Re: Begin2Search IE6 Browser hijack!!

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance


"Monty" <jinkom11@xxxxxxxx> wrote in message
news:1142798658.075587.19990@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
My IE6 browser keeps getting re-diretced by a subtle registry change to
strange porn sites. I have tried everything in terms of spyware
detectors/deleters such as AdAware, Spybot, Spyware Doctor even used
Trend Micros dedicated spyware software. Trend identifies the offending
Begin2Search, deletes it but somehow it comes back and starts
re-directing my browser again.
Does anyone have any idea how to get rid of this Begin2Search
spyware/malware ONCE AND FOR ALL?

Thanks in advance!


Monty,

I cleaned Begin2Search from a WinXP machine recently. The Symantec site
http://www.symantec.com/avcenter/venc/data/adware.begin2search.html

has what looks like a good recipe. I would add one more vital step which
they don't mention. Before you go to the tedious step of manually deleting
registry keys and values, go ahead and locate the BHO dll, named as
%system%\ns<randomstring>.DLL

then do
/start
/run
regsvr32 /u <path-to-DLL>

this will remove most (but not all) the keys mentioned by Symantec.

When I looked at the key
hkcu\software\ns<randomstring>.dll

there were literally MBytes & MBytes of text written there. You will need to
delete that key manually.

regards,
tlviewer



.

Relevant Pages

  • Re: How to inhibit My Documents from opening upon boot
    ... and, most importantly, no spyware. ... "Dennis" wrote in message ... >> Please post these registry keys, as this problem is almost certainly ... >> Associate Expert - WindowsXP Expert Zone ...
    (microsoft.public.windowsxp.general)
  • Re: LAN conn status shows Automatic Private Address
    ... you probably have a damaged winsock2 key in the registry. ... It may be a third-party firewall or a Spyware or a Virus. ... Step 1: Delete registry keys ...
    (microsoft.public.windowsxp.network_web)
  • Re: Setupapi.log and keyboard problems
    ... Is it possible that those keys just stopped working, ... | the change in the above log indicative of spyware or a virus. ... | Avast and a bunch of Spyware Programs in addition to crap cleaner. ... | to use the number keys on the old keyboard. ...
    (microsoft.public.win2000.general)
  • Re: wga notification on legitimate installs
    ... For the M$ attitude to what IMHO is spyware see these forums: ... variant with the early keys that where leaked, and the more recent keys that ... It seems Microsoft are going much further then picking off the VLK installs ... Reading some of the forums, it seems people are getting new machines, direct ...
    (uk.comp.homebuilt)
  • Re: LAN conn status shows Automatic Private Address
    ... It may be a third-party firewall or a Spyware or a Virus. ... for replacing the winsock and winsock2 registry keys: ... Step 1: Delete registry keys ... It is important to restart the computer after deleting the Winsock keys. ...
    (microsoft.public.windowsxp.network_web)