Have I got spyware

[Phil Martin]

Internet Explorer keeps taking me to www.angelfire.com without me typing the
address in. Have I got somekind of spyware and if I have how do I get rid
it?

 

[Will Denny]

Hi

Try these programs to check for any spyware that may be on your system:

Ad-Aware - www.lavasoftusa.com
Spybot - http://www.safer-networking.org/
CWShredder - http://www.spywareinfo.com/~merijn/downloads.html

Also see the following link:

http://mvps.org/winhelp2002/unwanted.htm

--

Will Denny
MS-MVP Windows - Shell/User
Please reply to the News Groups


| Internet Explorer keeps taking me to www.angelfire.com without me typing
the
| address in. Have I got somekind of spyware and if I have how do I get rid
| it?
|
|

 

[roger]

Internet Explorer keeps taking me to www.angelfire.com without me typing the
address in. Have I got somekind of spyware and if I have how do I get rid
it?

More info about parasites:
http://www.aumha.org/a/parasite.htm

Download the utility CWshredder:
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Unzip - close *all* instances of IE & OE, hit the executable and
follow
the prompts.

You can also download Hijack This from here:
http://computercops.biz/zx/phoenix22/hijackthis.zip
http://www.computercops.biz/downloads-cat-14.html
Go here:
http://mjc1.com/mirror/hjt/

For instructions on how to use it; you have to post the log it
produces

here:
http://www.spywareinfo.com/forums/
so experts tell you what is good and what is malware
HijackThis Log Tutorial
http://www.aumha.org/a/hjttutor.php
HiJack This is a program that simply searches for programs that run at
boot time, and checks for browser plug-ins. The results this program
gives you are generally just informative. Most of the programs it will
come up with are valid programs that you actually want running. You'll
have to go through the results and tell the program to delete unwanted
programs. If you can't figure out what some of the programs are, don't
just delete them, research them and/or post them so experts can let
you know what the program does. Just type the program name into google
which gets a decent answer pretty quickly.


Try downloading, installing and updating the
spyware removers from the links below. Run both of them.
Ad-aware
http://www.lavasoftusa.com/support/download/

Spybot S&D
http://www.safer-networking.org/index.php?lang=en&page=download



If these don't correct the problem, then get yourself a copy of
BHODemon,

available at
http://www.definitivesolutions.com/bhodemon.htm

It does not need installing - simply unzip and run the EXE program. It
is easy to use. It will find the hijackware DLL files, and give you
the ability to disable them.

Hope this helps.

 

[Jupiter Jones [MVP]]

Phil;
If you have to ask, you may not be properly protecting your computer:
http://www3.telus.net/dandemar/security.htm

#1, #2, #6 & #7 on this link will help answer your question:
http://www3.telus.net/dandemar/slowcom.htm

 

[Chuck]

Internet Explorer keeps taking me to www.angelfire.com without me typing the
address in. Have I got somekind of spyware and if I have how do I get rid
it?

Phil,

Could very well be a browser hijack.

First, download LSP-Fix and WinsockXPFIx from <http://www.cexx.org/lspfix.htm>,
and CWShredder from <http://www.majorgeeks.com/download4086.html>. All are
free.

Next, close all Internet Explorer and Outlook windows, then run CWShredder.
Have it fix all variants.

Now check for, and remove, spyware. Get HijackThis
<http://www.majorgeeks.com/download.php?det=3155> and Spybot S&D
<http://www.safer-networking.org/index.php?page=download>. Both free.
1) Install and run Spybot. First update it ("Search for updates"), then run a
scan ("Check for problems"). Trust Spybot, and make all recommended deletions.
2) Install and run HijackThis. Do NOT make any changes immediately. Save the
HJT Log. <http://forums.spywareinfo.com/index.php?showtopic=227>
3) Have your HJT log interpreted by experts at one or more of the following
forums (and post it, or a link to your forum post, here):
<http://forums.net-integration.net/>
<http://forums.spywareinfo.com/>
<http://forums.tomcoyote.org/>
<http://www.wilderssecurity.com/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

And Phil, please don't contribute to the spread and success of email address
mining viruses. Learn to munge your email address properly, to keep yourself a
bit safer when posting to open forums. Protect yourself and the rest of the
internet - never post your address unmunged.
http://www.mailmsg.com/SPAM_munging.htm

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Phil Martin]

The problem is a process called wugrds.exe. It was mentioned twice in
hijackthis and when it was deleted the web jumping stopped. Thanks to you
all for your help.