Can't get rid of Browser Hijacker . Need help

[Leha]

Hi . Since I've installed fast internet at home , I've learned how to protect myself of irritating malicious S**t that overwhelm the web . But there is one problem I can't solve , may be one of you can help .

Problem description : I have file somwhere in my PC which installs browser hijacker ( redirects my start page to porn search site ) every time I restart . I run Ad-aware , this great software finds 3 registry entries containing this bastard and cleans them , but it doesn't find source . McAfee antivirus doesn't find it either . Spybot doesn't find it . All of the above programs are constantly updated .
May be someone knows other anty-spy-ad-ware that can help ?

Thanks in advance .

Happy New Year .

 

[Turner]

Have you tried www.pcpitstop.com? They might be able to tell you where it is and how to remove it.

Other than that, I dunno. . .

 

[ainwood]

Do you have the latest definition file for adaware? (if not, use the 'check for updates' thingy.

Secondly, run Spybot Search and Destroy in parallel - it gets things that adaware doesn't, and vice-versa.

Also, do yo have a firewall? That might help too (although this does sound like a crappy program on your PC )

 

[Leha]

Turner , I will try it , thanks ( although , as far as I know , Ad-aware + Spybot are the best )

Ainwood , i tried everything you mentioned ( with updated software ) , and I do have firewall . BTW , if I permit eMule to connect to my PC , can other file ( trojan for one ) use eMule like "train" ?

 

[Turner]

It is technically possible that a trojan can find a common program and decide to use that to back-door through a firewall. I think it would have to be some pretty nifty code tho.

I do know that pcpitstop will tell you if you have a virus. It might tell you if you have a trojan. . . but I don't recall that from their site. Could be, tho.

Good luck. . . one sure way to get rid of it is to reformat your drive. But that's pretty drastic. . .hope you don't end up having to do that.

Never heard of emule. . . what is that?

Edit: From the pcpitstop main page:

Run PC Pitstop's full test suite now! Here's what we check:

* Disk Fragmentation Analysis
* System Resource Analysis
* Device Driver Analysis
* CPU Benchmark Test
* Video Benchmark Test
* Memory Benchmark Test
* Detailed System Inventory
* Spyware Check
* In-Memory Virus Check
* Internet Download Performance
* Internet Upload Performance
* Internet Ping Test
* Internet Security Test

So they do virus checks, but not trojans. Not sure where you could go to check that.

Where's Jeritain when you need him? He'd know this. . . .

 

[Leha]

Originally posted by Turner_727

Good luck. . . one sure way to get rid of it is to reformat your drive. But that's pretty drastic. . .hope you don't end up having to do that.

No way . I'd better live with this porno-madness

eMule is sharing software . Like kazaa with some differences .

 

[Zwelgje]

A collegue of mine had something similar once at his work PC.
Anyway, I fixed it like this:
- I used Microsoft system info to check all active tasks and looked what suspicious programs were running
- I checked whether or not the suspicious programs were true bad boys or just programs that should be on the PC (you can do this by using google, you will get links to sites that will show you how to delete the bad stuff too!)
- CTRL-ALT-DEL to show all the running processes and terminate that program that you suspect is the cause of your problem.
- Use the search function to find that program and delete it.

Hope this helps.

 

[Turner]

msinfo32, when ran from the Start/Run command, will also give you the location of the programs that are running. Location being the spot on the hard drive. After loading it, go to Software Environment/Running Tasks, and it will display this information. Of course, you can't exit out of the program here, but it tells you what's running, and where on the hard drive it is.

Don't know why I didn't think of that earlier. Zwelgje reminded me with his post.

 

[Comraddict]

Originally posted by Zwelgje
A collegue of mine had something similar once at his work PC.
Anyway, I fixed it like this:
- I used Microsoft system info to check all active tasks and looked what suspicious programs were running
- I checked whether or not the suspicious programs were true bad boys or just programs that should be on the PC (you can do this by using google, you will get links to sites that will show you how to delete the bad stuff too!)
- CTRL-ALT-DEL to show all the running processes and terminate that program that you suspect is the cause of your problem.
- Use the search function to find that program and delete it.

Hope this helps.

That is what PCPitstop will do for you. Their scan will show all programs running and what are they for.

MY opinion: install Google Toolbar or install Mozilla Firebird when you look porn sites

 

[Leha]

Originally posted by Comraddict



That is what PCPitstop will do for you. Their scan will show all programs running and what are they for.

MY opinion: install Google Toolbar or install Mozilla Firebird when you look porn sites

I got this hijacker not from a porn site . It was kazaa .( of course that doesn't mean I never visited porn-site )

 

[Leha]

Originally posted by Turner_727
msinfo32, when ran from the Start/Run command, will also give you the location of the programs that are running. Location being the spot on the hard drive. After loading it, go to Software Environment/Running Tasks, and it will display this information. Of course, you can't exit out of the program here, but it tells you what's running, and where on the hard drive it is.

Don't know why I didn't think of that earlier. Zwelgje reminded me with his post.

Ran PCPitstop . It said my PC is clean

Well , there's only one option left . I will clean PC with ad-aware after each restart .

 

[blackhalo15]

go to www.trendmicro.com, and from there go to personal, and do a free scan, because I was having the same problem you are having, and it found a virus called java.byteverify, and when I got rid of it, everthing was fine.

 

[Leha]

Originally posted by blackhalo15
go to www.trendmicro.com, and from there go to personal, and do a free scan, because I was having the same problem you are having, and it found a virus called java.byteverify, and when I got rid of it, everthing was fine.

Hey !! THANKS !!! Fantastic ! Unbelievable !

Updated McAfee couldn't find this sucka .

Guys if anyone has the same problem , go to trendmicro .
I had malicious browser redirector REG_WINSHOW.A
It was stored in C:\WINDOWS\sys.reg
I deleted file and , voila .. PC is clean after restart .

Thanks , blackhalo

 

[hbdragon88]

Originally posted by Turner_727
It is technically possible that a trojan can find a common program and decide to use that to back-door through a firewall. I think it would have to be some pretty nifty code tho.

This is why ZoneAlarm is useful. It finds a program's MD5 signature and if the MD5 signature has changed (trojan trying to pass itself off as a legit program or upgrades) when trying to access the Internet, ZA warns you.

 

[Pongui]

After manually deleting nasty files, one should reboot and immediately run a registry checker/cleaner. This will identify otherwise buried registry entries made by the nasty, because they now refer to nothing. Remove them.