Member Avatar for ethirtynine

i hope i have come to the right place to get help on this issue. this happens everytime i start using internet explorer... i would type something in the address bar, such as www.aol.com or www.yahoo.com, and it would always redirect me to , which is a site hosted by 008k.com

i have tried using cwshredder but the problem keeps occuring. has this happened to anyone? please help, thanks

  • 4 Contributors
  • 6 Replies
  • 275 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by ethirtynine

Dani AI

Generated

As described, the symptom (typing normal addresses and being sent to an affiliate/redirect host) usually means something on the PC is changing name resolution or intercepting browser traffic — common culprits are a modified HOSTS file, a rogue proxy or Winsock/LSP hook, or a malicious browser add-on. The advice from and to do targeted scanning is sensible; 's deletion fixed the symptom but was risky, so follow safe cleanup steps instead of blind deletion.

Check the HOSTS file first. Open Notepad as an administrator and edit:

C:\Windows\System32\drivers\etc\hosts

The file should normally contain only comments and a localhost entry. Remove any extra lines that map normal site names to unfamiliar IPs. Save a backup copy before changing anything.

Clear cached name settings and reset network hooks. Make sure IE is not using a proxy (Tools -> Internet Options -> Connections -> LAN Settings). From a command prompt run:

ipconfig /flushdns
netsh winsock reset

Reboot after running those commands. Flushing DNS removes any cached bad entries; resetting Winsock will remove many network-hooking LSPs that hijackers use.

Other useful steps: boot into Safe Mode and run an up-to-date on-demand malware scanner from clean media; review Startup entries (msconfig) and the StartUp folder for unknown programs; inspect Internet Explorer add-ons/toolbars and remove anything unfamiliar; if System Restore is enabled, disable it briefly to remove infected restore points and then re-enable after cleaning. Always back up personal files before drastic measures. Reformatting will work but should be a last resort — never delete system folders unless you know exactly what they do.

Recommended Answers

All 6 Replies

Member Avatar for ethirtynine

i am running windows XP, if that helps any.

Member Avatar for condorcanqui

have you tried a spyware removal?, spybot is really good
that sounds like spyware.

Member Avatar for sparkyszone

These cyber scum have also hijacked my browser. Has anyone been able to help you yet? I have done a bit of research, and found the losers name (our friend cool) who seems to be an affiliate of 39-93.com. He operates out of england, so not much we can do on this side but badmouth the maggot. I have sent one email off to the owners of the porn portal 008k.com, and It wasn't very friendly. If you are interested, I can give you the information. I feel that I should let them know what maggots they really are, at least ten times a day. Care to join me? If so, let me know, I will send all contact information to you that I can find. Unfortunatly, I cannot seem to remove their hijacker long enough to get an email off, and they have caused alot of time wasted for me. (I am an online marketer).
Anyway, if you have found a way to remove it without having to start all over, please let me know. Ill be lucky if I even get this posted!

Member Avatar for caperjack

Might I suggest Ad-Aware and Spybot

Download the latest version of Ad-Aware at ADAWARE

Download SPYBOT

How to setup Ad-Aware and Spy-Bot S&D
http://www.zerosrealm.com/scanning.php

And after that, please do the following:


Download 'Hijack This!'.

Unzip (extract) it to a folder of its own.Like c:\HJT\hijackthis.exe , Then Doubleclick HijackThis.exe (in the new folder), and hit "Scan".
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, then Ctrl-A to Select All, and copy its contents here. for hijackthis,most of what it lists will be harmless or even essential, don't fix anything yet.

reboot computer and post a new hijackthis log

Member Avatar for sparkyszone

Well, i don't know if this helps. I found the file hiding in WINDOWS/Programs/
in a folder called "services" so I deleted the whole folder. I don't recommend this, as I am not sure what the "services" folder was for, however, i don't have the problem anymore, and I havent seen any problems arise yet from deleting the folder. I still have all of the contact info for the offending parties, and would join anyone in harrassing them.I think they need it.

Member Avatar for ethirtynine

i think i am just going to reformat my computer. instead of being redirected to www.39-93.com i get sent to . my norton anti-virus catches it and it warns me that there are trojans being downloaded automatically. i would follow caperjack's suggestion but im just afraid that there are other infected programs.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.