Browser Hijack!

[Moir]

Using Win XP Home and IE Version 6.0.2800.1106.xpsp2.030422-1633IC.

Seems I have been hijacked by

http://searchpage.cc/1525/www.google.com/search

also showing as:

http://nkvd.us/1525/www.google.com/search



when trying to use google search. I have run Adaware (with latest update)
and also SpyBot but neither of these programs have been able to rid me of
the problem.
I would appreciate any assistance from anyone who knows about this problem.
TIA

 

[Gary Tsang]

Hi,

It sounds like you've been hit with some malware/spyware on your computer
and it has hijacked your Internet Explorer and added unwanted items on your
computer.

Visit this website: Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.php

 

[JRL]

Do a regedit. Search for those URLs. Delete the registry entries. Be
careful! You don't want to mess up your registry.

A safer way would be to download something like "reg cleaner", which
searches out strange stuff like that in your registry and allows you to
remove it.

Also, it probably isn't a bad idea to go to "run", type in "msconfig" (you
won't necessarily have this installed though) and check out if the hijack is
in your config settings. Again, don't fiddle with anything without checking
whether it is ok first (doing a google search usually brings up useful info
on DLLs / services that are being loaded)...

JRL
www.mitconsulting.ca

Probably a good idea to email the folks at Adaware to inform them. This is
likely a new one that they haven't seen yet.

 

[Moir]

Thanks Gary, found these two entries under HKEY_CURRENT_USER, Software,
Microsoft and entries Name Search, Type REG_SZ and Data http://nk% etc
and ending with /1525/ PLUS next line showing Name as SearchURL with same
Data entry. I have now removed the Data entries. Will report back after
reboot.

 

[Moir]

DAMN....still happens - (also renamed) the Name in the reg entry! Where to
now???

 

[Willie]

Possibly turn off System Restore, and then do what you need to do(What you
did), then reboot...Turn Sys Restore back on...Don't know, but worth a try.

Willie

 

[Moir]

SUCCESS......

Used CWShredder followed by Ad-aware and the "problem" has now gone.

Thanks for everyone's help.