Hijacked Homepage

[Frank]

A program has hijacked my home page to
res://aozmp.dll/index.html#96676 and creates annoying pop-
ups. I have followed the website's advice for removing
their programs but I get an error message such
as "Problem with shortcut, unable to open
http://www.looking-for.cc/uninstall/searchextender.html".

I think it's illegal to put a program on my computer
without consent if they don't supply removal options. Can
anyone help me to find a way to completely get rid of all
these programs from my Windows XP Home Edition PC?

 

[KAS]

Your machine may be/is infected with spyware/malware. Go
get copies of Ad-Aware and Spybot (both free) and run them.
That should clean your machine.

You might want to consider using a different browswer such
as Firefox, Opera, etc. They all have built-in pop-up
blocking so the ads which install this stuff on your system
don't even appear.

Another option might be to get Googles Toolbar which also
has built-in pop-up blocking.

 

[Frank]

I have both and have run them both. Every time I do so,
they both find the problems and the malicious activity. I
select remove and for about thirty seconds my webpage is
reset to msn.com. Then the problem comes back and the
website is reset. I have done a full system scan and
removed all registry references. Every system file that
seems suspicious is now deleted. Still, the problem comes
back. Is there anything, short of reformatting my C:
drive, that will solve the problem?

Frank

 

[Jim Byrd]

Hi Frank - I'm informed that the 01R325 AdAware update of 6/28 or later
supposedly completely removes this for some variants/malware
implimentations; however, I haven't been able to independently verify this
and have also heard contrary info. Try it first (from Safe mode), and if it
doesn't work then,
See these threads first:
http://www.pchell.com/support/lookfor.shtml and
http://www.pchell.com/support/onlythebest.shtml for manual removal
instructions
http://zerosrealm.com/index.php?page=dllfix (Read very
carefully!)http://forums.spywareinfo.com/index.php?showtopic=7447
http://forums.spywareinfo.com/index.php?showtopic=7261
http://forums.spywareinfo.com/index.php?showtopic=7281


Then from merijn, here: <http://www.spywareinfo.com/~merijn/index.html>


June 18, 2004:
Please stop emailing me about the new CWS variant that hijacks you to
res://<random>.dll/sp.html#96676. I am aware of this new thing, but it's a
beast to remove.
A solution is being worked on, see this thread on the SWI forums
<http://forums.spywareinfo.com/index.php?showtopic=7447>.

If it's not working for you, or it's too complicated, I heard from several
people that this workaround works as well:
Open the DLL you get hijacked to in Notepad
Select all content (Ctrl-A) and delete it
Save the file and exit Notepad
Find the file in Explorer, right-click it, select Properties, put a
checkmark in 'Read-Only' and click OK.
If you can't find the DLL file, make sure your settings allow you to view
"Hidden files". Open up any explorer windows and click on "Tools", "Folder
Options", "View" and be sure to check off "Show Hidden Files and Folders".


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Guest]

Mr Byrd, you are a god amongst men. I had a friend who
used to work for NASA working on this problem and even he
couldn't solve it. In the end I followed the procedures
from your second thread. It was my exact problem and I
fixed my PC in ten minutes. I can't thank you enough. I
want to shake your hand and buy you lunch because you've
helped me so much. Thank you so much. You are nothing
short of a genius and a lifesaver.

Sincerely,

Frank Lonsdale

 

[Jim Byrd]

YW, Frank - Glad it helped. (Thanks for the kind words, too, even though
they're unwarrented. There are many who contribute in these newsgroups -
both MVP's and others - who are far more knowledgeable than I. You just
happened to catch me this round. )

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In