Rxmesa and Ezanga virus

[MartinC]

I am getting my google and yahoo search engine "hijacked".
When I perform any search, the search results are returned
for a brief moment, then they are re-ordered with a link
to Rxmesa for prescriptions in natural search position
one, then eZanga for "searching" in the first sponsor
search position.

Any ideas?

Martin

 

[Ron Kinner]

Supposedly booting to Safe Mode and running a Full System
Scan (look under Scan Options) has helped some people.

If that doesn't help then get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save then Open it and select the SCAN AND SAVE LOG option.

Note where you save the log and then send it to me as an
attachment. I will be glad to look at it
and tell you what to do to get rid of it for good.


Ron Kinner
Microsoft MVP 2004 & 2005
(e-mail address removed)

 

[Bill Sanderson]

I found this brief thread via a google search:

http://castlecops.com/postp506779.html

In this case, the poster found that Microsoft Antispyware cleaned this for
him, it appears to me--but you may find some of the specifics mentioned
useful. Try using the system explorers to spot startup items that may be
keeping this spyware going.

If you do a text search on the page the URL brings up--on the key
MSTEXT--you will see the various locations this critter is listed in a
HijackThis log. If you don't find this precise name, look for something
perhaps similar, in a parallel set of locations.

 

[Steve Dodson [MSFT]]

Please submit a suspected spyware report to us with details on this issue.

--
-steve

Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.