Spyware?

[cargenius42]

Ok, just recently, when I start internet explorer, it automatically starts up with some site with this address: http://your-searcher.com/index.htm . I assume that I am infected with spyware and was wondering how to get rid of it. Spybot doesn't seem to be helping.

[DMR]

That sound like a Hijacker to me- I'll move this to the Security forum so that our spyware experts can offer assistance.

SpyBot isn't the be-all and end-all solution for removing malicious programs; as a matter of fact, there is no single program which can find and fix all of the "spyware" variants out there. At the very least, you should also download Ad Aware and HijackThis (download links are in my sig below).

Ad Aware is very similar to SpyBot, but it is updated more frequently and often catches things that SpyBot doesn't; using the two programs together will get rid of all but the nastiest infections. Run the 2 consecutively (the order doesn't matter), choose to have them fix everything they identify, and reboot after each program finishes its job. Make sure to check for and install the latest updates for each program before running them; new updates for Ad Aware are often released every two days or so.

Once you've run Ad Aware and SpyBot:

- Reboot into safe mode and, for every user account listed under C:\Documents and Settings, delete the entire contents of these folders:

1. Local Settings\Temp
2. Cookies
3. History
4. Local Settings\Temporary Internet Files\Content.IE5

- Delete the entire content of your C:\Windows\Temp folder.
- Empty your Recycle Bin.
- Reboot normally.

If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed.

After doing all of the above, create a new separate folder on your drive for HijackThis, move the program into thids folder, and run it from there. (Don't run HJT from within any Temp or Temporary Internet folder, and don't run it directly from your desktop.) Do not have HJT fix anything yet, only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...". Save the log in the folder you created for HiajckThis, open the log in Windows Notepad, and cut-n-paste the entire contents of the log here. The log contents will tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.

[cargenius42]

Ok, I think I fixed the problem. I found a page through google where someone had the same problem. I followed his steps to get rid of the spyware and it seemed to work. Thanks for all of your help tho!!! :cool:

[dlh6213]

Cargenius, to help keep yourself from being reinfected, use spywareblaster; it will install a list of known pests into your browsers Restricted Sites zone.

http://www.javacoolsoftware.com/

DMR, your link to Resources... didn't work for me -- is it just me or has the link gone bad?

[DMR]

DMR, your link to Resources... didn't work for me -- is it just me or has the link gone bad?

Looks like the site got rearranged/reprogrammed; I've updated my link.


cargenius42,

Could you tell us exactly what the fix was or give a link to the instructions you followed? That will help other members who might be having similar problems.

[cargenius42]

I went to http://www.webuser.co.uk/cgi-bin/forums/showflat.pl?Cat=&Board=security&Number=95776&page=5&view=collapsed&sb=5&o=93∂= . Someone had a similar problem and I tried the solution and it worked. :D

[DMR]

Thanks for the info. :)