Help, Got Spyware

[Horscht]

Hi

im having serious problems at the moment. Yesterday, i fired up my computer, and suddenly i had a different home-page (you know, the page that shows first). Its a totally unknown search page, that must be somwhere on my PC, because it also loads while im not connected to the internet. It shows "about:blank" in the adress bar. I already figured out, that it must be Spy-/adware. So i went on downloading Ad-Aware 6.181 from the official homepage and started it. It came up with 209 (!!!) results, and i deleted them all. Now, i can set my default home-page (www.google.de), and it loads, unless i shut down my PC or restart it. can somebody help me with that? because it freaking annoys me. ANY Help would be appreciated.

thanks in advance

Horscht

 

[Mark]

Are you using P2P, as most are infected somehow.

 

[Horscht]

nope, no KaZaA or emule, not any p2p prog (except for mIRC, but that one works like a chram on our other comp). Also i should mention (I forgot that), that everytime i remove that "infected" stuff, and restart my comp, and search again I get the same 8 results saying "possible Browser HiJack attempt" or something. Thats definatelly causing the problems, but they always come back.

btw: I installed all windows updates.

 

[Mark]

I'm not expert, but have you tried giing the hardrives a good virus scanning?

 

[Horscht]

well, no, because its actually spyware, not a virus. But i´ll have a look, perhaps i can find good one.

 

[Mark]

I don't know but perhaps a virus could install Adware/Spyware after you erase it. Someone will eventually post who has an idea

 

[diablo2]

that happens to me sometimes too
it only happens too ie for me

use firefox!
it is so much beter than ie

you could try spybot search and destroy

 

[raven]

I would check again with Spybot. It often detects spyware that Ad-aware misses.

Edit: and like Diablo said: use Firefox, I have my security settings very high and keep my system up-to-date and still got spyware just by surfing (actually saw it happening but couldn't do anything to stop it) sure MS created a patch 5 days later but that didn't really help me.
Ever since I started using Firefox I haven't gotten any spyware at all. Not even a single tracking cookie.

 

[Horscht]

No, sorry, i cant use firefox (well, actually I can, but my father is too, well, lets say unqualified to use it.). But i got it solved (thanks to Mark). It was some kind of combination of Virus/Spyware. I could remove the spyware with adaware, but the Virus always installed the spyware again. First i treid McAffee Virus scan, and it wasn´t detected, then i tried a free german one, that worked great (www.free-av.de)!

 

[benjaminblasius@web.de]

install Spybot - Search & Destroy, Ad-aware and a personal firewall like the free version of Zone Alarm. works fine for me. for virus scanning i use the free version of AVG.

 

[Thyphoid]

Check your registry with Regedit - take a closer look at the Software/Microsoft/Windows/Autostart Key: there you can see what is loaded at Startup. Also check your Task-Manager. Inform yourself about suspicious running processes with Google. Good Luck. :rolleyes:

 

[Josquius]

Sounds kind of like something which happened to me.
Whats the name of this search engine? Does it have a dodgey pop up search bar?

 

[Horscht]

dont know what teh name was, it was a white page with blue text on it.

 

[Tobriand]

A friend of mine rang me about something that sounds very similar to this. I remember being unable to help him, which was annoying. Right... so free virus scan *and* ad-aware. And spybot too mmmhmmm .

 

[Rico]

Exactly what I would have suggested, having just dealt with it on a friend's laptop. Virus scan THEN remove adware, use Spybot because Ad-Aware has pretty much been discontinued, and finally use firefox anyway. A pretty effective measure is simply to make the Internet Explorer icon point to firefox. If your father is as unskilled as you say he his he might not even notice the difference, and ff auto-imports everything from Internet Explorer for you!

 

[Steve-O]

Boot your System up into "Safe Mode"... Do a Scan with a FULLY updated Version of SPY BOT SEARCH AND DESTROY and then do a Scan With a FULLY updated version of AD-AWARE... Now Do a Virus Scan

Now Restart your computer into normal mode

 

[Efompor]

*is the only one here who actually know's what's wrong*

you-have: Some variant of the Coolwebsearch hijackers

About:Blank pages have been manipulated in a number of these CWS files. Go to www.merijn.org and download CWShredder. Its an extremely useful webite for this kind of thing, the guy is fighting a personal war against coolwebsearch . CoolWebSearch is this russian based company that produces computer viruses and pays shady websites like www.x-cracks.com (stay away from that one) to put their stuff on and make it auto download. I have been infected with the smartsearch.ws variant before and I know how annoying they can get. The variant was so smart that it actually closes Spybot, CWShredder and Hijack This (another useful tool) right when you open them automatically. It also closed my browser windows when I typed keywords like "Virus" and "hijack' in them. Talk about a die-hard ad... <_<
I'm 99% sure you are infected with one of the many variants of CWS.

 

[Horscht]

well, i already solved it. A virus scan brought up a Virus called something like

SD/RT startpage

or similar. At least the word "startpage" was in it.

 

[Efompor]

i still think it was CWS behind it

They're always behind it!