browser windows go haywire with popups

  • Thread starter Thread starter mr_cowboy1
  • Start date Start date
M

mr_cowboy1

I'm hitting my head against the wall here. I've gone
through the registry and tweaked the internet explorer
settings to clear out search and home pages. I've gone in
the registry startup and the startup group and taken out
things that I know shouldn't be running. When I fire up
internet explorer, something resets my homepage and search
pages. my homepage is set to "about:blank" which ends up
being some sort of search engine with no viewable source.
and the search page gets changed to something random.
What do I need to do to try and stop what is happening.
Everytime I do this, I reset it, then run the browser and
everything resets. I've run adaware v6, mcafee, and there
are not virus' and no more ads. HELP!!!!!!!!!!!!!!!!!!
 
mr_cowboy1 said:
I'm hitting my head against the wall here. I've gone
through the registry and tweaked the internet explorer
settings to clear out search and home pages. I've gone in
the registry startup and the startup group and taken out
things that I know shouldn't be running. When I fire up
internet explorer, something resets my homepage and search
pages. my homepage is set to "about:blank" which ends up
being some sort of search engine with no viewable source.
and the search page gets changed to something random.
What do I need to do to try and stop what is happening.
Everytime I do this, I reset it, then run the browser and
everything resets. I've run adaware v6, mcafee, and there
are not virus' and no more ads. HELP!!!!!!!!!!!!!!!!!!
Click to expand...

Ad-aware can't find all the spyware, try other spyware removers also:

http://www.geocities.com/googlepubsupgenfaq/#spyware
 
I'm hitting my head against the wall here. I've gone
through the registry and tweaked the internet explorer
settings to clear out search and home pages. I've gone in
the registry startup and the startup group and taken out
things that I know shouldn't be running. When I fire up
internet explorer, something resets my homepage and search
pages. my homepage is set to "about:blank" which ends up
being some sort of search engine with no viewable source.
and the search page gets changed to something random.
What do I need to do to try and stop what is happening.
Everytime I do this, I reset it, then run the browser and
everything resets. I've run adaware v6, mcafee, and there
are not virus' and no more ads. HELP!!!!!!!!!!!!!!!!!!
Click to expand...

IIRC, the about:blank hijacker is a CWS variant. You need CWShredder.

First, download LSP-Fix and WinsockXPFIx from <http://www.cexx.org/lspfix.htm>,
and CWShredder from <http://www.majorgeeks.com/download4086.html>. All are
free.

Next, close all Internet Explorer and Outlook windows, then run CWShredder.
Have it fix all variants.

Now check for, and remove, spyware. Get HijackThis
<http://www.majorgeeks.com/download.php?det=3155> and Spybot S&D
<http://www.safer-networking.org/index.php?page=download>. Both free.
1) Install and run Spybot. First update it ("Search for updates"), then run a
scan ("Check for problems"). Trust Spybot, and make all recommended deletions.
2) Install and run HijackThis. Do NOT make any changes immediately. Save the
HJT Log.
3) Have your HJT log interpreted by experts at one or more of the following
forums (and post a link here to your post there please):
<http://forums.net-integration.net/>
<http://www.spywareinfo.com/forums/>
<http://forums.tomcoyote.org/>
<http://www.wilderssecurity.com/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

And please don't contribute to the spread of email address mining viruses.
Learn to munge your email address properly, to keep yourself a bit safer when
posting to open forums. Protect yourself and the rest of the internet - never
post your address unmunged.
http://www.mailmsg.com/SPAM_munging.htm

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
 
it says that the website wwww.cexx.org doesn't exist.
Click to expand...

You must have a dns hijack. Substitute "216.127.70.106" for "www.cexx.org".

Search your entire system drive, including hidden and system folders, for file
"hosts". There is one legit copy, in C:\WINDOWS\system32\drivers\etc\. The
others are bogus, and part (but just part) of the problem. Also, examine the
contents of the legit copy, using Notepad, too.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
 
well, I gave up on trying to get it fixed. nothing recommended worked. re-installed the OS to a different directory and re-installed the apps. it was a pain, but wasted too much time trying to figure it out. sorry Ic ouldn't shed light on a miraculous cure.
 
the stigma goes on. I've just got another pc with a browser hijacker on it. I've used cwshredder, hijacker, the winsockxpfix and lpfix, and spysweeper, and spybot search and destroy. there's still something in there resetting explorer homepage to http://greatbiz.cc or something like that. how can I find out where, or what module in windows is resetting this. there isn't a running process that I can see that doesn't appear like it belongs. I've virus scanned with the latest mcafee engine and dat files, and it says there are no virus' and now all the spy crap and hijacker stuff says there is nothing wrong. but obviously there is. any other hints on where I can look

Paul
 
the stigma goes on. I've just got another pc with a browser hijacker on it. I've used cwshredder, hijacker, the winsockxpfix and lpfix, and spysweeper, and spybot search and destroy. there's still something in there resetting explorer homepage to http://greatbiz.cc or something like that. how can I find out where, or what module in windows is resetting this. there isn't a running process that I can see that doesn't appear like it belongs. I've virus scanned with the latest mcafee engine and dat files, and it says there are no virus' and now all the spy crap and hijacker stuff says there is nothing wrong. but obviously there is. any other hints on where I can look?

Paul
Click to expand...

Paul,

Did you post your HijackThis log to one of the security forums? HJT requires
expert interpretation. Can you provide a link to your posting?
These are four which I read and use. There are others too:
<http://forums.net-integration.net/>
<http://forums.spywareinfo.com/>
<http://forums.tomcoyote.org/>
<http://www.wilderssecurity.com/>

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
 
Back
Top