hijacked

[Shayne]

when i search google, or even in regedit an internet
explorer window will launch and attempt to take me to
either www.loadingwebsite.com or 64.192.130.141 Or if i
do a search for eg "party poker" then it will launch
popup add for party poker, anothe eg is if i open regedit
it will giv e me ads for registry cleaners.

I traced some back to ad median llc, ad server, and
loadingwebsite.com, all seem to be connected in some way

I have run nis 2005, ms spyware, adaware, spybot s & D
and hijack this with no success.

 

[Steve Dodson [MSFT]]

Does the browser restore work for you? You can access this in Advanced
tools.

--
-steve

Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

 

[Bill Sanderson]

Steve forgot:

Please do a Tools, Suspected spyware report!

If the brower settings restore doesn't keep this changed, I'd recommend
HijackThis and Ron Kinner's services--look for a message from him for
details.

 

[Ron Kinner]

Shayne sent me a HijackThis log. It's one of those
winlogon bugs that booting into Safe Mode won't stop.
Looks like AntiSpy almost got it all but not quite:

O18 - Filter: text/html - {950238FB-C706-4791-8674-
4D429F85897E} - (no file)
O20 - Winlogon Notify: Extensions - C:\WINDOWS\system32
\l66o0gj3e6o.dll (file
missing)
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32
\mcisip.dll
O20 - Winlogon Notify: ShellCompatibility -
C:\WINDOWS\system32\t6r80g9ue6.dll
(file missing)

I suggested using APM and unloading the mcisip.dll from
Explorer and Winlogon and then HijackThis/check/FixChecked
and ccleaner.

Haven't heard back yet if it worked or not.

Ron