware and Spybot but
> still have the same problem. Oh yes, the thing automatically pops up
> every 20 minutes or so and opens a new browser window to the
> casinopalazzo. I have found the address, but I don't know how to
> delete it. The address is "C:\Program files\Internet
> Explorer\Iexplore.exe"http://www.casinopalazzo.com. I have Windows 98
> SE. Any help will be greatly appreciated.
>
> Bob

Are you running adwatch? That should prevent browser hijacks. Go to
settings, and make sure 'block hijack attemmpts' is checked.

Re: Hijacking
 

Bob Brister wrote:

> Somehow I have gotten a program that hijacks my home address and adds an
> icon on my desktop. The icon says "sexdial" and when I click on it I go
> to
> www.casinopalazzo.com. I have used Adaware and Spybot but still have the
> same problem. Oh yes, the thing automatically pops up every 20 minutes or
> so and opens a new browser window to the casinopalazzo. I have found the
> address, but I don't know how to delete it. The address is "C:\Program
> files\Internet Explorer\Iexplore.exe"http://www.casinopalazzo.com. I have
> Windows 98 SE. Any help will be greatly appreciated.

> Bob

1) run msconfig and in the startup tab, uncheck the box for "sexdial" or the
casino site or both.
2) check the "ini" files for any entry and delete them.
3) run regedit and search the registry for both items and delete all entries
found.
4) in the start button check the "startup" item and make sure nothing is
referred to here. Delete if it is.
5) In IE, go to internet options advanced tab. Uncheck "Enable install on
demand".

If you are on dialup, be sure to check your phone bill for any item that you
know you did not create.
"sexdial" is an autodialer and will call a specified number, probably a 900
number, or overseas number, and you will unwittingly pay the bill.

Spyware programs may not catch autodialers. As these change names as often
as they are distributed.

Re: Hijacking
 

In article <c8os7d02del@news1.newsguy.com>, Richard <Anonymous@127.001>
writes
> Bob Brister wrote:
>
> > Somehow I have gotten a program that hijacks my home address and adds an
> > icon on my desktop. The icon says "sexdial" and when I click on it I go
> > to
> > www.casinopalazzo.com. I have used Adaware and Spybot but still have the
> > same problem. Oh yes, the thing automatically pops up every 20 minutes or
> > so and opens a new browser window to the casinopalazzo. I have found the
> > address, but I don't know how to delete it. The address is "C:\Program
> > files\Internet Explorer\Iexplore.exe"http://www.casinopalazzo.com. I have
> > Windows 98 SE. Any help will be greatly appreciated.
>
> > Bob
>
>1) run msconfig and in the startup tab, uncheck the box for "sexdial" or the
>casino site or both.
>2) check the "ini" files for any entry and delete them.
>3) run regedit and search the registry for both items and delete all entries
>found.
>4) in the start button check the "startup" item and make sure nothing is
>referred to here. Delete if it is.
>5) In IE, go to internet options advanced tab. Uncheck "Enable install on
>demand".
>
>If you are on dialup, be sure to check your phone bill for any item that you
>know you did not create.
>"sexdial" is an autodialer and will call a specified number, probably a 900
>number, or overseas number, and you will unwittingly pay the bill.
>
>Spyware programs may not catch autodialers. As these change names as often
>as they are distributed.
>
>
If they are in your country prepare a bill / invoice for damages and
send it to them, take them to court if they don't pay
--
Zaax
http://www.ukgatsos.com

Re: Hijacking
 

zaax wrote:


> If they are in your country prepare a bill / invoice for damages and
> send it to them, take them to court if they don't pay

yeah, right. USA courts would not accept that as a legitimate case.

Re: Hijacking
 

I have done everything Richard said, but the problem is still there. The
home page it goes to is www.easy-search.biz. When I try to delete or modify
the registry to get rid of this address, it comes right back. I deleted
every reference to easy-search but when I reran regedit and searched for it,
there it was! I can find no reference to casino, sexdial or easy-search in
the startup. I could remove IE6 and reinstall if that would help. Oh yes, I
tried SpyBouncer, and it didn't find the problem either.

Bob

Re: Hijacking
 

"Bob Brister" <brist1942@highstream.net> wrote:

> I have done everything Richard said, but the problem is still
> there. The home page it goes to is www.easy-search.biz. When I try
> to delete or modify the registry to get rid of this address, it
> comes right back. I deleted every reference to easy-search but
> when I reran regedit and searched for it, there it was! I can find
> no reference to casino, sexdial or easy-search in the startup. I
> could remove IE6 and reinstall if that would help. Oh yes, I tried
> SpyBouncer, and it didn't find the problem either.
>
> Bob

Hi

Download and install HijackThis
http://tomcoyote.com/hjt/

Then post your log over here:
HijackThis forum/HijackThis Logs
http://www.lavasoftsupport.com/index.php?act=idx

Also could you please include some of the message you are responding
to,
in your reply?
(Tools> Options> Send tab, tick the "Include message in Reply" box.)


Thanks. :)

Re: Hijacking
 

In article <c8qdut01ci3@news1.newsguy.com>, Richard <Anonymous@127.001>
writes
> zaax wrote:
>
>
> > If they are in your country prepare a bill / invoice for damages and
> > send it to them, take them to court if they don't pay
>
>yeah, right. USA courts would not accept that as a legitimate case.
>
>
So if someone smashed you car you could not sue them for damages?
--
Zaax
http://www.ukgatsos.com

Re: Hijacking
 

Then you're either a fool, or very naive about usenet.
Never, repeat never, take any notice of "advice" given
by Richard (RtS) Bullis.


On Sun, 23 May 2004 10:18:52 -0500, in
<10b1gb0b6nk0m4c@corp.supernews.com>
Bob Brister scrawled:

>I have done everything Richard said,

<snip>

--
Basic computer maintenance
http://uk.geocities.com/personel44/maintenance.html

Re: Hijacking
 

First of all, try CWShredder:

CWShredder (CoolWebSearch remover)
http://www.spywareinfo.com/~merijn/cwschronicles.html
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

If that doesn't help, install HijackThis and post the contents
of your log here.

HijackThis
http://www.tomcoyote.org/hjt/
http://mjc1.com/mirror/hjt/
http://www.spywareinfo.com/~merijn/files/hijackthis.zip


On Sun, 23 May 2004 10:18:52 -0500, in
<10b1gb0b6nk0m4c@corp.supernews.com>
Bob Brister scrawled:

>I have done everything Richard said, but the problem is still there. The
>home page it goes to is www.easy-search.biz. When I try to delete or modify
>the registry to get rid of this address, it comes right back. I deleted
>every reference to easy-search but when I reran regedit and searched for it,
>there it was! I can find no reference to casino, sexdial or easy-search in
>the startup. I could remove IE6 and reinstall if that would help. Oh yes, I
>tried SpyBouncer, and it didn't find the problem either.
>
>Bob
>

--
Basic computer maintenance
http://uk.geocities.com/personel44/maintenance.html