Malware - Printable Version

Malware - Printable Version

+- InsaneTrain Forums (https://insanetrain.com)
+-- Forum: General (https://insanetrain.com/forumdisplay.php?fid=4)
+--- Forum: General Forum (https://insanetrain.com/forumdisplay.php?fid=8)
+--- Thread: Malware (/showthread.php?tid=4126)

Malware - greg - 04-24-2004

I apparently have downloaded something that won't allow me to change my homepage. Everytime I open my browser it brings up some stupid search engine. I have Adaware 6.0 but it doesn't get rid of it.

Any suggestions?

:angry: :angry: :angry: :angry: :angry: :angry: :angry: :angry:

Malware - leeman - 04-24-2004

Quote:Originally posted by gregl@Apr 24 2004, 04:01 PM
I apparently have downloaded something that won't allow me to change my homepage. Everytime I open my browser it brings up some stupid search engine. I have Adaware 6.0 but it doesn't get rid of it.

Any suggestions?

:angry:  :angry:  :angry:  :angry:  :angry:  :angry:  :angry:  :angry:

Hmmm What search page do you end up at????

Normaly they do a registry altering ....

So just use regedit and search for the web addie and delete them in registry ...

Ohhh and backup registry first... Wink

Malware - greg - 04-24-2004

Quote:Originally posted by leeman+Apr 24 2004, 09:04 AM--><div class='quotetop'>QUOTE(leeman @ Apr 24 2004, 09:04 AM)</div><div class='quotemain'> <!--QuoteBegin-gregl@Apr 24 2004, 04:01 PM
I apparently have downloaded something that won't allow me to change my homepage. Everytime I open my browser it brings up some stupid search engine. I have Adaware 6.0 but it doesn't get rid of it.

Any suggestions?

:angry:Â :angry:Â :angry:Â :angry:Â :angry:Â :angry:Â :angry:Â :angry:

[/b][/quote]
Sorry Lee, I am totaly computer illiterate. Please talk to me like a 5 year old! Huh

Malware - greg - 04-24-2004

http://ww9.linklist.cc/index.php?aid=20037 is the site.

Malware - leeman - 04-24-2004

Quote:Originally posted by gregl@Apr 24 2004, 04:11 PM
http://ww9.linklist.cc/index.php?aid=20037 is the site.

Hmmmm If you are not totaly comfy in registry you shouldn't mess around there.

Hmmm But you could do like this just to see how many hits you get.

Press : START - RUN
type REGEDIT and press OK.

Do a : EDIT - SEARCH (FIND)

And search for : ww9.linklist.cc

Malware - greg - 04-24-2004

No hits!

Malware - leeman - 04-24-2004

Quote:Originally posted by gregl@Apr 24 2004, 04:25 PM
No hits!

Hmmm .........

Try .... This

Malware - retiredroadie - 04-25-2004

Quote:Originally posted by gregl@Apr 24 2004, 04:01 PM
I apparently have downloaded something that won't allow me to change my homepage. Everytime I open my browser it brings up some stupid search engine. I have Adaware 6.0 but it doesn't get rid of it.

Any suggestions?

:angry:  :angry:  :angry:  :angry:  :angry:  :angry:  :angry:  :angry:

1. Make sure your anti virus is up to date as well as your subscription.
2. Try spybot software.
3. When you change the homepage address back are you making sure to hit "apply" then ok?

I think its #3 or a virus.

Malware - Devious - 04-25-2004

try tools , Then internet options and put back in your homepage.. Then go to Downloads.com and search for Spybot Seek and destroy. Download that and use it every week and you should be safe!!

Malware - greg - 04-25-2004

OK, I have purchased Spyhunter.
Did a scan (134 registry - 4 cookies - 12 files infected) deleted all of the infected items.
Then I did a re-scan and came back clean.
When I opened explorer it was back to the goddamned search engine.

So I did a search of my hard drive and found a cookie with that address, deleted it.
Now when I reboot, the cookie is back.

Could it be that one of the programs that open automatically at start up is putting the cookie back in?
(MSN Messenger - My MSN - The Weather Channel)

:angry: :angry: :angry: :angry: :angry: :angry: :angry: :angry: :angry:

Malware - retiredroadie - 04-26-2004

Quote:Originally posted by gregl@Apr 25 2004, 06:46 PM
OK, I have purchased Spyhunter.
Did a scan (134 registry - 4 cookies - 12 files infected) deleted all of the infected items.
Then I did a re-scan and came back clean.
When I opened explorer it was back to the goddamned search engine.

So I did a search of my hard drive and found a cookie with that address, deleted it.
Now when I reboot, the cookie is back.

Could it be that one of the programs that open automatically at start up is putting the cookie back in?
(MSN Messenger - My MSN - The Weather Channel)

:angry:  :angry:  :angry:  :angry:  :angry:  :angry:  :angry:  :angry:  :angry:

Possibly, did you turn them all off? Start in safe mode, to see if that makes a difference.

Malware - leucetios - 04-27-2004

I have SpyHuntet too. It will remove all of the offending spy programs, but not reset your home page for you. You need to do that manually.

Open Internet Explorer. Click on Tools, then Internt Options. You should see options to set your Home Page to Current, Blank or Default. And since SpyHunter has removed the spyware it shouldn't get set back.

Malware - greg - 04-27-2004

Quote:Originally posted by leucetios@Apr 27 2004, 11:01 AM
I have SpyHuntet too.  It will remove all of the offending spy programs, but not reset your home page for you.  You need to do that manually.

Open Internet Explorer. Click on Tools, then Internt Options.  You should see options to set your Home Page to Current, Blank or Default.  And since SpyHunter has removed the spyware it shouldn't get set back.

That's the thing, it does. When I start my computer the cookie is back into my recieved files. That is why I'm thinking it's a program installing the cookie at start up.

(maybe?)

Malware - leucetios - 04-27-2004

I had this problem recently. I just kept setting my page back to blank and running SpyHunter. For a while it would come back, I think those times I had run Spy Hunter then opened IE to reset it which takes me to their page and sets the cookie. So last night I did it the other way around, I unset the home page in IE first, then ran Spy Hunter. This morning, no annoying home page hijacking.

Try it that way if you haven't already. I will look into the one you have specifically for you in the meantime.

Malware - leucetios - 04-27-2004

OK. Here goes. I got this from http://www.spywareinfo.com/~merijn/ , specifically on linklist.cc. As with anything that messes with your computer, be careful.

--------------------------------------------------------------
March 24, 2004:
[Update] If your browser has been hijacked to drxcount.biz,
real-yellow-page.com, list2004.com or linklist.cc:
We are working on a fix for this one and drawing near to an automated
solution. This is by far the most sophisticated CWS variant seen to
date, and it will take some time before CWShredder will be able to
remove it.

The following *updated* manual fix should work:
Download this zip: http://www.zero.vulc4n.com/downloads/pv.zip, unzip
it to the desktop.
Be sure to have at least 1 Internet Explorer open, then double click
on the runme.bat.
Notepad will open with a log in it Look for a line with this file,
size and beginning to it. The filename will always be different:
winajbm.dll 61c00000 61440 c:\windows\system32\winajbm.dll

This part indicates the bad file:
61c00000 61440
It will always start with that header.
Write down the filename behind it.

Now download KillBox:
http://download.broadbandmedic.com/VbStuff/KillBox.zip
Unzip and run it.
Don't click any of the buttons though, instead please click on the
Action menu and choose "Delete on Reboot".
On the next screen, click on the File menu and choose "Add File". The
file you copied earlier should now show up in the window. If that's
successful, choose the Action menu and select "Process and Reboot".
You'll be prompted to reboot, do so.
After rebooting, make sure the file is gone.
If this doesn't work, search on the SpywareInfo forums for topics
posted by users with the same problem and read those. If none of the
solutions you find work, make a new thread and ask for help.

Malware - greg - 04-28-2004

OK I will try.

By the way, that is what it is, It used to always be real yellow page that opened.

Thanks, I appreciate it!

Malware - Undeadcannibal - 05-01-2004

There are three programs that I use and I neve rhave those problems. Xcleaner, DClean, and Spider. they all clean all information from your browser, inlciding index.dat files. xcleaner is at http://www.Xblock.com , Dclean I don't remember, but if you do a search for Dclean, you'll find it. and Spider is at http://www.fsm.nl/ward/ This should help you out.