My computer has been hijacked!

[GRUMPA]

I know this my sound silly but have you tried to use spy-bot in safe mode? Theres alot of those "BUGS" that embed themselves so deep into your sys32 folder that even if you find and delete them they just return when you re-boot your comp. I use that program alot and once I got that darn thing out of my comp I de-activate all direct-x controls (cause thats how it happens). But now I use a program called windows trace remover that removes all cookies ect. before I shut down (greatly reduces even remote chance) of attacks.

 

[Junkman]

I would be very hesitant to recommend to anyone that isn't computer literate to use any program that messes with the registry. One wrong move and the patient is dead. As they say... my day starts when your day ends...... and I will be the last one to let you down. You don't want to be owning a dead computer with all those pictures. You also might consider doing a backup of all your important files and pictures. You never know when the hard drive is going to peter out....

 

[tracdoc]

Durbob,

You have certainly been offered a LOT of advice to help you un-hijack. I would agree with most/all, but I would pay careful attention to the ORDER in which you do things.

First, if your computer is working (booting, programs run, etc), I would NOT do a RESTORE. As others have said, that operation will only re-set your computer's "housekeeping" functions to an earlier time. It will not eliminate a hijack problem.

Second, do NOT install Windows SP2 until AFTER you have resolved the current problem. SP2 is not without its own set of problems /forums/images/graemlins/shocked.gif. A number of people have reported boot failure after SP2 installation /forums/images/graemlins/frown.gif. Many times this is the result of an unsigned driver conflict, but it can be a vexing problem to sort out /forums/images/graemlins/confused.gif. Prudence dictates solving your present problem FIRST, before making a change which may bring its own new set of problems.

Third, I would start off using CWShredder, available from:
Download CWShredder 1.59 This is a safe and easily executed utility which, chances are, will eliminate your problem.

Fourth, I would suggest running Ad-aware 6, and quarantine everything it picks up. You can download it here:
Ad-aware Download.

"Hijack This" is a great utility if your problem persists. However, I would strongly suggest that unless you are in to this stuff, you run the utility to collect the data, and then have someone review it before deleting anything.

To PREVENT or minimize repeat hijacking, I would suggest looking at "X-Setup Pro 6.6." It is, like everything else I've emntioned, freeware for an individual user. You can download it here:
X-Setup Pro 6.6 Download Page.

Good luck...

 

[Durbob]

Tracdoc, i have done all that. I have used every spy detector program out there including all the ones mentioned and my homepage still gets hijacked. I know it's in my registry and it's gonna take someone more computer savvy than me to fix it i guess. Thanks for all your help anyway. I'll get it out somehow.
Durbob

 

[Junkman]

Do the restore and see if it helps... if it does, then you are home free...... if it doesn't, then you can do the restore back to the current date. I have found that it has fixed problems for me when I have had a program take control of my computer in a way that I didn't want.

 

[BillyP]

I agree. You don't have nothing to lose but maybe 10 minutes.

 

[Mrwurm]

I started a post about this subject a few weeks back. Thread Link The program I used fixed my hijacker problem when everything else failed. The software is called 'Geek SuperHero', it will reset your IE settings and prevent them from being altered in the future.

 

[Alan L.]

I have had the best luck with Adaware from Lavasoft - its a free download. Have yet to fail to clean up 3 or 4 machines that were badly infected by spyware. It might take 2 scans to clean it up completely.

Something else that can help a tremendous amount is a firewall like Zonealarm. The built-in firewall in XP is very helpful also, in fact thats all I run on this laptop and have had no problems.

 

[Durbob]

I had hopes for the geek superhero Jerry, but after setting it up it couldn't stop the homepage from being hijacked either. I have zone alarm and AVG virus protection along with about 6 spyware programs now. Nothing is working. The cw shredder and ad aware and all the others pick it up , but it comes back after they say it has been deleted. I even found a website that showed how to change the registry to get it out. Spent about 90 minutes doing that for nothing. This thing is buried deep in my computer.

 

[Junkman]

I don't remember the exact method, but when removing a virus, you have to turn off something in windows and then remove the virus. Hopefully someone else here can help with the exact details. If not, in the morning I will look for my copy of the instructions. Junk...

 

[Durbob]

Junkman, your talking about removing a virus in the sound system of your computer. I've done that plenty of times where you had to turn off system restore to remove it. I know what is going on here. There is part of this worm that has disguised itself in a file on my computer and i'm not getting all of it removed. I'll figure it out sooner or later....i think.

 

[Glenn9643]

Do you have an "emergency disk" from an antivirus program available? Most AV programs that I have seen out of the box have a provision for you to prepare a bootable diskette with basic AV programs on it that allow you to remove a virus that may be residing in the computer's memory and reestablishing itself after normal AV scanning. Basically, you shut down your machine and reboot from the "A Drive" and the windows system isn't active. Then you can scan your "C Drive" for the bugs. Good luck.

 

[Durbob]

Well, i just spent $40.00 on the highest recommended software i could find for removing this virus/trojan whatever it is. And guess what , it still comes back after this program deletes it. I tried removing it in safe mode and also with the system restore turned off to no avail. I guess $40.00 buys me some support as i sent them the saved logs of what's going on. They tell me this is one of the most viscious and infecting files there is because it keeps changing itself. Hopefully none of you ever get this and when i get rid of it the IE won't be used by me anymore. I just want to make sure my registry is clean first which is what it keeps changing.

 

[mathey]

hmm...ok, here's some random thoughts...

</font><font color="blue" class="small">( The cw shredder and ad aware and all the others pick it up )</font> ...OK, what do they find? must have a name?

have you checked for the Peper trojan? My home system had it a month or so back and it was a real pain to get rid of...neither Ad-Aware or Spybot (at least at that time) could get rid of it...

here's a link that describes what to look for and where to see if it's resident PEPER LINK

here's another link that may be of help PEPER LINK 2

one other thing...this may be obvious...but after you've installed these programs (Ad-aware, Spybot, etc....) you've gone and gotten all the latest updates, correct?

 

[Durbob]

I have all the latest releases of the spyware programs downloaded. This this is called CWS which you can google coolwebsearch"hijacked" and see what i'm up against. It changes your registry and hides and even changes itself from what i'm told. I have Firefox, Opera, and Netscape browsers that aren't infected by it. So, i'll probably get rid of internet explorer when i finally get all this straightened out.

 

[Richard]

I just had a similar problem.

Go look in C/documents and settings/all users/start menu/programs/startup

I had a win??? file in there that didnt USE to be in there.

I tried to delete it to no availe. So, I had to go into safe mode ("F8" on startup) and then go into there to delete it.

Once I did that, I had my homepage back.

I've deleted the actual file, so I do not recall it's exact name.

I THINK it was something like winlogon but again, I do not recall. I was happy to get rid of it because I knew I keep NOTHING in my startup file.

Hope it helps

 

[JayC]

Could it have been winproc32? That was one of the nasty little buggers that got installed on my computer when I got hijacked. The other one was svchost. Being I use Windows ME, svchost isn't even on the system! I have seen it on WinXP, though, not sure what it does.

 

[Richard]

Winproc32, I THINK that rings a bell. If you go to Start/programs/startup you might see it in there and it will NOT be deletable. I had to go into safe mode and dig it out of the above (way above) file location & delete it. ONce deleted, all was (seemingly) back to normal.

Maybe we can have a tractor pulling contest with ANY sized tractor... and like Hercules, tie the people that make these obnoxious files in the middle of the tractors as the green flag drops... /forums/images/graemlins/crazy.gif

 

[Durbob]

Well, i'm cautiously saying this ( VERY Cautiously). But, i think i might have gotten it out. What a learning experience this has been. I took 3 or 4 spyware programs and got into the registry myself. Looking for things that didn't look right and what the spyware programs said to look for. I went into safe mode and deleted what i needed to and all that and so far my homepage is still back. I have just made a new restore point for future reference also. It seems like no one spyware program had the answer, but getting info from them all and then running them all seems to have done the trick.
I guess this computer may not wind up a boat anchor after all. /forums/images/graemlins/smile.gif Thanks for all your suggestions. It seems i needed them all to figure this out.

Durbob

 

[RSKY]

I had a similar problem and finally went to the add/remove program page in control panel. Found a program there named WinSearch. Removed that one and solved the problem. Took me more than a week to luck up on it though.