IE 6 Web Searches are wrong!!!

[Guest]

Okay -- I am not sure what is wrong. I have run spybot and spyhunter and
nortin antivirus.

Whenever I perform a Yahoo search (or google) for a name that I KNOW has a
website, I get junk as a result. I can perform the same search at work on
IE6 and get the correct response. What is wrong? Is this a hijack?

Obviously, my children are unable to perform any research searches, becaues
the results are not what they need!

HELP!!!

 

[Altrüs]

Hi,

It does sound like a possible hijack. Although I note you have
tried Spybot and spyhunter, I would still urge you to try the
following:

You may first want to remove any third party helper
objects. This is best done by a program called BHOCop. It,
along with the rest of the programs, are freely available.
You can download BHOcop, and view an introduction to it,
from the following sites:

Download from:
http://support.honour.ca/bin/bhocop.zip
Introduction at:
http://www.pcmag.com/article2/0,1759,97081,00.asp

Once you download the file, run it, and install the program.
Then remove all objects you find that you are not familiar
with.

We'll now have you download some programs which shall aid
you in the actual removal of spyware programs which may be
running (and causing these problems).

First, download AdAware. This is an excellent program which
detects and deletes spyware, and other malware programs.
AdAware is available from:

http://www.lavasoftusa.com/support/download/

After downloading and installing AdAware, *be sure to update
it*. This will ensure you are protected against the latest
threats. Then, run it.

Some versions can be particularly malicious - removing them
can cause you to lose your internet connection. Therefore,
we'll download the next two programs as precautionary
measures. If, after running these programs, you are unable
to connect to the internet, you may need to run these
programs to fix the connection.

They are available here:

http://www.cexx.org/lspfix.htm

and

http://www.tacktech.com/pub/winsockfix/WinsockFix.zip

Directions for the last program can be found here:
http://www.tacktech.com/display.cfm?ttid=257

Note: You'll only need to run these programs in the event
that removal of the evil programs causes some good
components to break. Otherwise, you can safely continue:

Next, we'll get CWShredder. This neat program catches
variants which may have been missed by AdAware. CWShredder
is available from:

http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Once again, be sure to update it to ensure the latest threat
protection.

Lastly, you may find it necessary to rename your HOSTS file.
This step is used if you find yourself unable to connect to
specific sites. Instructions can be found here:
http://support.honour.ca/ldbh.solutions.php#blockers

The above procedures should help you remove these programs
and return your computer to a functional state.

More information about Adware and Spyware is available here:

http://mvps.org/winhelp2002/unwanted.htm

Once you are finished, you are encouraged to run a full system scan with your
antivirus product to ensure that you also clean up and virii which may be on
your computer.

Best regards,

Altrus




: Okay -- I am not sure what is wrong. I have run spybot and spyhunter and
: nortin antivirus.
:
: Whenever I perform a Yahoo search (or google) for a name that I KNOW has a
: website, I get junk as a result. I can perform the same search at work on
: IE6 and get the correct response. What is wrong? Is this a hijack?
:
: Obviously, my children are unable to perform any research searches, becaues
: the results are not what they need!
:
: HELP!!!
:
:

 

[Jan Il]

Hi Cheri

It sounds like you have a hijacker. Do the following:

First, download, install and run this program:
CWShredder: Free
http://www.majorgeeks.com/download4086.html

The do the following. Even if you have already run some programs, run them
again according to the instructions in the information below to thoroughly
clean you system. Some variants of malware can replicate itself and return
repeatedly if not cleaned properly. It is best to read through all the
information before you start to know before hand what you need to do and
how. Follow all instructions to letter as much as possible.

WARNING>>>> Backup all documents and files before removing any spyware!!

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx
What you can do about spyware and other unwanted software
http://www.microsoft.com/athome/security/spyware/spywarewhat.mspx
Most importantly, be sure to run CWShredder here
http://www.majorgeeks.com/download3019.html
Also this program searches for hidden .dlls that recreate the malware.
About Buster:
http://www.majorgeeks.com/download4289.html
Then visit these two sites to test for parasites and help basic cleaning:
On-Line Check
http://aumha.org/a/noads.htm
and
Quick-Fix Protocol.
http://aumha.org/a/quickfix.php
Basically, throw everything here at your "infection".

Also very important, be sure to use the HijackThis. Please DO NOT post your
log to this
newsgroup, but to the HiJackThis Support Forums below:
http://www.hijackthis.de/forum/forumdisplay.php?f=10&guestlanguageid=4
the Aumha HiJackThis Forum
http://forum.aumha.org/viewforum.php?f=30
or Bleeping Computer Forum
http://www.bleepingcomputer.com/forums/forum22.html
to allow the experts there to evaluate your log and advise you of any
necessary steps to clean your system.
(Note: You will have to Register before posting on these Forums. Please
follow all posting instructions carefully to avoid having your log deleted
or ignored.

CAUTION!!!!! Before you try to remove spyware using any of the programs
below, download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

You should also get a copy of WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also... From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)
or Winsock Fix Utility
http://www.dfwonline.net/files/WinsockFix.zip

Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm