Browser Hijack Nightmare!! HELP!!!
Last night I installed Windows XP SP2 (Beta) and Windows Media Player 10 just to see how they work. Guess what, as soon as i finish checking things out (the firewall settings, etc. ) the internet explorer ended up with two spyware.
Last night I installed Windows XP SP2 (Beta) and Windows Media Player 10 just to see how they work. Guess what, as soon as i finish checking things out (the firewall settings, etc.) the internet explorer ended up with two spyware. One i could remove (MySearchBar) and the other one i'm stock with and i can't figure out how to remove it.
I have uninstalled SP2 since I kept getting spywares from any site i visited!!! or it seemed like it. got rid of SP2 and it's all back to normal.
it changes my homepage to about:blank, but there is "Search for..." page as my hompage, few suspecious items are added in favorites, and NOTHING PICKS THE DAMN THING UP! ;(
I used Adaware and spybot, and "Spyware Nuker"(??) which picked it up as Slotch XXX Toolbar, but it is not correct because my computer does not contain non of the components they mention in the removal instructions for that "thing". (there is no actual TOOLBAR, Nothing in add/remove programs, and the reg. keys they mention don't match, and there is no tinybar.exe anywhere on any of my HDDs).
If i get my hands on the basturds who make such pains i'll choke them to death!!! they dont even dare to put a contact link or company name, or copyright, or anything in there. Basturds. ;(
Please somebody help!!!!!!!
I have uninstalled SP2 since I kept getting spywares from any site i visited!!! or it seemed like it. got rid of SP2 and it's all back to normal.
it changes my homepage to about:blank, but there is "Search for..." page as my hompage, few suspecious items are added in favorites, and NOTHING PICKS THE DAMN THING UP! ;(
I used Adaware and spybot, and "Spyware Nuker"(??) which picked it up as Slotch XXX Toolbar, but it is not correct because my computer does not contain non of the components they mention in the removal instructions for that "thing". (there is no actual TOOLBAR, Nothing in add/remove programs, and the reg. keys they mention don't match, and there is no tinybar.exe anywhere on any of my HDDs).
If i get my hands on the basturds who make such pains i'll choke them to death!!! they dont even dare to put a contact link or company name, or copyright, or anything in there. Basturds. ;(
Please somebody help!!!!!!!
Participate on our website and join the conversation
This topic is archived. New comments cannot be posted and votes cannot be cast.
Responses to this topic
I have the same browser problem only mine started as "mukeh.dll" and kept changing to some weird stuff. I tried to go to the registry and deleting the keys but after 15 or so minutes it just comes back, which leads me to believe a program (hidden of course) is installing it.I have run ad-aware, spybot, avg antivirus, panda, nortons none pick it up and i think is it a very well executed pain in the a..... funny enough i have picked through my whole system32 folder (cause one antivirus program told me that was where it was)file by painstaking file and found only one program called "loader" I deleted it, rebooted and..........."PRESTO" there was old faithful "mukeh.dll" running my sh....... So Ali i feel you bro thought i knew a little sumptin sumptin about computers but this one almost has me tossing it out the window.
peace y'all and God Bless whoever comes up with the answer
peace y'all and God Bless whoever comes up with the answer
I was having similar problems on a work computer and a found a file called "jushed32.exe" or similar. I stopped it and renamed it and since then, no more problems.
I have a simplem rule regarding programs:
"If there's no Author's information etc on the .exe when I right click on the file, it gets shut down and deleted. If they don't have the integrity to put their name on it, blow it away.
I have a simplem rule regarding programs:
"If there's no Author's information etc on the .exe when I right click on the file, it gets shut down and deleted. If they don't have the integrity to put their name on it, blow it away.
Good rule. You might also check to see if it deleted the program: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogon.exe
That file is part of the Bizten family of Trojans. It also plays fast and furious with IE's toolbars so you might also want to check the following Registry keys:
HKLM\Software\Microsoft\Internet Explorer\Main\Search Bar
HKLM\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\Software\Microsoft\Internet Explorer\Main\Search Page
HKLM\Software\Microsoft\Internet Explorer\Main\SearchURL
HKLM\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKLM\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKLM\Software\Microsoft\Internet Explorer\TypedURLs\url1
HKCU\Software\Microsoft\Internet Explorer\Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Main\SearchURL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url1
That file is part of the Bizten family of Trojans. It also plays fast and furious with IE's toolbars so you might also want to check the following Registry keys:
HKLM\Software\Microsoft\Internet Explorer\Main\Search Bar
HKLM\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\Software\Microsoft\Internet Explorer\Main\Search Page
HKLM\Software\Microsoft\Internet Explorer\Main\SearchURL
HKLM\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKLM\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKLM\Software\Microsoft\Internet Explorer\TypedURLs\url1
HKCU\Software\Microsoft\Internet Explorer\Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Main\SearchURL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url1
Originally posted by Sampson:
Quote:A browser helper object (BHO) does not always appear as a toolbar but does get invoked whenever you bring up IE or those browsers that use IE components.
Download BHODemon2.0 (it's free) and it will tell you what BHO's exist (and you can disable them). It will also tell you if something is changing your homepage or writing a value in your registry.
Spywareguard (also free) also protects your homepage.
SpywareBlaster (also free) will load dozens of sites known to infect systems and keep them from running.
Finally, PestPatrol (not free but reasonable) will do a better job than most in finding pests, spyware, and the like. It runs in memory after installed and will alert you if something is being installed.
Spyware Stopper is "free" until you need to update virus definitions. You get one free update, then you will have to pay a yearly subscription.
Sampson,
Can you please tell me where i can download BHODemon2.0. I can't find it anywhere. do you have a link that you can send me. I really need this program. please help. thank you.
Quote:A browser helper object (BHO) does not always appear as a toolbar but does get invoked whenever you bring up IE or those browsers that use IE components.
Download BHODemon2.0 (it's free) and it will tell you what BHO's exist (and you can disable them). It will also tell you if something is changing your homepage or writing a value in your registry.
Spywareguard (also free) also protects your homepage.
SpywareBlaster (also free) will load dozens of sites known to infect systems and keep them from running.
Finally, PestPatrol (not free but reasonable) will do a better job than most in finding pests, spyware, and the like. It runs in memory after installed and will alert you if something is being installed.
Spyware Stopper is "free" until you need to update virus definitions. You get one free update, then you will have to pay a yearly subscription.
Sampson,
Can you please tell me where i can download BHODemon2.0. I can't find it anywhere. do you have a link that you can send me. I really need this program. please help. thank you.
