entire browser has been hijacked

[D.K.]

Don't know how this happened, but I suspect a friend was
viewing porn on my computer. When I came home today I
noticed my computer performing slowly, and when I opened
IE, I saw the browser had been hijacked. In my Internet
Options, the address is set at C:\WINDOWS\secure.html,
and whenever I attempt to correct it, that address always
reappears. How do I know porn is to blame? There's also a
Javascript pop-under ad that I can't get rid of, which
has thumbnails of pix--it appears on my desktop.

I ran Adaware and it did some good. I'm able to access
Microsoft Updates and this newsgroup right now. But
that's it. Any other web site I go to takes me to some
Search page. I can't even use search engines to research
what what the problem is.

Has anyone encountered this problem before who can help
me? Please respond by email as well since I'm not sure
I'll find my post here.. Or that I'll be able to access
this forum tomorrow.

 

[Bladeless]

Go on another computer and download Spybot - Search &
Destroy. It tends to do more good then adaware, you can
use an ftp to download it (Windows has a built in, go
start->run->command.com(if you are using winxp use CMD)
and type in the dos box, ftp, log on to this site
ftp://ftp.download.com/pub/win95/utilities/spybotsd13.exe

Best of luck! You'll need it!

 

[D.K.]

I do have XP, and I was able to do the CMD, get Spybot
thing. Spyboy did catch some stuff Adaware didn't. But
the browser remains hijacked. Here are some more symptoms:
(1) On Add/Remove I've removed these programs constantly--
PGate Basic, Search Assistant Uninstall, Uninstall
180searchAssistant--and somehow they always reappear when
I restart my computer.

(2) Whenever I try to shut down my computer there appears
to be some program running in the background. I get End
Now errors about some SysFader and DDE Server running.
There was a rundll32.exe error but that's gone now.

(3) When I first turned my computer on and discovered my
browser had been hijacked, a Spyware protection called
Spyware Stormer automatically installed, without me ever
having gone to its web site. And after installing, the
damn thing said I'd have to pay to use it--worthless.

(4) Then --and now-- there's a Norton Antivirus message
that pops up, but I don't even have Norton on my
computer. This pop up takes me to a site that says buy
this security pack to clean up your PC. But I don't trust
the URL. Nowhere in it do I see mcafee or norton
mentioned.

(5) That C:\WINDOWS\secure.html displays this message
only:

Detected SPYware! System error #384
_______________________________________________________
Your IP address is (insert my correct IP address here).
Using this address a remote computer has gained anaccess
to your computer and probably is collecting the
information about the sites you've visited and the files
contained in the folder Temporary Internet Files.
Attention! Ask for help or install the software for
deleting secret information about the sites you visited.
_______________________________________________________
Your computer is full of evidences!

ISP of transmission: MINDSPRING

Your IP address: (insert my correct IP address here)

They know you're using: Mozilla/4.0 (compatible; MSIE
6.0; Windows NT 5.1; Roadrunner)

Your computer is: Windows XP

Risk status for further investigation: VERY HIGH RISK

To prevent from the spyware - click here
To prevent information transmission - click here
To delete the history of your activity, click here

Based on the amount of typos and grammar mistakes I knew
not to trust the links given on this page either.

Now that everyone knows a little bit more information, is
there anything familiar that you can help with?

 

[D.K.]

By the way, thanks for responding man. If you could
believe it, System Restore did the trick. Everything
seems to be working fine now.

Except, does anyone know how I can get back all the
Microsoft Windows Updates? Even the XP Service Pack 1
disappeared from my Add/Remove programs list. And my
Windows Media Player has the same ol' design again. I
kinda liked the metallic new look.

 

[Lawrence]

I'm not sure you have provided enough info but I'll give
this a try.

Make sure you have the latest version of Adaware
installed. It sounds like you have the same ad bomb I
experianced about 4 months ago. What some of these sites
do is download files onto your system which can change
your brouser security settings, make changes to your
registry, change your start page and redirect your brouser
without your authorization. Once it gets in it is hard to
get rid of because the registry calls the files that "fix"
any damage you cause if you find them and attempt to
delete them yourself. It runs in the background and in
some cases cannot be removed because it will result in
a "file is in use by windows" error. And that is only if
you can find them! I was able to find some help with this
type of problem here: http://computercops.biz/index.php

Hope this helps some.