Crazy stuff on my PC!! ?

Discussion in 'Computer Support' started by mickey, Sep 15, 2004.

  1. mickey

    mickey Guest

    I have been experiencing a lot of recent problems, the worst of which
    happened today when my Google homepage changed to a porn search page! I
    clearly have an infection of some sort but I just can't get my system
    cleaned no matter what Spy Search or Ad-ware I run. I can't understand the
    Hijack This log and I certainly don#t want my children exposed to porn. I
    suspect that they are responsible however because they use WinMX to download
    music etc and as I don't visit porn sites, I haven't any other explanation
    for my recent probs! I don't even know if this message will upload because
    when I try to post stuff on other groups, I get an error message telling me
    that a problem was encountered! A bit of a mess all round then. Can anyone
    help me please?
    mickey, Sep 15, 2004
    #1
    1. Advertising

  2. mickey

    Brian Guest

    "mickey" <> schrieb im Newsbeitrag
    news:ci95vp$k8e$...
    > I have been experiencing a lot of recent problems, the worst of which
    > happened today when my Google homepage changed to a porn search page! I
    > clearly have an infection of some sort but I just can't get my system
    > cleaned no matter what Spy Search or Ad-ware I run. I can't understand the
    > Hijack This log and I certainly don#t want my children exposed to porn. I
    > suspect that they are responsible however because they use WinMX to

    download
    > music etc and as I don't visit porn sites, I haven't any other explanation
    > for my recent probs! I don't even know if this message will upload because
    > when I try to post stuff on other groups, I get an error message telling

    me
    > that a problem was encountered! A bit of a mess all round then. Can anyone
    > help me please?
    >
    >
    >

    visit this link:
    http://hijackthis.de/index.php?langselect=english
    copy and paste the hijack this log into the text field on that page and
    click "analyze" that should find any nasteis on your system. in the app
    itself: look for the baddies (which are marked on thatpage displayed after
    analysing), tick them and have hijack this fix them.
    Brian, Sep 15, 2004
    #2
    1. Advertising

  3. mickey

    Linda Guest

    "Brian" <> wrote in message
    news:...
    >
    > "mickey" <> schrieb im Newsbeitrag
    > news:ci95vp$k8e$...
    >> I have been experiencing a lot of recent problems, the worst of which
    >> happened today when my Google homepage changed to a porn search page! I
    >> clearly have an infection of some sort but I just can't get my system
    >> cleaned no matter what Spy Search or Ad-ware I run. I can't understand
    >> the
    >> Hijack This log and I certainly don#t want my children exposed to porn.
    >> I
    >> suspect that they are responsible however because they use WinMX to

    > download
    >> music etc and as I don't visit porn sites, I haven't any other
    >> explanation
    >> for my recent probs! I don't even know if this message will upload
    >> because
    >> when I try to post stuff on other groups, I get an error message telling

    > me
    >> that a problem was encountered! A bit of a mess all round then. Can
    >> anyone
    >> help me please?
    >>
    >>
    >>

    > visit this link:
    > http://hijackthis.de/index.php?langselect=english
    > copy and paste the hijack this log into the text field on that page and
    > click "analyze" that should find any nasteis on your system. in the app
    > itself: look for the baddies (which are marked on thatpage displayed after
    > analysing), tick them and have hijack this fix them.
    >


    As a quick brute force solution, in WinXP enable control panel/internet
    properties/content/content advisor (approved sites) tab. I can't remember if
    it's available in previous Win versions.
    Linda, Sep 15, 2004
    #3
  4. mickey

    mickey Guest

    "Brian" <> wrote in message
    news:...
    >
    > "mickey" <> schrieb im Newsbeitrag
    > news:ci95vp$k8e$...
    > > I have been experiencing a lot of recent problems, the worst of which
    > > happened today when my Google homepage changed to a porn search page! I
    > > clearly have an infection of some sort but I just can't get my system
    > > cleaned no matter what Spy Search or Ad-ware I run. I can't understand

    the
    > > Hijack This log and I certainly don#t want my children exposed to porn.

    I
    > > suspect that they are responsible however because they use WinMX to

    > download
    > > music etc and as I don't visit porn sites, I haven't any other

    explanation
    > > for my recent probs! I don't even know if this message will upload

    because
    > > when I try to post stuff on other groups, I get an error message telling

    > me
    > > that a problem was encountered! A bit of a mess all round then. Can

    anyone
    > > help me please?
    > >
    > >
    > >

    > visit this link:
    > http://hijackthis.de/index.php?langselect=english
    > copy and paste the hijack this log into the text field on that page and
    > click "analyze" that should find any nasteis on your system. in the app
    > itself: look for the baddies (which are marked on thatpage displayed after
    > analysing), tick them and have hijack this fix them.


    Hi Brian. I did what you suggested and analysed the logfile. I then "fixed"
    everything I was advised to but the problem has now got worse! My home page
    just can't be changed back to Google permanently. When I use my Internet
    Options to do so and then open IE, the Porn searchpage comes back up. And to
    make matters worse, I had to go out for a few minutes there and my 11 year
    old son (who is off school with a bug) had opened it up and this filth was
    sitting on my desktop! I am in a real quandary here and need help urgently!
    Anybody.......please!
    Oh, and another slighter prob, I downloaded the most recent version of
    Hijack this on Sunday night but this analysis tells me that I don't have the
    latest version?

    >
    >
    mickey, Sep 15, 2004
    #4
  5. mickey

    Linda Guest

    "Linda" <.@.> wrote in message news:...
    > "Brian" <> wrote in message
    > news:...
    >>
    >> "mickey" <> schrieb im Newsbeitrag
    >> news:ci95vp$k8e$...
    >>> I have been experiencing a lot of recent problems, the worst of which
    >>> happened today when my Google homepage changed to a porn search page! I
    >>> clearly have an infection of some sort but I just can't get my system
    >>> cleaned no matter what Spy Search or Ad-ware I run. I can't understand
    >>> the
    >>> Hijack This log and I certainly don#t want my children exposed to porn.
    >>> I
    >>> suspect that they are responsible however because they use WinMX to

    >> download
    >>> music etc and as I don't visit porn sites, I haven't any other
    >>> explanation
    >>> for my recent probs! I don't even know if this message will upload
    >>> because
    >>> when I try to post stuff on other groups, I get an error message telling

    >> me
    >>> that a problem was encountered! A bit of a mess all round then. Can
    >>> anyone
    >>> help me please?
    >>>
    >>>
    >>>

    >> visit this link:
    >> http://hijackthis.de/index.php?langselect=english
    >> copy and paste the hijack this log into the text field on that page and
    >> click "analyze" that should find any nasteis on your system. in the app
    >> itself: look for the baddies (which are marked on thatpage displayed
    >> after
    >> analysing), tick them and have hijack this fix them.
    >>

    >
    > As a quick brute force solution, in WinXP enable control panel/internet
    > properties/content/content advisor (approved sites) tab. I can't remember
    > if it's available in previous Win versions.
    >

    Sorry. Meant for OP.
    Linda, Sep 15, 2004
    #5
  6. mickey

    Brian Guest

    "mickey" <> schrieb im Newsbeitrag
    news:ci9e92$obc$...
    > "Brian" <> wrote in message
    > news:...
    > >
    > > "mickey" <> schrieb im Newsbeitrag
    > > news:ci95vp$k8e$...
    > > > I have been experiencing a lot of recent problems, the worst of which
    > > > happened today when my Google homepage changed to a porn search page!

    I
    > > > clearly have an infection of some sort but I just can't get my system
    > > > cleaned no matter what Spy Search or Ad-ware I run. I can't understand

    > the
    > > > Hijack This log and I certainly don#t want my children exposed to

    porn.
    > I
    > > > suspect that they are responsible however because they use WinMX to

    > > download
    > > > music etc and as I don't visit porn sites, I haven't any other

    > explanation
    > > > for my recent probs! I don't even know if this message will upload

    > because
    > > > when I try to post stuff on other groups, I get an error message

    telling
    > > me
    > > > that a problem was encountered! A bit of a mess all round then. Can

    > anyone
    > > > help me please?
    > > >
    > > >
    > > >

    > > visit this link:
    > > http://hijackthis.de/index.php?langselect=english
    > > copy and paste the hijack this log into the text field on that page and
    > > click "analyze" that should find any nasteis on your system. in the app
    > > itself: look for the baddies (which are marked on thatpage displayed

    after
    > > analysing), tick them and have hijack this fix them.

    >
    > Hi Brian. I did what you suggested and analysed the logfile. I then

    "fixed"
    > everything I was advised to but the problem has now got worse! My home

    page
    > just can't be changed back to Google permanently. When I use my Internet
    > Options to do so and then open IE, the Porn searchpage comes back up. And

    to
    > make matters worse, I had to go out for a few minutes there and my 11 year
    > old son (who is off school with a bug) had opened it up and this filth was
    > sitting on my desktop! I am in a real quandary here and need help

    urgently!
    > Anybody.......please!
    > Oh, and another slighter prob, I downloaded the most recent version of
    > Hijack this on Sunday night but this analysis tells me that I don't have

    the
    > latest version?
    >
    > >
    > >

    >
    >

    do an online scan:
    http://housecall.trendmicro.com

    try the following.
    What is spyware : http://www.spychecker.com/spyware.html

    SpyBot-S&D : http://www.webattack.com/download/dlspybot.shtml

    Ad-aware : http://www.webattack.com/download/dladaware.shtml

    Trojan Remover : http://www.simplysup.com/

    HijackThis : http://www.webattack.com/download/dlhijackthis.shtml

    KL-Detector : http://www.webattack.com/download/dlkldetector.shtml

    X-Cleaner Free : http://www.webattack.com/download/dlxcleaner.shtml

    SpywareBlaster : http://www.webattack.com/download/dlspywareblaster.shtml

    SpywareGuard : http://www.webattack.com/download/dlspywareguard.shtml

    SpySites : http://www.webattack.com/download/dlspysites.shtml

    Keylogger Hunter : http://www.webattack.com/download/dlklhunter.shtml

    Spycop: http://www.spycop.com/

    BHODemon : http://www.spywareinfo.com/downloads/bhod/

    Browser Hijack Blaster : http://www.wilderssecurity.net/bhblaster.html

    Goodbye Spy : http://www.topshareware.com/GoodBye-Spy-download-2012.htm

    CWShredder :
    http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder

    Other spyware removal instructions :
    http://www.pchell.com/support/click2findnow.shtml
    Brian, Sep 15, 2004
    #6
  7. mickey

    Brian Guest

    "mickey" <> schrieb im Newsbeitrag
    news:ci9e92$obc$...
    > "Brian" <> wrote in message
    > news:...
    > >
    > > "mickey" <> schrieb im Newsbeitrag
    > > news:ci95vp$k8e$...
    > > > I have been experiencing a lot of recent problems, the worst of which
    > > > happened today when my Google homepage changed to a porn search page!

    I
    > > > clearly have an infection of some sort but I just can't get my system
    > > > cleaned no matter what Spy Search or Ad-ware I run. I can't understand

    > the
    > > > Hijack This log and I certainly don#t want my children exposed to

    porn.
    > I
    > > > suspect that they are responsible however because they use WinMX to

    > > download
    > > > music etc and as I don't visit porn sites, I haven't any other

    > explanation
    > > > for my recent probs! I don't even know if this message will upload

    > because
    > > > when I try to post stuff on other groups, I get an error message

    telling
    > > me
    > > > that a problem was encountered! A bit of a mess all round then. Can

    > anyone
    > > > help me please?
    > > >
    > > >
    > > >

    > > visit this link:
    > > http://hijackthis.de/index.php?langselect=english
    > > copy and paste the hijack this log into the text field on that page and
    > > click "analyze" that should find any nasteis on your system. in the app
    > > itself: look for the baddies (which are marked on thatpage displayed

    after
    > > analysing), tick them and have hijack this fix them.

    >
    > Hi Brian. I did what you suggested and analysed the logfile. I then

    "fixed"
    > everything I was advised to but the problem has now got worse! My home

    page
    > just can't be changed back to Google permanently. When I use my Internet
    > Options to do so and then open IE, the Porn searchpage comes back up. And

    to
    > make matters worse, I had to go out for a few minutes there and my 11 year
    > old son (who is off school with a bug) had opened it up and this filth was
    > sitting on my desktop! I am in a real quandary here and need help

    urgently!
    > Anybody.......please!
    > Oh, and another slighter prob, I downloaded the most recent version of
    > Hijack this on Sunday night but this analysis tells me that I don't have

    the
    > latest version?
    >
    > >
    > >

    >
    >


    or even:
    http://www.pestscan.com/
    google around for free online ad/malware scanners. there are quite a few
    good ones.
    Brian, Sep 15, 2004
    #7
  8. mickey

    mickey Guest

    "Brian" <> wrote in message
    news:...
    >
    > "mickey" <> schrieb im Newsbeitrag
    > news:ci9e92$obc$...
    > > "Brian" <> wrote in message
    > > news:...
    > > >
    > > > "mickey" <> schrieb im Newsbeitrag
    > > > news:ci95vp$k8e$...
    > > > > I have been experiencing a lot of recent problems, the worst of

    which
    > > > > happened today when my Google homepage changed to a porn search

    page!
    > I
    > > > > clearly have an infection of some sort but I just can't get my

    system
    > > > > cleaned no matter what Spy Search or Ad-ware I run. I can't

    understand
    > > the
    > > > > Hijack This log and I certainly don#t want my children exposed to

    > porn.
    > > I
    > > > > suspect that they are responsible however because they use WinMX to
    > > > download
    > > > > music etc and as I don't visit porn sites, I haven't any other

    > > explanation
    > > > > for my recent probs! I don't even know if this message will upload

    > > because
    > > > > when I try to post stuff on other groups, I get an error message

    > telling
    > > > me
    > > > > that a problem was encountered! A bit of a mess all round then. Can

    > > anyone
    > > > > help me please?
    > > > >
    > > > >
    > > > >
    > > > visit this link:
    > > > http://hijackthis.de/index.php?langselect=english
    > > > copy and paste the hijack this log into the text field on that page

    and
    > > > click "analyze" that should find any nasteis on your system. in the

    app
    > > > itself: look for the baddies (which are marked on thatpage displayed

    > after
    > > > analysing), tick them and have hijack this fix them.

    > >
    > > Hi Brian. I did what you suggested and analysed the logfile. I then

    > "fixed"
    > > everything I was advised to but the problem has now got worse! My home

    > page
    > > just can't be changed back to Google permanently. When I use my Internet
    > > Options to do so and then open IE, the Porn searchpage comes back up.

    And
    > to
    > > make matters worse, I had to go out for a few minutes there and my 11

    year
    > > old son (who is off school with a bug) had opened it up and this filth

    was
    > > sitting on my desktop! I am in a real quandary here and need help

    > urgently!
    > > Anybody.......please!
    > > Oh, and another slighter prob, I downloaded the most recent version of
    > > Hijack this on Sunday night but this analysis tells me that I don't have

    > the
    > > latest version?
    > >
    > > >
    > > >

    > >
    > >

    >
    > or even:
    > http://www.pestscan.com/
    > google around for free online ad/malware scanners. there are quite a few
    > good ones.


    Nothing is helping! When I run Hijack This and see the offending stuff, when
    I Fix it and do a new scan, it is still there? HELP !!!!!!!!!!!!!!!!!

    >
    >
    mickey, Sep 15, 2004
    #8
  9. mickey

    Brian Guest

    "mickey" <> schrieb im Newsbeitrag
    news:ci9k6q$chq$...
    >
    > "Brian" <> wrote in message
    > news:...
    > >
    > > "mickey" <> schrieb im Newsbeitrag
    > > news:ci9e92$obc$...
    > > > "Brian" <> wrote in message
    > > > news:...
    > > > >
    > > > > "mickey" <> schrieb im Newsbeitrag
    > > > > news:ci95vp$k8e$...
    > > > > > I have been experiencing a lot of recent problems, the worst of

    > which
    > > > > > happened today when my Google homepage changed to a porn search

    > page!
    > > I
    > > > > > clearly have an infection of some sort but I just can't get my

    > system
    > > > > > cleaned no matter what Spy Search or Ad-ware I run. I can't

    > understand
    > > > the
    > > > > > Hijack This log and I certainly don#t want my children exposed to

    > > porn.
    > > > I
    > > > > > suspect that they are responsible however because they use WinMX

    to
    > > > > download
    > > > > > music etc and as I don't visit porn sites, I haven't any other
    > > > explanation
    > > > > > for my recent probs! I don't even know if this message will upload
    > > > because
    > > > > > when I try to post stuff on other groups, I get an error message

    > > telling
    > > > > me
    > > > > > that a problem was encountered! A bit of a mess all round then.

    Can
    > > > anyone
    > > > > > help me please?
    > > > > >
    > > > > >
    > > > > >
    > > > > visit this link:
    > > > > http://hijackthis.de/index.php?langselect=english
    > > > > copy and paste the hijack this log into the text field on that page

    > and
    > > > > click "analyze" that should find any nasteis on your system. in the

    > app
    > > > > itself: look for the baddies (which are marked on thatpage displayed

    > > after
    > > > > analysing), tick them and have hijack this fix them.
    > > >
    > > > Hi Brian. I did what you suggested and analysed the logfile. I then

    > > "fixed"
    > > > everything I was advised to but the problem has now got worse! My home

    > > page
    > > > just can't be changed back to Google permanently. When I use my

    Internet
    > > > Options to do so and then open IE, the Porn searchpage comes back up.

    > And
    > > to
    > > > make matters worse, I had to go out for a few minutes there and my 11

    > year
    > > > old son (who is off school with a bug) had opened it up and this filth

    > was
    > > > sitting on my desktop! I am in a real quandary here and need help

    > > urgently!
    > > > Anybody.......please!
    > > > Oh, and another slighter prob, I downloaded the most recent version of
    > > > Hijack this on Sunday night but this analysis tells me that I don't

    have
    > > the
    > > > latest version?
    > > >
    > > > >
    > > > >
    > > >
    > > >

    > >
    > > or even:
    > > http://www.pestscan.com/
    > > google around for free online ad/malware scanners. there are quite a few
    > > good ones.

    >
    > Nothing is helping! When I run Hijack This and see the offending stuff,

    when
    > I Fix it and do a new scan, it is still there? HELP !!!!!!!!!!!!!!!!!
    >
    > >
    > >

    >
    >


    turn your system restore off before scanning and fixing. then you can turn
    it back on after removal.
    Brian, Sep 15, 2004
    #9
  10. mickey

    mickey Guest

    "Brian" <> wrote in message
    news:...
    >
    > "mickey" <> schrieb im Newsbeitrag
    > news:ci9e92$obc$...
    > > "Brian" <> wrote in message
    > > news:...
    > > >
    > > > "mickey" <> schrieb im Newsbeitrag
    > > > news:ci95vp$k8e$...
    > > > > I have been experiencing a lot of recent problems, the worst of

    which
    > > > > happened today when my Google homepage changed to a porn search

    page!
    > I
    > > > > clearly have an infection of some sort but I just can't get my

    system
    > > > > cleaned no matter what Spy Search or Ad-ware I run. I can't

    understand
    > > the
    > > > > Hijack This log and I certainly don#t want my children exposed to

    > porn.
    > > I
    > > > > suspect that they are responsible however because they use WinMX to
    > > > download
    > > > > music etc and as I don't visit porn sites, I haven't any other

    > > explanation
    > > > > for my recent probs! I don't even know if this message will upload

    > > because
    > > > > when I try to post stuff on other groups, I get an error message

    > telling
    > > > me
    > > > > that a problem was encountered! A bit of a mess all round then. Can

    > > anyone
    > > > > help me please?
    > > > >
    > > > >
    > > > >
    > > > visit this link:
    > > > http://hijackthis.de/index.php?langselect=english
    > > > copy and paste the hijack this log into the text field on that page

    and
    > > > click "analyze" that should find any nasteis on your system. in the

    app
    > > > itself: look for the baddies (which are marked on thatpage displayed

    > after
    > > > analysing), tick them and have hijack this fix them.

    > >
    > > Hi Brian. I did what you suggested and analysed the logfile. I then

    > "fixed"
    > > everything I was advised to but the problem has now got worse! My home

    > page
    > > just can't be changed back to Google permanently. When I use my Internet
    > > Options to do so and then open IE, the Porn searchpage comes back up.

    And
    > to
    > > make matters worse, I had to go out for a few minutes there and my 11

    year
    > > old son (who is off school with a bug) had opened it up and this filth

    was
    > > sitting on my desktop! I am in a real quandary here and need help

    > urgently!
    > > Anybody.......please!
    > > Oh, and another slighter prob, I downloaded the most recent version of
    > > Hijack this on Sunday night but this analysis tells me that I don't have

    > the
    > > latest version?
    > >
    > > >
    > > >

    > >
    > >

    >
    > or even:
    > http://www.pestscan.com/
    > google around for free online ad/malware scanners. there are quite a few
    > good ones.
    >


    Thanks for the help Brian. I got nothing from Trend either but I seem to
    have resolved my problem for now. I started up in safe Mode and using either
    SpyBot or Adware (can't remember which) I changed the names of the offending
    start-up pages to Google and it seems to have done the trick. Only thing is,
    I am now scared it will all happen again when I am not about. It's a great
    pity that we can't detect where this filth comes from and do something about
    it. Porn is okay for consenting adults but when young children are
    innocently exposed to it, someone should be made pay! Thanks again and also
    to anyone else who took the time to offer assistance to me.

    >
    mickey, Sep 15, 2004
    #10
  11. mickey

    mickey Guest

    "Brian" <> wrote in message
    news:...
    >
    > "mickey" <> schrieb im Newsbeitrag
    > news:ci9k6q$chq$...
    > >
    > > "Brian" <> wrote in message
    > > news:...
    > > >
    > > > "mickey" <> schrieb im Newsbeitrag
    > > > news:ci9e92$obc$...
    > > > > "Brian" <> wrote in message
    > > > > news:...
    > > > > >
    > > > > > "mickey" <> schrieb im Newsbeitrag
    > > > > > news:ci95vp$k8e$...
    > > > > > > I have been experiencing a lot of recent problems, the worst of

    > > which
    > > > > > > happened today when my Google homepage changed to a porn search

    > > page!
    > > > I
    > > > > > > clearly have an infection of some sort but I just can't get my

    > > system
    > > > > > > cleaned no matter what Spy Search or Ad-ware I run. I can't

    > > understand
    > > > > the
    > > > > > > Hijack This log and I certainly don#t want my children exposed

    to
    > > > porn.
    > > > > I
    > > > > > > suspect that they are responsible however because they use WinMX

    > to
    > > > > > download
    > > > > > > music etc and as I don't visit porn sites, I haven't any other
    > > > > explanation
    > > > > > > for my recent probs! I don't even know if this message will

    upload
    > > > > because
    > > > > > > when I try to post stuff on other groups, I get an error message
    > > > telling
    > > > > > me
    > > > > > > that a problem was encountered! A bit of a mess all round then.

    > Can
    > > > > anyone
    > > > > > > help me please?
    > > > > > >
    > > > > > >
    > > > > > >
    > > > > > visit this link:
    > > > > > http://hijackthis.de/index.php?langselect=english
    > > > > > copy and paste the hijack this log into the text field on that

    page
    > > and
    > > > > > click "analyze" that should find any nasteis on your system. in

    the
    > > app
    > > > > > itself: look for the baddies (which are marked on thatpage

    displayed
    > > > after
    > > > > > analysing), tick them and have hijack this fix them.
    > > > >
    > > > > Hi Brian. I did what you suggested and analysed the logfile. I then
    > > > "fixed"
    > > > > everything I was advised to but the problem has now got worse! My

    home
    > > > page
    > > > > just can't be changed back to Google permanently. When I use my

    > Internet
    > > > > Options to do so and then open IE, the Porn searchpage comes back

    up.
    > > And
    > > > to
    > > > > make matters worse, I had to go out for a few minutes there and my

    11
    > > year
    > > > > old son (who is off school with a bug) had opened it up and this

    filth
    > > was
    > > > > sitting on my desktop! I am in a real quandary here and need help
    > > > urgently!
    > > > > Anybody.......please!
    > > > > Oh, and another slighter prob, I downloaded the most recent version

    of
    > > > > Hijack this on Sunday night but this analysis tells me that I don't

    > have
    > > > the
    > > > > latest version?
    > > > >
    > > > > >
    > > > > >
    > > > >
    > > > >
    > > >
    > > > or even:
    > > > http://www.pestscan.com/
    > > > google around for free online ad/malware scanners. there are quite a

    few
    > > > good ones.

    > >
    > > Nothing is helping! When I run Hijack This and see the offending stuff,

    > when
    > > I Fix it and do a new scan, it is still there? HELP !!!!!!!!!!!!!!!!!
    > >
    > > >
    > > >

    > >
    > >

    >
    > turn your system restore off before scanning and fixing. then you can turn
    > it back on after removal.
    >


    I wrote that too soon! The bas***d is back again. It was fixed for less than
    five minutes! How do I turn off system restore then?

    >
    mickey, Sep 15, 2004
    #11
  12. mickey

    Brian Guest

    "mickey" <> schrieb im Newsbeitrag
    news:ci9mrq$a9a$...
    > "Brian" <> wrote in message
    > news:...
    > >
    > > "mickey" <> schrieb im Newsbeitrag
    > > news:ci9k6q$chq$...
    > > >
    > > > "Brian" <> wrote in message
    > > > news:...
    > > > >
    > > > > "mickey" <> schrieb im Newsbeitrag
    > > > > news:ci9e92$obc$...
    > > > > > "Brian" <> wrote in message
    > > > > > news:...
    > > > > > >
    > > > > > > "mickey" <> schrieb im Newsbeitrag
    > > > > > > news:ci95vp$k8e$...
    > > > > > > > I have been experiencing a lot of recent problems, the worst

    of
    > > > which
    > > > > > > > happened today when my Google homepage changed to a porn

    search
    > > > page!
    > > > > I
    > > > > > > > clearly have an infection of some sort but I just can't get my
    > > > system
    > > > > > > > cleaned no matter what Spy Search or Ad-ware I run. I can't
    > > > understand
    > > > > > the
    > > > > > > > Hijack This log and I certainly don#t want my children

    exposed
    > to
    > > > > porn.
    > > > > > I
    > > > > > > > suspect that they are responsible however because they use

    WinMX
    > > to
    > > > > > > download
    > > > > > > > music etc and as I don't visit porn sites, I haven't any other
    > > > > > explanation
    > > > > > > > for my recent probs! I don't even know if this message will

    > upload
    > > > > > because
    > > > > > > > when I try to post stuff on other groups, I get an error

    message
    > > > > telling
    > > > > > > me
    > > > > > > > that a problem was encountered! A bit of a mess all round

    then.
    > > Can
    > > > > > anyone
    > > > > > > > help me please?
    > > > > > > >
    > > > > > > >
    > > > > > > >
    > > > > > > visit this link:
    > > > > > > http://hijackthis.de/index.php?langselect=english
    > > > > > > copy and paste the hijack this log into the text field on that

    > page
    > > > and
    > > > > > > click "analyze" that should find any nasteis on your system. in

    > the
    > > > app
    > > > > > > itself: look for the baddies (which are marked on thatpage

    > displayed
    > > > > after
    > > > > > > analysing), tick them and have hijack this fix them.
    > > > > >
    > > > > > Hi Brian. I did what you suggested and analysed the logfile. I

    then
    > > > > "fixed"
    > > > > > everything I was advised to but the problem has now got worse! My

    > home
    > > > > page
    > > > > > just can't be changed back to Google permanently. When I use my

    > > Internet
    > > > > > Options to do so and then open IE, the Porn searchpage comes back

    > up.
    > > > And
    > > > > to
    > > > > > make matters worse, I had to go out for a few minutes there and my

    > 11
    > > > year
    > > > > > old son (who is off school with a bug) had opened it up and this

    > filth
    > > > was
    > > > > > sitting on my desktop! I am in a real quandary here and need help
    > > > > urgently!
    > > > > > Anybody.......please!
    > > > > > Oh, and another slighter prob, I downloaded the most recent

    version
    > of
    > > > > > Hijack this on Sunday night but this analysis tells me that I

    don't
    > > have
    > > > > the
    > > > > > latest version?
    > > > > >
    > > > > > >
    > > > > > >
    > > > > >
    > > > > >
    > > > >
    > > > > or even:
    > > > > http://www.pestscan.com/
    > > > > google around for free online ad/malware scanners. there are quite a

    > few
    > > > > good ones.
    > > >
    > > > Nothing is helping! When I run Hijack This and see the offending

    stuff,
    > > when
    > > > I Fix it and do a new scan, it is still there? HELP !!!!!!!!!!!!!!!!!
    > > >
    > > > >
    > > > >
    > > >
    > > >

    > >
    > > turn your system restore off before scanning and fixing. then you can

    turn
    > > it back on after removal.
    > >

    >
    > I wrote that too soon! The bas***d is back again. It was fixed for less

    than
    > five minutes! How do I turn off system restore then?
    >
    > >

    >
    >

    right click my computer>>systemrestore>>deaktivate system restore
    Brian, Sep 15, 2004
    #12
  13. mickey

    Brian Guest

    "mickey" <> schrieb im Newsbeitrag
    news:ci9mrq$a9a$...
    > "Brian" <> wrote in message
    > news:...
    > >
    > > "mickey" <> schrieb im Newsbeitrag
    > > news:ci9k6q$chq$...
    > > >
    > > > "Brian" <> wrote in message
    > > > news:...
    > > > >
    > > > > "mickey" <> schrieb im Newsbeitrag
    > > > > news:ci9e92$obc$...
    > > > > > "Brian" <> wrote in message
    > > > > > news:...
    > > > > > >
    > > > > > > "mickey" <> schrieb im Newsbeitrag
    > > > > > > news:ci95vp$k8e$...
    > > > > > > > I have been experiencing a lot of recent problems, the worst

    of
    > > > which
    > > > > > > > happened today when my Google homepage changed to a porn

    search
    > > > page!
    > > > > I
    > > > > > > > clearly have an infection of some sort but I just can't get my
    > > > system
    > > > > > > > cleaned no matter what Spy Search or Ad-ware I run. I can't
    > > > understand
    > > > > > the
    > > > > > > > Hijack This log and I certainly don#t want my children

    exposed
    > to
    > > > > porn.
    > > > > > I
    > > > > > > > suspect that they are responsible however because they use

    WinMX
    > > to
    > > > > > > download
    > > > > > > > music etc and as I don't visit porn sites, I haven't any other
    > > > > > explanation
    > > > > > > > for my recent probs! I don't even know if this message will

    > upload
    > > > > > because
    > > > > > > > when I try to post stuff on other groups, I get an error

    message
    > > > > telling
    > > > > > > me
    > > > > > > > that a problem was encountered! A bit of a mess all round

    then.
    > > Can
    > > > > > anyone
    > > > > > > > help me please?
    > > > > > > >
    > > > > > > >
    > > > > > > >
    > > > > > > visit this link:
    > > > > > > http://hijackthis.de/index.php?langselect=english
    > > > > > > copy and paste the hijack this log into the text field on that

    > page
    > > > and
    > > > > > > click "analyze" that should find any nasteis on your system. in

    > the
    > > > app
    > > > > > > itself: look for the baddies (which are marked on thatpage

    > displayed
    > > > > after
    > > > > > > analysing), tick them and have hijack this fix them.
    > > > > >
    > > > > > Hi Brian. I did what you suggested and analysed the logfile. I

    then
    > > > > "fixed"
    > > > > > everything I was advised to but the problem has now got worse! My

    > home
    > > > > page
    > > > > > just can't be changed back to Google permanently. When I use my

    > > Internet
    > > > > > Options to do so and then open IE, the Porn searchpage comes back

    > up.
    > > > And
    > > > > to
    > > > > > make matters worse, I had to go out for a few minutes there and my

    > 11
    > > > year
    > > > > > old son (who is off school with a bug) had opened it up and this

    > filth
    > > > was
    > > > > > sitting on my desktop! I am in a real quandary here and need help
    > > > > urgently!
    > > > > > Anybody.......please!
    > > > > > Oh, and another slighter prob, I downloaded the most recent

    version
    > of
    > > > > > Hijack this on Sunday night but this analysis tells me that I

    don't
    > > have
    > > > > the
    > > > > > latest version?
    > > > > >
    > > > > > >
    > > > > > >
    > > > > >
    > > > > >
    > > > >
    > > > > or even:
    > > > > http://www.pestscan.com/
    > > > > google around for free online ad/malware scanners. there are quite a

    > few
    > > > > good ones.
    > > >
    > > > Nothing is helping! When I run Hijack This and see the offending

    stuff,
    > > when
    > > > I Fix it and do a new scan, it is still there? HELP !!!!!!!!!!!!!!!!!
    > > >
    > > > >
    > > > >
    > > >
    > > >

    > >
    > > turn your system restore off before scanning and fixing. then you can

    turn
    > > it back on after removal.
    > >

    >
    > I wrote that too soon! The bas***d is back again. It was fixed for less

    than
    > five minutes! How do I turn off system restore then?
    >
    > >

    >
    >

    also (if u are using xp) you might want to have a look at your msconfig...
    start>>run>>type msconfig>>enter>>systemstart tab.. and let us know what is
    in that list (just the ones with a tick next to it). .
    maybe a manual removal if all else fails.......
    look in your taskmanager and see if any processes are running which seem
    dubious to you. then search for it/them on your drive using the search
    assistent. (make sure u are showing hidden and system files in your windows
    explorer tools>>folder options>>view>>uncheck don't show system and hidden
    files (or something like that). then reboot into safe mode (after writing
    down the location of those/that file/s) and delete them. don't forget to
    turn off the system restore again before hand. empty your temp i-net files
    and temp files. C:\documents and settings\your username\local settings open
    both folders(one at a time) mark all and delete.note the name of the file/s
    u deleted and do a registry search start run type regedit and press F3 enter
    the name of that file(better without extension.. you will get more hits) and
    delete keys matching (do a backup of your registry first file>>export (if
    things mes up afterwards you can import that file back and all will be back
    to its state prior to deleting keys and values). reboot in normal mode.
    bit long winded i know.. but thats the way i have had to get rid of some
    which wern't recoginized by the scanners.
    Brian, Sep 15, 2004
    #13
  14. mickey

    Buffalo Guest

    "mickey" <> wrote in message
    news:ci9mnf$a3l$...
    > "> Thanks for the help Brian. I got nothing from Trend either but I

    seem to
    > have resolved my problem for now. I started up in safe Mode and

    using either
    > SpyBot or Adware (can't remember which) I changed the names of the

    offending
    > start-up pages to Google and it seems to have done the trick. Only

    thing is,
    > I am now scared it will all happen again when I am not about. It's a

    great
    > pity that we can't detect where this filth comes from and do

    something about
    > it. Porn is okay for consenting adults but when young children are
    > innocently exposed to it, someone should be made pay! Thanks again

    and also
    > to anyone else who took the time to offer assistance to me.


    If you turned off System Restore to fix your problem, turn it back on
    when you are 'clean' again.
    The latest version of HiJackThis is: HijackThis v1.98.2,as far as I
    know.
    You can download it on the same page you used to analyze it.


    Did you try :
    CWShredder :
    http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder


    Also, download, install, update and then run SpyWareBlaster (free
    program).
    http://www.webattack.com/download/dlspywareblaster.shtml

    It does not find spyware-adware, but it stops most of them from being
    installed on your computer.

    Brian gave many links.
    I know you don't need them all, but I would surely try the two I
    mentioned in addition to AdAware and SpyBot.
    Buffalo, Sep 15, 2004
    #14
  15. mickey

    Nottoman Guest

    haven't read all the posts, but many times running your machine in Safe Mode
    can help before running the removal processes.

    "mickey" <> wrote in message
    news:ci95vp$k8e$...
    > I have been experiencing a lot of recent problems, the worst of which
    > happened today when my Google homepage changed to a porn search page! I
    > clearly have an infection of some sort but I just can't get my system
    > cleaned no matter what Spy Search or Ad-ware I run. I can't understand the
    > Hijack This log and I certainly don#t want my children exposed to porn. I
    > suspect that they are responsible however because they use WinMX to

    download
    > music etc and as I don't visit porn sites, I haven't any other explanation
    > for my recent probs! I don't even know if this message will upload because
    > when I try to post stuff on other groups, I get an error message telling

    me
    > that a problem was encountered! A bit of a mess all round then. Can anyone
    > help me please?
    >
    >
    >
    Nottoman, Sep 15, 2004
    #15
  16. mickey

    Brian Guest

    "mickey" <> schrieb im Newsbeitrag
    news:ci9mrq$a9a$...
    > "Brian" <> wrote in message
    > news:...
    > >
    > > "mickey" <> schrieb im Newsbeitrag
    > > news:ci9k6q$chq$...
    > > >
    > > > "Brian" <> wrote in message
    > > > news:...
    > > > >
    > > > > "mickey" <> schrieb im Newsbeitrag
    > > > > news:ci9e92$obc$...
    > > > > > "Brian" <> wrote in message
    > > > > > news:...
    > > > > > >
    > > > > > > "mickey" <> schrieb im Newsbeitrag
    > > > > > > news:ci95vp$k8e$...
    > > > > > > > I have been experiencing a lot of recent problems, the worst

    of
    > > > which
    > > > > > > > happened today when my Google homepage changed to a porn

    search
    > > > page!
    > > > > I
    > > > > > > > clearly have an infection of some sort but I just can't get my
    > > > system
    > > > > > > > cleaned no matter what Spy Search or Ad-ware I run. I can't
    > > > understand
    > > > > > the
    > > > > > > > Hijack This log and I certainly don#t want my children

    exposed
    > to
    > > > > porn.
    > > > > > I
    > > > > > > > suspect that they are responsible however because they use

    WinMX
    > > to
    > > > > > > download
    > > > > > > > music etc and as I don't visit porn sites, I haven't any other
    > > > > > explanation
    > > > > > > > for my recent probs! I don't even know if this message will

    > upload
    > > > > > because
    > > > > > > > when I try to post stuff on other groups, I get an error

    message
    > > > > telling
    > > > > > > me
    > > > > > > > that a problem was encountered! A bit of a mess all round

    then.
    > > Can
    > > > > > anyone
    > > > > > > > help me please?
    > > > > > > >
    > > > > > > >
    > > > > > > >
    > > > > > > visit this link:
    > > > > > > http://hijackthis.de/index.php?langselect=english
    > > > > > > copy and paste the hijack this log into the text field on that

    > page
    > > > and
    > > > > > > click "analyze" that should find any nasteis on your system. in

    > the
    > > > app
    > > > > > > itself: look for the baddies (which are marked on thatpage

    > displayed
    > > > > after
    > > > > > > analysing), tick them and have hijack this fix them.
    > > > > >
    > > > > > Hi Brian. I did what you suggested and analysed the logfile. I

    then
    > > > > "fixed"
    > > > > > everything I was advised to but the problem has now got worse! My

    > home
    > > > > page
    > > > > > just can't be changed back to Google permanently. When I use my

    > > Internet
    > > > > > Options to do so and then open IE, the Porn searchpage comes back

    > up.
    > > > And
    > > > > to
    > > > > > make matters worse, I had to go out for a few minutes there and my

    > 11
    > > > year
    > > > > > old son (who is off school with a bug) had opened it up and this

    > filth
    > > > was
    > > > > > sitting on my desktop! I am in a real quandary here and need help
    > > > > urgently!
    > > > > > Anybody.......please!
    > > > > > Oh, and another slighter prob, I downloaded the most recent

    version
    > of
    > > > > > Hijack this on Sunday night but this analysis tells me that I

    don't
    > > have
    > > > > the
    > > > > > latest version?
    > > > > >
    > > > > > >
    > > > > > >
    > > > > >
    > > > > >
    > > > >
    > > > > or even:
    > > > > http://www.pestscan.com/
    > > > > google around for free online ad/malware scanners. there are quite a

    > few
    > > > > good ones.
    > > >
    > > > Nothing is helping! When I run Hijack This and see the offending

    stuff,
    > > when
    > > > I Fix it and do a new scan, it is still there? HELP !!!!!!!!!!!!!!!!!
    > > >
    > > > >
    > > > >
    > > >
    > > >

    > >
    > > turn your system restore off before scanning and fixing. then you can

    turn
    > > it back on after removal.
    > >

    >
    > I wrote that too soon! The bas***d is back again. It was fixed for less

    than
    > five minutes! How do I turn off system restore then?
    >
    > >

    >
    >


    one more thing.. on the registry search. keep hitting F3 until the message
    box appears searching complete.
    Brian, Sep 15, 2004
    #16
  17. mickey

    mickey Guest


    > >
    > > I wrote that too soon! The bas***d is back again. It was fixed for less

    > than
    > > five minutes! How do I turn off system restore then?
    > >
    > > >

    > >
    > >

    > right click my computer>>systemrestore>>deaktivate system restore


    I figured it out but that too has made no difference! I have run Spybot,
    Adware, AVG and a new one, startchmfix. But I keep getting the same crap on
    my home page. I did a Googl search and see that it is a common enough
    problem but I just can't fix it! It is a replicant so each time I change my
    homepage back to Google, it only lasts for seconds, if even that. I am at my
    wits end here. Somebody must know how to permanently remove this trash
    surely!

    >
    >
    mickey, Sep 15, 2004
    #17
  18. mickey

    Jim Byrd Guest

    Hi Mickey - Sorry I haven't chimed in before, but I just now got a chance to
    look at this thread. You may be OK for now, but for future reference and/or
    if it comes back please take a look at the following. You might want to
    note particularly the preventive measures at the end:



    Sounds like this might be a variant of some malware called CoolWebSearch (if
    CWShredder doesn't fix it, then see AdAware, SpyBot, and HijackThis, below,
    in that order). Do the following:


    #########IMPORTANT#########
    Before you try to remove spyware using any of the programs below, download
    both a copy of LSPFIX here:

    http://www.cexx.org/lspfix.htm

    AND a copy of Winsockfix
    http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
    Directions here: http://www.tacktech.com/display.cfm?ttid=257

    The process of removing certain malware may kill your internet connection.
    If this should occur, these programs, LSPFIX and WINSOCKFIX, will enable you
    to regain your connection.

    NOTE: It is reported that in XP SP2, the command netsh winsock reset
    will fix this problem without the need for these programs.
    #########IMPORTANT#########



    #########IMPORTANT#########
    All of the following removal tools should be run from Safe mode when
    possible.Reboot and test if the malware is fixed after using each tool.
    #########IMPORTANT#########


    Download and run Stinger.exe, here:
    http://download.nai.com/products/mcafee-avert/stinger.exe or from the link
    on this page: http://vil.nai.com/vil/stinger/


    Download sysclean.com , from Trend Micro, here:
    http://www.trendmicro.com/download/dcs.asp along with the latest pattern
    file, here: http://www.trendmicro.com/download/pattern.asp (You might also
    want to get Art's updater, SYS-UP.Zip, here for future updating of these:
    http://home.epix.net/~artnpeg/). Place them in a dedicated folder after
    appropriate unzipping, and then run. (If you download and use the updater
    from the beginning, it will automatically handle downloading the other
    files.)


    Sometimes the tools below will find files which they are unable to delete
    because they are in use. A program called Copylock, here,
    http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the process of
    "replacing, moving, renaming or deleting one or many files which are
    currently in use (e.g. system files like comctl32.dll, or virus/trojan
    files.)"



    Download, UPDATE before running, and run:
    http://209.133.47.200/~merijn/files/CWShredder.exe or here:
    http://hem.bredband.net/b157129/f/cwshredder.zip or here:
    http://www.softpedia.com/public/scripts/downloadhero/10-17-150/ or here:
    http://www.zerosrealm.com/downloads/CWShredder.zip
    to remove the parasite. Be sure to close all instances of IE and OE.


    There's a good tutorial about CWS and using CWShredder here:
    http://www.bleepingcomputer.com/forums/index.php?showtutorial=47#domain

    BE SURE that you get v.1.59.0.1 or later!

    You will need to show Hidden files first and then at the end clear the
    malware garbage from your System Restore backups after you've cleaned up.
    It's best to perform CWShredder (and most other malware fixers too) from
    Safe mode and then reboot. AFTER cleaning things up, then you can disable
    and then re-enable System Restore. See ******** below.

    The following links give instructions on how to do these various functions:


    HOW TO Restart in Safe Mode
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

    HOW TO Enable Hidden Files
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339

    HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
    use the suggested procedure for XP at the ******'s)
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039
    (WinXP)
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239
    (WinME)



    Then download and run:
    http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
    tabs and remove any restrictions that the parasite has put in place.

    Now download and run:
    http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
    your search functions if they've been affected (as they probably will have
    been).


    Be sure that you also download and install hotfix Q816093, here:

    http://support.microsoft.com/?kbid=816093

    which blocks the exploit upon which this parasite family depends.



    However, this also indicates that you may have acquired some other malware
    along the way. If you go to this page at Jim Eshelman's site, here:
    http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
    of a number of possible parasites on your machine will be made to help you
    identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
    Alarm 3.x or later, if present or any other Ad Blocking software which
    interferes with Java Scripting for this scan to work. You should get a
    message between the two lines of **** giving the results of the scan.

    Get Ad-Aware SE Personal Edition, here:
    http://www.lavasoftusa.com/support/download/. UPDATE, set it up in
    accordance with this: http://forum.aumha.org/viewtopic.php?t=5877 or the
    directions immediately below and run this regularly to get rid of most
    "spyware/hijackware" on your machine. If it has to fix things, be sure to
    re-boot and rerun AdAware again and repeat this cycle until you get a clean
    scan. The reason is that it may have to remove things which are currently
    "in use" before it can then clean up others. Configure Ad-aware for a
    customized scan, and let it remove any bad files found.....

    <Begin Setup Directions>
    Then, courtesy of NonSuch at Lockergnome, open Ad-aware then click the gear
    wheel at the top and check these options to configure Ad-aware for a
    customized scan:

    General> activate these: "Automatically save log-file" and "Automatically
    quarantine objects prior to removal"

    Scanning > activate these: "Scan within archives", "Scan active processes",
    "Scan registry", "Deep scan registry," "Scan my IE Favorites for banned
    sites," and "Scan my Hosts file"

    Tweaks > Scanning Engine> activate this: "Unload recognized processes during
    scanning."

    Tweaks > Cleaning Engine: activate these: "Automatically try to unregister
    objects prior to deletion" and "Let Windows remove files in use after
    reboot."

    Click "Proceed" to save your settings, then click "Start." Make sure
    "Activate in-depth scan" is ticked green, then scan your system. When the
    scan is finished, the screen will tell you if anything has been found, click
    "Next." The bad files will be listed. Right click the pane and click "Select
    all objects" - This will put a check mark in the box at the side, click
    "Next" again and click "OK" at the prompt "# objects will be removed.
    Continue?"
    <End Setup Directions>

    Courtesy of http://www.nondisputandum.com/html/anti_spyware.html: HINT: If
    Ad Aware is automatically shut-down by a malicious software, first run
    AWCloak.exe, http://www.lavasoftnews.com/downloads/AAWCloak.exe, before
    opening Ad Aware. When AAWCloak is open, click “Activate Cloak”. Than open
    Ad Aware and scan your system.


    Another excellent program for this purpose is SpyBot Search and Destroy
    available here: http://security.kolla.de/ SpyBot Support Forum here:
    http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
    using both normally. After UPDATING and fixing ONLY RED things with SpyBot
    S&D, be sure to re-boot and rerun SpyBot again and repeat this cycle until
    you get a clean "no red" scan. The reason is that SpyBot sometimes has to
    remove things which are currently "in use" before it can then clean up
    others.

    Note that sometimes you need to make a judgement call about what these
    programs report as spyware. See here, for example:
    http://www.imilly.com/alexa.htm

    Both of these programs should normally be UPDATED and run after doing any
    other fix such as CWShredder and, as a minimum, normally at least once a
    week.



    If they don't fix it then start here:

    Download HijackThis, free, here:
    http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
    fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
    You may also get it here if that link is blocked:
    http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13
    or here: http://www.bleepingcomputer.com/files/spyware/hijackthis.zip

    In Windows Explorer, click on Tools|Folder Options|View and check "Show
    hidden files and folders" and uncheck "Hide protected operating system
    files". (You may want to restore these when you're all finished with
    HijackThis.)

    Place HijackThis.exe or unzip HijackThis.zip into its own dedicated folder
    at the root level such as C:\HijackThis (NOT in a Temp folder or on your
    Desktop), reboot to Safe mode, start HT (have ONLY HT running - IE MUST be
    closed) then press Scan. Click on SaveLog when it's finished which will
    create hijackthis.log. Now click the Config button, then Misc Tools and
    click on Generate StartupList.log which will create Startuplist.txt

    Then go to one of the following forums:

    Spyware and Hijackware Removal Support, here:
    http://forums.spywareinfo.com/

    or Net-Integration here:
    http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

    or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx
    or Jim Eshelman's site here: http://forum.aumha.org/
    or Bleepingcomputer here: http://www.bleepingcomputer.com/
    or Computer Cops here: http://www.computercops.biz/forums.html



    Register if necessary, then sign in and READ THE DIRECTIONS at the beginning
    of the particular site's HiJackThis forum, then copy and paste both files
    into a message asking for assistance, Someone will answer with detailed
    instructions for the removal of your parasite(s). Be sure you include at
    the beginning of your post a description of "What specific
    problem(s)/symptoms you're trying to solve" and "What steps you've already
    taken."


    *******
    ONLY IF you've successfully eliminated the malware, you can now make a new,
    clean Restore Point and delete any previously saved (possibly infected)
    ones. The following suggested approach is courtesy of Gary Woodruff: For XP
    you can run a Disk Cleanup cycle and then look in the More Options tab. The
    System Restore option removes all but the latest Restore Point. If there
    hasn't been one made since the system was cleaned you should manually create
    one before dumping the old possibly infected ones.
    *******


    Once you get this cleaned up, you might want to consider installing Eric
    Howes' IESpyAds, SpywareBlaster and SpywareGuard here to help prevent this
    kind of thing from happening in the future:

    IESpyads - https://netfiles.uiuc.edu/ehowes/www/resource.htm "IE-SPYAD adds
    a long list of sites and domains associated with known advertisers,
    marketers, and crapware pushers to the Restricted sites zone of Internet
    Explorer. Once you merge this list of sites and domains into the Registry,
    the web sites for these companies will not be able to use cookies, ActiveX
    controls, Java applets, or scripting to compromise your privacy or your PC
    while you surf the Net. Nor will they be able to use your browser to push
    unwanted pop-ups, cookies, or auto-installing programs on your PC." Read
    carefully.

    http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
    X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU or memory
    load - but keep it UPDATED) The latest version as of this writing will
    prevent installation or prevent the malware from running if it is already
    installed, and it provides information and fixit-links for a variety of
    parasites.

    http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
    install malware) Keep it UPDATED. All three Very Highly Recommended


    Finally, go to Windows Update and ensure that ALL Critical updates are
    installed.


    --
    Please respond in the same thread.
    Regards, Jim Byrd, MS-MVP



    In news:ci9mnf$a3l$,
    mickey <> typed:
    > "Brian" <> wrote in message
    > news:...
    >>
    >> "mickey" <> schrieb im Newsbeitrag
    >> news:ci9e92$obc$...
    >>> "Brian" <> wrote in message
    >>> news:...
    >>>>
    >>>> "mickey" <> schrieb im Newsbeitrag
    >>>> news:ci95vp$k8e$...
    >>>>> I have been experiencing a lot of recent problems, the worst of
    >>>>> which happened today when my Google homepage changed to a porn
    >>>>> search page! I clearly have an infection of some sort but I just
    >>>>> can't get my system cleaned no matter what Spy Search or Ad-ware
    >>>>> I run. I can't understand the Hijack This log and I certainly
    >>>>> don#t want my children exposed to porn. I suspect that they are
    >>>>> responsible however because they use WinMX to download music etc
    >>>>> and as I don't visit porn sites, I haven't any other explanation
    >>>>> for my recent probs! I don't even know if this message will
    >>>>> upload because when I try to post stuff on other groups, I get an
    >>>>> error message telling me that a problem was encountered! A bit of
    >>>>> a mess all round then. Can anyone help me please?
    >>>>>
    >>>>>
    >>>>>
    >>>> visit this link:
    >>>> http://hijackthis.de/index.php?langselect=english
    >>>> copy and paste the hijack this log into the text field on that
    >>>> page and click "analyze" that should find any nasteis on your
    >>>> system. in the app itself: look for the baddies (which are marked
    >>>> on thatpage displayed after analysing), tick them and have hijack
    >>>> this fix them.
    >>>
    >>> Hi Brian. I did what you suggested and analysed the logfile. I then
    >>> "fixed" everything I was advised to but the problem has now got
    >>> worse! My home page just can't be changed back to Google
    >>> permanently. When I use my Internet Options to do so and then open
    >>> IE, the Porn searchpage comes back up. And to make matters worse, I
    >>> had to go out for a few minutes there and my 11 year old son (who
    >>> is off school with a bug) had opened it up and this filth was
    >>> sitting on my desktop! I am in a real quandary here and need help
    >>> urgently! Anybody.......please!
    >>> Oh, and another slighter prob, I downloaded the most recent version
    >>> of Hijack this on Sunday night but this analysis tells me that I
    >>> don't have the latest version?
    >>>
    >>>>
    >>>>
    >>>
    >>>

    >>
    >> or even:
    >> http://www.pestscan.com/
    >> google around for free online ad/malware scanners. there are quite a
    >> few good ones.
    >>

    >
    > Thanks for the help Brian. I got nothing from Trend either but I seem
    > to have resolved my problem for now. I started up in safe Mode and
    > using either SpyBot or Adware (can't remember which) I changed the
    > names of the offending start-up pages to Google and it seems to have
    > done the trick. Only thing is, I am now scared it will all happen
    > again when I am not about. It's a great pity that we can't detect
    > where this filth comes from and do something about it. Porn is okay
    > for consenting adults but when young children are innocently exposed
    > to it, someone should be made pay! Thanks again and also to anyone
    > else who took the time to offer assistance to me.
    Jim Byrd, Sep 15, 2004
    #18
  19. mickey

    mickey Guest

    I'm running "Spy Sweeper" right now but I'm not having a lot of success at
    all. I bought a programme a couple of years ago and it was one that Brian
    suggested, "Pest Scan". I ran it a while back and it seemed to pick up the
    offending Toolbar but it will cost me about $40. I tried sendingg them my
    e-mail but I don't have tho old credit card number so I can't get my
    registry number. Pity because it did look promising. I did a Google search
    for the URL that appears in my browser and I see that loads of people have
    had problems with this one hijacking their systems. But, as I am not that
    computer literate, I can't see how they got rid of it eventually. This is
    the name and if anyone can give me plain and as simple as possible
    instructions to remove it, I will be eternally grateful. Don't anybody click
    on it for God's sake;

    mk:mad:MSITStore:C:\spe\start.chm::/start.html#



    "Buffalo" <eric(nospam)@nada.com.invalid> wrote in message
    news:cRZ1d.196276$mD.147840@attbi_s02...
    >
    > "mickey" <> wrote in message
    > news:ci9mnf$a3l$...
    > > "> Thanks for the help Brian. I got nothing from Trend either but I

    > seem to
    > > have resolved my problem for now. I started up in safe Mode and

    > using either
    > > SpyBot or Adware (can't remember which) I changed the names of the

    > offending
    > > start-up pages to Google and it seems to have done the trick. Only

    > thing is,
    > > I am now scared it will all happen again when I am not about. It's a

    > great
    > > pity that we can't detect where this filth comes from and do

    > something about
    > > it. Porn is okay for consenting adults but when young children are
    > > innocently exposed to it, someone should be made pay! Thanks again

    > and also
    > > to anyone else who took the time to offer assistance to me.

    >
    > If you turned off System Restore to fix your problem, turn it back on
    > when you are 'clean' again.
    > The latest version of HiJackThis is: HijackThis v1.98.2,as far as I
    > know.
    > You can download it on the same page you used to analyze it.
    >
    >
    > Did you try :
    > CWShredder :
    > http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder
    >
    >
    > Also, download, install, update and then run SpyWareBlaster (free
    > program).
    > http://www.webattack.com/download/dlspywareblaster.shtml
    >
    > It does not find spyware-adware, but it stops most of them from being
    > installed on your computer.
    >
    > Brian gave many links.
    > I know you don't need them all, but I would surely try the two I
    > mentioned in addition to AdAware and SpyBot.
    >
    >
    mickey, Sep 15, 2004
    #19
  20. mickey

    °Mike° Guest

    It looks like you have been hijacked by "heretofind".

    Install HijackThis and post the contents of your log here.
    I don't have the rest of this thread, so I don't know
    what advise has already been given.

    HijackThis
    http://aumha.org/downloads/hijackthis.zip
    http://aumha.org/downloads/hijackthis.exe


    On Wed, 15 Sep 2004 19:46:13 +0000 (UTC), in
    <cia664$p2c$>
    mickey scrawled:

    >I'm running "Spy Sweeper" right now but I'm not having a lot of success at
    >all. I bought a programme a couple of years ago and it was one that Brian
    >suggested, "Pest Scan". I ran it a while back and it seemed to pick up the
    >offending Toolbar but it will cost me about $40. I tried sendingg them my
    >e-mail but I don't have tho old credit card number so I can't get my
    >registry number. Pity because it did look promising. I did a Google search
    >for the URL that appears in my browser and I see that loads of people have
    >had problems with this one hijacking their systems. But, as I am not that
    >computer literate, I can't see how they got rid of it eventually. This is
    >the name and if anyone can give me plain and as simple as possible
    >instructions to remove it, I will be eternally grateful. Don't anybody click
    >on it for God's sake;
    >
    >mk:mad:MSITStore:C:\spe\start.chm::/start.html#


    <snip>

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Sep 15, 2004
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. nikoli

    Something Crazy Happened !!!

    nikoli, Dec 12, 2003, in forum: Firefox
    Replies:
    0
    Views:
    526
    nikoli
    Dec 12, 2003
  2. Pavel

    ------- Crazy XP ------- HELP !!!!!!!

    Pavel, Sep 22, 2003, in forum: Microsoft Certification
    Replies:
    4
    Views:
    1,742
    Pavel
    Sep 30, 2003
  3. G
    Replies:
    0
    Views:
    1,094
  4. Alfonso Deo
    Replies:
    1
    Views:
    4,678
    Erik Tamminga
    Apr 30, 2004
  5. dr greg

    crazy browser go crazy

    dr greg, Jan 13, 2005, in forum: Computer Support
    Replies:
    7
    Views:
    998
Loading...

Share This Page