Re: Hijacked webpage

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Jim Byrd (jrbyrd_at_spamlesscomcast.net)
Date: 02/10/04 

Date: Tue, 10 Feb 2004 07:06:18 -0800

Hi Eddie - This is usually associated with installing KaaZa. You can
usually remove it by using SpyBot Seach & Destroy, below. Or you may want
to uninstall KaaZa (Recommended):
http://www.spywareinfo.com/~merijn/...kazaabegone.zip

Note that this symptom often indicates the possibility of other malware.
You might want go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in
Zone Alarm 3.x, if present or any other Ad Blocking software which
interferes with Java Scripting for this scan to work. You should get a
message between the two lines of **** giving the results of the scan.

For the general hijack case, the best way to start is to get Ad-Aware 6.0,
Build 181 or later, here: http://www.lavasoftusa.com/support/download/.
UPDATE and run this regularly to get rid of most "spyware/hijackware" on
your machine. If it has to fix things, be sure to re-boot and rerun
AdAware again and repeat this cycle until you get a clean scan. The reason
is that it may have to remove things which are currently "in use" before it
can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm

A currently common parasite which can cause this symptom is some malware cal
led CoolWebSearch. Do the following:

Download and run: http://www.merijn.org/files/cwshredder.zip to remove the
parasite. Be sure to close all instances of IE and OE. Always download a
new copy of this application, as it is updated almost daily.,

Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093

which blocks the exploit upon which this parasite family depends.

Once you get things cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:
http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended. 

-- 
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
 In news:d06b01c3efaf$6d4eec70$a101280a@phx.gbl,
eddie <jehjeh@shamie.net> typed:
> Every once in a while when clicking on a link , instead
> of going to where it should it goes to
> www.perfectnav.com. Does anyone know how to get rid of
> this? I am using Windows XP Pro with IE6.
>
> Thank you,

Relevant Pages

  • Re: Phantom call up
    ... Be thorough in spyware / virus checking, ... AdAware and Spybot S&D have install routines - run them. ... First update it ("Search for updates"), ... Block known dangerous scripts from installing. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Cant Get Explorer to Work
    ... If you use Windows 98 it may be a parasite. ... Let AD-Aware Scan your system for advertising Spyware ... After installing Ad-Aware, open it and click on the ref update to get the ... download/run HijackThis from: ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Internet Properties-Home Page
    ... This is spyware. ... AdAware and Spybot S&D have install routines - run them. ... First update it ("Search for updates"), ... Block known dangerous scripts from installing. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Links that keep haunting me...
    ... Download HijackThis, free, here: ... Another excellent program for this purpose is SpyBot Search and Destroy ... you might want to consider installing the SpywareBlaster and ... SpyWare Blaster is not memory resident ... ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Virus? Pop-ups on sites that dont have any like Google?
    ... CoolWebSearch (if not, then see AdAware, SpyBot, and HijackThis, below). ... tabs and remove any restrictions that the parasite has put in place. ... this also indicates that you may have acquired some other malware ... Once you get this cleaned up, you might want to consider installing the ...
    (microsoft.public.windows.inetexplorer.ie6.browser)