fucking spyware hijacked my google!

Printable View

May 26th, 2004, 04:03 PM
Drau

I've had problems lately to at home and work.

I've got SpybotS&D going and Norton IS; and i still get that crap.

What did you end up using Jor? Hopefully something free?
May 26th, 2004, 04:10 PM
aspawnfan

I talked to McTwitch last night and he has the same problem. Adware and also some kind of worm that keeps digging it's way back in. So he's down for the time being because they were not able to get rid of them with Mcafee.
May 26th, 2004, 04:16 PM
chaserfan

thanks for scaring me and making me remember to run my spybot search and destroy. had four or five things on there, but they destroyed them. that stuff sucks!
May 26th, 2004, 04:26 PM
Drau

Thanks, CM. I've got those installed at work and will do at home.
May 26th, 2004, 04:31 PM
EndQuest

http://www.mnsi.net/~jhlavac/security/spyware.htm
May 26th, 2004, 04:32 PM
Joranthalus

Quote:

Originally posted by Drau:
I've had problems lately to at home and work.

I've got SpybotS&D going and Norton IS; and i still get that crap.

What did you end up using Jor? Hopefully something free?

CWShredder got it on the first try [img]smile.gif[/img]

Chet, yeah, i'm sure he knows nothing about it
[img]graemlins/hmmm.gif[/img]

baimun, I'm just utterly shocked and appalled that it was on my machine... MY machine... These people don't know who they're fucking with! [img]biggrin.gif[/img]
May 26th, 2004, 04:37 PM
Thew

Bazooka Spyware Scanner
the best one
scans the comp in less than 3 seconds
find a whole bunch a shit and tells ya how to uninstall it
May 26th, 2004, 04:43 PM
Joranthalus

also used Bazooka... USELESS!

I already posted the program that is capable of repairing this...

I'm fairly familiar with computers... [img]wink.gif[/img]
May 26th, 2004, 04:50 PM
chaserfan

how do you know this stuff is on your pc?
May 26th, 2004, 04:51 PM
Joranthalus

in this case, it hijacks my browser when i do searches on google, also so the transmissions in a netstat that were going somewhere else...
May 26th, 2004, 04:56 PM
chaserfan

when it hijacks you, where does it take you?
May 26th, 2004, 04:58 PM
baimun

On obvious thing is that instead of blank 404 page not found errors, you end up at a search engine or domain registration.

If you start ending up at the same place regardless of which bogus address you're typing then it's probably your pc that's redirecting.
May 26th, 2004, 05:02 PM
chaserfan

there should be a law against this. and what do they gain by doing this?
May 26th, 2004, 05:11 PM
Joranthalus

they bring your traffic to their site...
May 26th, 2004, 05:14 PM
Drau

Thanks, Jor. Is this the "homepage" for it?

http://www.spywareinfo.com/~merijn/downloads.html

Chaser, what i was seeing for a while is if the page was a little slow on loading, it would redirect me to a search engine i'd never seen or used before.
May 26th, 2004, 05:15 PM
Darkest Angel

...I wanted to say...

WE ARE OFFERING SUPER LOW INTEREST RATES!!! ON YOUR NEXT
<marquee>PENILE ENLARGEMENT!</marquee>

SEXXXY Mortgages!!!

Just call our super-hot, barely 18 operators!!! Also ask about cheap prescriptions and bust enhancement opportunties!!!

Don't miss out on this FANTASTIC OPPORTUNITY!!!

Your chalmy will NOT regret it!
May 26th, 2004, 05:58 PM
Joranthalus

De'z bitches fuck anything and every thing at www.hotbitches.com !!!!
Checks it outz yo' !!!!!

Drau, that's them [img]smile.gif[/img]
May 26th, 2004, 06:10 PM
Cemetery Can

Quote:

Originally posted by Drau:
Thanks, CM. I've got those installed at work and will do at home.

No prob, Drau. Since I began using those I get alot less garbage picked up in Adaware.

FYI- Make sure AdAware's always set to "deep scan", though I think it's a default setting nowadays when it's installed.

(and the rest of this info is for everyone here in general)
I also recommend HijackThis, though be warned that it picks up even normal programs. But most of them would be familiar to anyone, like a Nvidia file or such. There's a few spyware forums where people post their HijackThis logs for experts to look at and diagnose. Chances are others have had the same problems, so you can just view the archives for info.

I learned a TON more about all of this in late April when I had a sudden Trojan& Spyware attack one day. Even became reallll accustomed to regedit.

Another program called Process Manager gives a you a more broader layout than Task manager. It even labels many of the program files that are running, so you know if they're legit or not.

Really if there's anything questionable running I'd just do a yahoo search on the exact filename, there's many pages out there that list & describe the processes.

Of course, with AdAware, Spybot, SpywareBLaster, Spyware guard, etc always make sure to check for updates! Some of those programs usually have routine updates abounding regularly, along with an easy button or toolbar to instantly start checking for any new reference files.

Edit: Links for SpywareBlaster and SpywareGuard-
http://www.javacoolsoftware.com/sbdownload.html
http://www.javacoolsoftware.com/sgdownload.html
These also alert you if your browser is trying to be hijacked as well. At least I tried this on a friend's machine, and a popup warned that the homepage was attempting to be changed, and you can stop it right there.

[ May 26, 2004 03:16 PM: Message edited by: Cemetery Man ]
May 27th, 2004, 12:24 AM
BENSIN

Download Hijack this, it's the best.
May 27th, 2004, 12:33 AM
Tortricidae

heh..I hate adware. Twice now I've had test stations at work infected by it because dumbass students install shit on the computers. I only have so many PCs set up as test stations, so if I get a larger than usual number of people coming to test, I need every single one that I have. The computers obviously can't be used for testing while 20 popups are appearing every minute, but they can't stop students from downloading crap that installs it on there.

I wish the computers that the test delivery software is on could be off limits to everyone but staff, but unfortunately that's not possible.
May 27th, 2004, 01:27 AM
Joranthalus

Quote:

Originally posted by BENSIN:
Download Hijack this, it's the best.

regedit is better [img]wink.gif[/img]
May 27th, 2004, 03:18 AM
Joranthalus

hijacking adware/spyware crap on my computer! MY computer! WTF?!??!?

took me almost 3 hours, 5 utilities, and about 20 reboots to get that shit off of there...

They should go after those idiots like they do virus writers...

I'll teach you to hijack my google! Take 'em out back and shoot 'em like a rabid dog!

Anyway... [img]smile.gif[/img]
May 27th, 2004, 03:23 AM
pairadocs

Ad-Aware and Spybot - all you need (usually).

I used to deal with that at work all the time - helping remove spyware from people's PCs.

I'll tell you what I told them... stay off the porn sites! [img]wink.gif[/img]
May 27th, 2004, 03:25 AM
-megalithanod

You need to fire the gujy at the gate!

I hate the local news site for finding some way to bypass the ability to prevent IE from launching locally. They have it opening another window, modifying the registry, and allowing their own designed pops to show. Everytime I get rid of it, it comes back next time.

Shame, as they have the best rader in the area for weather.
May 27th, 2004, 03:27 AM
Joranthalus

Quote:

Originally posted by pairadocs:
Ad-Aware and Spybot - all you need (usually).

I used to deal with that at work all the time - helping remove spyware from people's PCs.

I'll tell you what I told them... stay off the porn sites! [img]wink.gif[/img]

Tell me more of these com PU ters of which you speak... [img]eek.gif[/img]

Nope, those and spysweeper wouldn't take care of it. USELESS!

CWShredder

mega, i'll do worse than that! I'll send him out to lunch! [img]biggrin.gif[/img]
May 27th, 2004, 03:30 AM
pairadocs

Ah, CoolWebSearch... I've had to clear that one... yeah, that one's a bitch. That's the only one I've come across that need a separate app that wasn't fixed by Ad-Aware or Spybot.

Fargin' Bastidges.
May 27th, 2004, 03:40 AM
baimun

Jor... I think I had that same one on our CAD machine... I ended up having to disable just about everything in the startup registry and THEN run the Anti-Spyware stuff to remove it. One of the spam software pieces was disguising itself as a SVCHOST.exe file. Normall you have 3-5 of those running in your processes... the cad machine was crashing because there were about 12 running. [img]eek.gif[/img]
May 27th, 2004, 03:42 AM
thatchetguy

And then it screws up your DNS settings, and can totally keep you off the internet. I've had to reload Windows to restore those settings for a few clients.

And the guy at CoolWebSearch says he has no idea how that spyware got out with his address...
May 27th, 2004, 03:59 AM
Cemetery Can

Be sure to download SpywareBlaster and SpywareGuard too.
May 27th, 2004, 11:28 AM
Joranthalus

that's just it! I have no idea, haven't been to any fucked up sites, haven't installed any free/shareware... this one was evil...
May 27th, 2004, 11:56 AM
Tr3s

Do you think it's Sandy? [img]eek.gif[/img]

You know, she could be that no-clue-on-the-outside-but-pure-evil-genius-in-the-inside type of manic-schizoid chick. Ya never know... crispy creepies!
May 27th, 2004, 12:29 PM
Cemetery Can

Quote:

Originally posted by Joranthalus:
that's just it! I have no idea, haven't been to any fucked up sites, haven't installed any free/shareware... this one was evil...

Same with me when I got hit. No shareware, nothing new downloaded period. It was either a google search, running into a wrong URL that's replaced with a domain name holder (those are the ones who at times ask "Would you like to set your homepage to so-and-so.com?") or more likely some evil Lycos site, not sure. Lycos itself likes to install BHO's.

Most of the cookies or files my spy stuff would pick up would be unwanted Search tools, Weatherbug, or E-commerce crap.
May 27th, 2004, 12:36 PM
Cemetery Can

Quote:

Originally posted by Joranthalus:
<blockquote>quote:<hr />Originally posted by BENSIN:
Download Hijack this, it's the best.

regedit is better [img]wink.gif[/img] <hr /></blockquote>Regedit's great, but hijack this saves more time when searching for and removing typical spyware. I still use regedit alone regardless at times, but no harm in a little extra help.

There's a program called Registry Mechanic which goes beyond even spyware searches to find any leftover or bad crap in the registry. Only it's not free and the demo has a limited search function.
May 27th, 2004, 12:50 PM
Joranthalus

I just like digging through the registry. it's like brain surgery [img]smile.gif[/img]
May 27th, 2004, 01:08 PM
Halitosis Crunch

My registry is a mess.

I can't stand how fast all the spyware piles up, even when not surfing for porn. [img]tongue.gif[/img]
It's worse than spam ten fold.
May 27th, 2004, 03:35 PM
Tr3s

jor: how the hell was it possible that your machine got hijerked? does it mean that you're not a god anymore? [img]confused.gif[/img]