Spyware that won't go away - Tilted Forum Project Discussion Community

Kadath · 01-05-2004, 06:53 AM

Tech specs: Win2k and IE.
My friend has web-based school email as his home page. Whenever he logs in, he is taken to an ad screen. If he hits back, he is logged in and on his mail screen(ie, inbox). His homepage is reset by this action to some search engine. We have used both Ad-Aware and another spybot destroyer(in that order, and the second thing found more, which makes me unhappy about ad-aware) but the problem remains. However, it does not happen when he uses another home page, such as Yahoo. Okay, we think, it's the page. Nope. Doesn't happen on mine. So our current hypothesis is that there is an extraneous registry value associated with PHP or some such that the school's web email uses. We are reaching out to other resources, but I thought I'd look here. Thoughts?

cheerios · 01-05-2004, 02:59 PM

might help to konw what search engine the page re-directed to...

NbCal · 01-05-2004, 03:24 PM

Might wanna try CWshredder. You can read about it Here. The link to download it is at the bottom of that page, under Epilogue.

Addiction · 01-06-2004, 12:08 AM

Install an anti-virus program, install Spybot Search and Destroy, reboot in safe mode, and scan with both. If neither of them work, it may be time for a reformat.

nanofever · 01-06-2004, 07:00 PM

Quote:

Originally posted by Addiction
Install an anti-virus program, install Spybot Search and Destroy, reboot in safe mode, and scan with both. If neither of them work, it may be time for a reformat.

Ditto, also run a good anti-trojan like trojan hunter.

Kadath · 01-06-2004, 08:48 PM

Thanks for your help, all.

Finchie · 01-06-2004, 09:44 PM

Try using a program called HijackThis here : http://mjc1.com/mirror/hjt/. It looks at the registry and hard drive and lets you enable/disable certain processes. It also lets you export a text file which contains a list of services. Just post one of those logs onto the forums in the link at the top and people can show you what you need to disable.

01-05-2004, 06:53 AM	#1 (permalink)
Kadath Muffled Location: Camazotz	Spyware that won't go away Tech specs: Win2k and IE. My friend has web-based school email as his home page. Whenever he logs in, he is taken to an ad screen. If he hits back, he is logged in and on his mail screen(ie, inbox). His homepage is reset by this action to some search engine. We have used both Ad-Aware and another spybot destroyer(in that order, and the second thing found more, which makes me unhappy about ad-aware) but the problem remains. However, it does not happen when he uses another home page, such as Yahoo. Okay, we think, it's the page. Nope. Doesn't happen on mine. So our current hypothesis is that there is an extraneous registry value associated with PHP or some such that the school's web email uses. We are reaching out to other resources, but I thought I'd look here. Thoughts? __________________ it's quiet in here

01-06-2004, 08:48 PM	#6 (permalink)
Kadath Muffled Location: Camazotz	Thanks for your help, all. __________________ it's quiet in here

01-05-2004, 02:59 PM	#2 (permalink)
cheerios Banned Location: 'bout 2 feet from my iMac	might help to konw what search engine the page re-directed to...

01-05-2004, 03:24 PM	#3 (permalink)
NbCal Tilted Location: Newport Beach, CA	Might wanna try CWshredder. You can read about it Here. The link to download it is at the bottom of that page, under Epilogue.

01-06-2004, 12:08 AM	#4 (permalink)
Addiction Tilted Location: Sydney, Australia	Install an anti-virus program, install Spybot Search and Destroy, reboot in safe mode, and scan with both. If neither of them work, it may be time for a reformat.

01-06-2004, 09:44 PM	#7 (permalink)
Finchie Tilted	Try using a program called HijackThis here : http://mjc1.com/mirror/hjt/. It looks at the registry and hard drive and lets you enable/disable certain processes. It also lets you export a text file which contains a list of services. Just post one of those logs onto the forums in the link at the top and people can show you what you need to disable.