Some help with a browser hijack??

[Netpiddler]

Ya gotta love scum like this....

I have a browser hijack that is randomly popping traffic trades with the following referrals:

http://www.pussypool.net/?ref=aqua
http://www.deep-anal.us/?wm=443
http://www.teenygirlshome.com/?ref=414

I have run Norton, AdAware, SpyBot, Hijack This - I've checked my hosts files - nada...

I figured I'd be a great guy and send an email to the sites to let them know they had a trade cheater - emails bounced... figures.

I didn't get a home page change, there are no tool bar installs, and when I check running processes everything that is there should be there...

Any ideas?

[Linkster]

Just a thought - but do you have the updates loaded for hijack this and adaware?
Might also try cwshredder and then run hijackthis - but make sure you have the most updated version - there are some new adware programs that update themselves automatically with a fix for the updates for spybot and adaware that have just come out.

http://www.spywareinfo.com/~merijn/files/cwshredder.zip - if you get a virus warning when you d/l it for w32/generic.worm or something like that - D/L this version http://www.spywareinfo.com/~merijn/f...shredder_u.zip - some virus programs see the fix file as a virus

If your computer is too infected, it might not let you to get to those pages - use this instead http://209.133.47.200/~merijn/index.html

If you cant get the cws or hijackthis to run properly - this will help:
http://www.safer-networking.org/files/delcwssk.zip

http://209.133.47.12/~merijn/files/HijackThis.exe is the link for the newest hijackthis

Also one other thing that Ive found - if you run adaware then run these other programs, go back and run adaware again - it misses some the first time around if they are not exposed

[Bell]

wow.... Linkster you really know your stuff....

~Bell

[Netpiddler]

Holy crap Linkster - it sounds like you've been through the wringer before lol! Those are some great links you dropped for me - thank you!

Unfortunately I have had more than my share of nasty viruses and thought I was pretty good at spotting the files, etc...

I did update AdAware, Norton, HiJack This beforehand so I was a bit concerned... Then I tried BHO Demon - nothing new.

Andrej suggested I try Panda Software so I downloaded the free trial of Titanium 2004 and that found 9 nasty trojans/infected files that all the other programs didn't catch!

I will know later on today whether that fixed it or not, but so far so good! I am just glad my kids weren't using this computer...

Thanks alot Linkster for the quick reply!

[tiny]

I use this lil program its free and it looks for spyware and adware and it'll tell ya where they are hiding at in the reg and how to get rid of them
http://www.kephyr.com/spywarescanner...ource=appvisit

That and AVG antivirus save my ass alot and it has a free ver I use.But I'm thinkin about buying the pay ver simply as supporting a good product.
http://www.grisoft.cz/us/us_index.php

[Netpiddler]

Well unfortunately running the Panda Software did not fix the problem...

I followed tiny's advice and grabbed a copy of AVG Antivirus and the problem was identified right away by AVG even before the installation was complete!

For the record I was wrong and I missed the virus in the Running Processes window.

The application was mcc.exe and while AVG Antivirus could NOT fix the issue by itself, I was able to remove it by following the steps outlined here.

Sure enough the urls I was being redirected to were listed right in the Windows Registry.

Thanks to tiny and to all who replied here and via email - you're the best!

[guitar riff]

Another one ya can get to prevent spyware and shit like that from starting Spyware Blaster

I got screwed up by three tgp webmaster pages and finally decide was tme to do something.