Homepage resetting to unwanted site.

[Roy H]

I believe this is a virus, but my virus scanner ins't
picking up on it. Anyway, my homepage for Internet
Explorer 6.0 (Windows 98) will not stay with what I
choose it to be. It forces itself to be this site....
res://atvrj.dll/index.html#809775909 . I think I've
heard of free software I can download that can remove
these kinds of viruses, but I don't know where to get
it. Are there also alternative methods of fixing this
homepage problem?

Also, a bunch of pop-up ads have started to appear. A
lot of them about buying software to remove spyware. I
assume the two problems are related. Any help would be
very much appreciated.


Thanks

 

[Computer Granny]

Roy H

Sounds like you've got spyware on your pc. I've seen this behavior on a
couple of my clients pc's. Try downloading one of the free spyware apps
like Ad-aware from Lavasoft and run that. Bet you'll find you have a bunch
of them.

Computer Granny

 

[Roy H]

Heh, yeah, I don't doubt it at all. I posted this
question in another group, and ad-aware looks like the
best solution for me. One other question: Spyware, does
it infect your pc all on it's own (like just viewing a
page)? Or, does it require the user to say click an OK
button to get infected? This problem is on my parents'
pc, and I would like to be able to tell them how to avoid
this.

Thanks for the help btw

 

[ricksbiz]

-----Original Message-----
Heh, yeah, I don't doubt it at all. I posted this
question in another group, and ad-aware looks like the
best solution for me. One other question: Spyware, does
it infect your pc all on it's own (like just viewing a
page)? Or, does it require the user to say click an OK
button to get infected? This problem is on my parents'
pc, and I would like to be able to tell them how to avoid
this.

Thanks for the help btw

I have ad aware and that does not remove the unwanted web
site default problem Have you heard of any other way to
correct the problem???

 

[Kelly Cotter]

I have ad aware and that does not remove the unwanted web
site default problem Have you heard of any other way to
correct the problem???

for spyware/adware problems
spyware/adware can be installed by just visiting the webpage
adaware pro and spybot can both help stop this as can changing your active x
controls

download and run these
http://www.lavasoftusa.com/software/adaware/ adaware

http://www.safer-networking.org/index.php?page=download spybot

http://www.safer-networking.org/index.php?page=download cwshredder
also do a full virus scan

 

[Jan Il]

Hi Roy

Check out the information here, I think it will answer your questions.

(Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?kbid=827315)

You can check your computer for 'bugs' here:

DO YOU HAVE PARASITES? Screen for Adware, Spyware, Scumware, Diallers, '
Jackers and other unsolicited commercial software
http://aumha.org/a/noads.htm

This is another very good site for scumware information and how to protect
your PC against these types of warez:

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm


Hope this helps.

Jan

Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.

 

[Jan Il]

Hi ricksbiz

I have ad aware and that does not remove the unwanted web
site default problem Have you heard of any other way to
correct the problem???

Try the following and see if it helps.

New CWS variant that hijacks you to res://<random>.dll/sp.html#96676.

Here are some other links which may shed some extra light:
http://forums.spywareinfo.com/index.php?showtopic=8847
http://forums.spywareinfo.com/index.php?showtopic=7447
http://forums.spywareinfo.com/index.php?showtopic=7261
http://forums.spywareinfo.com/index.php?showtopic=7281

How you know you have it : When you start up Internet Explorer it takes a
few seconds to load and in the address bar it starts with res://<Random
..dll>

Per Merijn - http://www.spywareinfo.com/~merijn/index.html

A solution is being worked on, see this thread on the SWI forums.
http://forums.spywareinfo.com/index.php?showtopic=7447

If it's not working for you, or it's too complicated, I heard from several
people that this workaround works as well:
Open the DLL you get hijacked to in Notepad
Select all content (Ctrl-A) and delete it
Save the file and exit Notepad
Find the file in Explorer, right-click it, select Properties, put a
checkmark in 'Read-Only' and click OK.
If you can't find the DLL file, make sure your settings allow you to view
"Hidden files". Open up any explorer windows and click on "Tools", "Folder
Options", "View" and be sure to check off "Show Hidden Files and Folders".
===================================
These programs will alert you to any changes and let you know the process
that changed them. Let's track everything and get to the bottom of this.

Filemon:
http://www.sysinternals.com/ntw2k/source/filemon.shtml

Regmon:
http://www.sysinternals.com/ntw2k/source/regmon.shtml

Hope this helps.

Jan

Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.