Spyware messing with homepage

[mccoady]

I guess I picked up some spyware looking for dvd covers and I can't seem to get rid of it. My homepage keeps coming up with "Blaze Find" no matter how many times I delete it or use my default homepage. This is only doing this with my IE browser, not my SBC Yahoo brower. When this first occurred my Trend PC-cillin antivirus picked up ADW_Barg..., ADW_Lycos... and ADW_Solu1... and I thought all I had to do was delete them, but I guess it didn't work because of the homepage problem. I ran PC-cillin today but it's not picking up anything now.

I also ran Ad-aware and Spybot several times (both latest files) and picked up various spyware and deleted them, but still the "Blaze Find" problem. Any ideas?

Mike

[sartynhc]

have you tryed doing an online virus scan, http://housecall.trendmicro.com/
my brother got our computer infected and when I did the scan it found a trojan and deleted it.

also install winpatrol or spywareguard.

Download hijackthis and post it here(not an expert but i might be able to see it) or at spywareinfo forums(http://forums.spywareinfo.com/) or adaware forum(http://www.lavasoftsupport.com/)

oh and when looking for dvd covers explorer is a no no. Use firefox or mozilla.

[BJ_M]

your "hosts" file is probobly fubared ... and there now may be more than one ..


do a search for "hosts" on your system (looking in system files etc ) and open them all up and check what is there

this is all that should be there (though i add a lot of extra entries myself to block ads)

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

[DVD_Ripper]

Also, if your running XP at the run prompt type MSCONFIG and look for any startup apps that may be problematic... you can compare them to various startup apps here:

http://www.windowsstartup.com/wso/

[tekkieman]

It's probably in the registry to reload every time you start your computer. Start by checking HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run

Spybot won't always catch it.

****Disclaimer - F'ing with your registry could cause serious damage to your system!

[mccoady]

Okay I guess I forgot to mention I'm only a step above a novice when it comes to computers, so it can't be to complicated for me. What am I looking for and where do I start first, maybe someone can talk me through if needed?

Following tekkleman's directions this is what's displayed in "Run":
ab (Default)
ab 2WsysTray
ab IPInsightMonitor 01
ab ITunesHelper
ab Nerofiltercheck
ab pccguide
ab PCClient.exe
ab QuickTime
ab TM Outbreak Agent
ab WinUpdates
ab YBrower


Mike

[tekkieman]

Okay I guess I forgot to mention I'm only a step above a novice when it comes to computers, so it can't be to complicated for me. What am I looking for and where do I start first, maybe someone can talk me through if needed?

Mike

Please don't take this as an attack on your intelligence, and I apologize for being graphic and blunt, but if the already tried apps did not resolve your problem, you are better off seeking the services of trained professionals. The knowledge and experience required to traipse through the bowels of the computer to resolve these issues can raised the blood pressure of many experienced users.

Most places will only charge around $50.00-$75.00 to recover the system to a normal state. While this may seem excessive, it is nothing to the harm worms/trojans/etc can do to the system, or what you might accidentally do to it while trying to repair it.

Just a suggestion....

[tekkieman]

Sorry Mike, looks like you were editing while I was typing my response. The last entry looks suspicious. I would run the name through Google and see what you find.

edit - if that's supposed to be "YBrowser", then that is the Yahoo browser. That's probably ok.

[mccoady]

I think it may be my SBC Yahoo Browser, although I'm not possive.

[fredpb]

Webroot Spysweeper fixes and prevents these home page hijackings. I think its at www.webroot.com

[mccoady]

Well I tried all the suggestions mentioned here plus downloading every free spyware programs I could find, but to no avail. Finally I decided if I was going to have to hire someone to find and eliminate my spyware I might as well purchase some software, and ended up with PestPatrol. This found and eliminated 4 different hijacker spyware all in about 30 minutes after I had tried for a day and a half. So far it seems everything is back to normal including my homepage, plus my computer is so much faster. At least if I run into hijacker spyware again I should be able to deal with it (hopefully)in the future.

I did see where someone mentioned browsing and downloading dvd covers is a no no with IE, but how about with my SBC Yahoo Browser? Also it was mentioned using Mozilla/Firefox, which would be better?

Mike

[tweedledee]

I guess I picked up some spyware looking for dvd covers

I use this site for DVD covers, and never had a problem
http://www.cdcovers.cc/

[mccoady]

Well I'm pretty sure that's where I was at, but it could have been one of the other links to dvd covers they provided since they didn't have what I needed.

[tweedledee]

It's difficult to see how you could pick up spy ware from that site as you don't actually download the cover, you simply click/copy, and with Spybot and Adaware installed, you should be safe.

[sartynhc]

yeh that website is loaded with spyware i went there with internet explorer with activex enabled(because i hate those activex popups and didnt have access to firefox) and got tons, but for me adaware cleaned it all, they mustve added worse stuff since Ive been there. Just use a mozilla or firefox or try diasbling all your activex when you go there.

[ybee]

check out this link to help solve your problem
http://www.net-integration.net/tools/hijackthis.html


you can get the latest versions of the programs over here
http://www.spywareinfo.com/~merijn/
but yesterday the site was not working (but is working just now)

I use Spywareblaster to prevent ie browser hijacking.
Google it to find out more about it.