Help I think my browsers been hijacked!

[Dan Murphy]

http://disboards.com/showthread.php?s=&postid=5575892


Check some of these links in here.

 

[DMRick]

I'm too lazy to read teh whole thread..but all I do is open this addy and if I've been hijacked, they auto fix it for me.

http://www.doxdesk.com/parasite/

 

[HappyMommy2]

Unbelievable--I was just reading this thread yesterday thinking, "Boy am I glad that didn't happen to me" and then last night suddenly it happened!!

I have tried most of the suggestions that have been given so far, with no luck. I think I'm going to have to hire an expert to take care of this for me.

 

[oogieboogie]

Hang tight. I spent the better part of last night on the spywareinfo forum and they've seen this type of hijacking.

They've got a solution (I think), and since I'm at work right now, I can't work on it. After work, I'm going to run the fixes that they recommend.

Apparently there's a really nasty one right now by HomeSearchAssistant that is just absolutely difficult to destroy.
If I can get it out of DH's PC, I'll post the solution here tonight.

 

[Towncrier]

One of my coworker's computers here at work had this problem. One of our IT people worked for 4 hours to remove the hijacking program only to have it reappear this morning when he rebooted his computer.

If you are comfortable editting your registry, you may need to remove an entry that automatically runs the offending DLL file that re-infects your computer each time you reboot. AdAware, CWShredder, Sophos, McAfee, and Spybot S&D found the malware, but were unable to automatically remove it. Eventually I'm sure that these utilities will be updated in order to handle the most recent version of the browser hijacker. Until then, it won't hurt to try all the things that have been mentioned in this thread. Just hold off on reformatting your hard drive until the malware and antivirus people have had a little more time to address this version.

 

[oogieboogie]

Unfortunately this latest malware is one that spybot, ad-aware, and other spyware killers can't get. Even deleting the .dll didn't work because the malware kept changing dll names so it was just confusing to clean up.

Like I said, I'll post tonight.

 

[Pooh93]

I will be looking for any help I can get also. Our local computer man has been on vacation this week and since we are on vacation next week, I feel that I am "stuck." This virus/spyware keeps putting a porn site back in my favorites each time I delete it. Ugh! I am about to lose my mind.

 

[oogieboogie]

OK, update on my part.

This is not going so good. I've tried the steps the spywareinfo people have written, and I still have the spyware.

As for now, I'm using Mozilla for my browser while I work to figure this issue out.

 

[Pooh93]

This is not going so good. I've tried the steps the spywareinfo people have written, and I still have the spyware.

Okay, I'll give you a week to figure it out because we're leaving on vacation.

I was able to get rid of the search toolbar that had installed itself after finding it on my add/remove programs. So that part is better.

It looks like the internet that my computer is connecting to is www.nkvd.us. Ever heard of it? Then it flips to searchpage.cc as my homepage and then the popups begin.

Good luck and I hope you have success. I have a feeling I'll be taking it to the computer person that got my computer back together a few months ago.

 

[HappyMommy2]

Thanks for posting the updates on your progress (or lack thereof
). I'll be interested to see how everyone ends up getting this fixed. Mine is better since I ran spybot and CWShredder (plus I installed a "family" internet filter, which keeps some of the nasty stuff at bay) but things are still really messed up. When I try to do a google search, the thing takes over and performs its own search (for advertisements, of course), plus my homepage keeps getting switched no matter what I try, and sometimes in the middle of looking at another website I will get sent to the phony home page.

In the meantime, does anyone know if it's harmful for me to keep going online while I have this problem? I'd like to give it a little time and try some more things before I take drastic measures, as someone suggested, but not if I'm going to incur more damage to my computer by doing so. Just wondering.

Best wishes to everybody dealing with this. I am surprised by how violated I feel by this little computer intrusion.

 

[sammi]

Well my update is no better than the last time! I'm so sick of this! This should be dealt with through the law IF these idiots are ever caught!

The HomeSearch Assistant is what I keep getting on my home page and my search keeps getting taken over too. Also the same thing happens to me.....when I do a Google searh the stupid thing puts up it's own search page over top of Google's and trys to sell you stuff. Something should be done by the ISP's to put an end to this.

I've done more scans on this PC in the last couple of days.

Towncrier I think you may be right in that the utilities will eventually get an update running to fix this....but my luck the twits will find another way to get into our PC's.

Is it just me or does this seem to be running rampant right now?

Will keep you all updatded if something does get fixed.......gee maybe we should start a "I'm hikjacked support group"!

 

[6_Time_Momma]

Try going to www.webroot.com and download their spysweeper program (free version. I just did and it was sooooooo thorough and picked up 129 files including two trojan horses I had that spybot and adaware both missed. Cleaning it up right now!

 

[cati]

xx

 

[Dan Murphy]

Another thought...........

http://www.lavasoftsupport.com/index.php?showforum=44

 

[oogieboogie]

OK, latest update.

I decided what the heck, I'll go and update spybot, ad-aware, cwshredder and TrojanHunter just in case there were any updates this weekend.

Well anyways, long story short, Ad-aware had a new reference file as of 6/19 and it took out 69 malwares including the one plagueing me - the homesearch assistant!

So, as of today - 6/19/04 - the PC is cleansed and doing well.

I'll still keep Mozilla as my primary browser though and just keep IE as a secondary browser.

So, for those being hijacked now, try updating all your sweeper programs and run them again.

Good luck!

 

[Dan Murphy]

And a follow up on what ob says above. After using Ad-aware, the free one, for about a year, and seeing how well it worked, I opted for the Plus version a couple months ago, only $26 or so dollars. It updayes itself as new defs come out and scans to prevent the malware, spyware from getting in in the first place, rather than scanning for it and removing it. I can do manual scans if I want, and I still do, both Ad-aware and spybot, and since I went to plus, neither As-aware nor spybot have found one bad undesirable, batting average so far, 100%. I like it.

 

[sammi]

That's something I'll give some thought to Dan as I'm sooooo mad about this! and I don't ever want to go through this again.

My oldest DS (a computer whiz) is coming over tomorrow and will be attempting to remove this and I'll be sure to give an update......good luck to those who are still fighting with this "intrusion"!

 

[HappyMommy2]

Well, I am almost in tears over this. As recommended, I updated and re-ran all the scans (re-booting between each one, etc.). Everything looked great for a few minutes--I was thrilled! But then I turned the computer off and turned it on again, and lo and behold there was "coolwebsearch" as my home page again!


I will keep at this, but I'm wondering if I'm going to have to just wipe everything out and start clean (this time with a proactive anti-spyware; we already have a firewall and antivirus that are constantly updated and used).

If anyone has any other words of wisdom, please let me know!

 

[Dan Murphy]

Any help here???

http://www.siena.edu/antivirus/Spyware/CWS.htm

 

[oogieboogie]

OK, from the lavasoftsupport site, Ad-aware has updated their definitions to include coolwebsearch.

What I would do is download Mozilla first from http://www.mozilla.org. Install that and use it as your browser for now.

Then open Ad-aware and update your reference files. Run Ad-aware. Then shut down and restart.

Run Ad-aware again. Then open IE and hopefully your browser will open to the about:blank page which is blank. Set your normal homepage and see if it comes back.

Good luck.