Adware--spyware? how do I get rid of this?

[Gouki]

A friend of mine has the exact same problem. If you set the homepage to something else, it will be back the next time you run IE. It even comes back when you reboot...

I had downloaded ad-aware and while it found a few occurences of spy/adware...it didn't solve the "lolita" problem. Granted this was before version 5.8 came out...so I might try the new version of ad-aware and see what happens.

John Prophet said he found some registry entries...I might try that as well. I wonder if that worked for him?

[fatal xception]

Funny, I was just reading about this yesterday. This might help also:

http://www.spywareinfo.com/hijacked.html

Oh man I must be slipping!

That link never even registered, and I knew it was porn..

Thanks amdkt7 for the mention! And Thanks AuraEdge for catching that!

Thanks for the link Fatal.

[amdkt7]

I'd delete all cookies and temp files using the control panel, then make sure the temporary internet folder is empty (might need to do it from safe mode).

Next look out for trojon programs running in the background. Run msconfig and exam all entrys in the startup. It might take deleting registry keys to kill it.

Nasty, those porn sites. Very dangerous places, viruses, trogons, spyware, ect.

[Gouki]

I just skimmed through the article that Fatal Exception just posted...quite a bit of good information in there! I'm printing it out now...and will take it over to my friends house this evening. Hopefully we'll rid his computer of Lolita once and for all. lol.

Thanks for all the great tips!

[AuraEdge]

Socalgal PM'ed this to me. I'm posting it out here in hopes that it will help solve the problem.

Socalgal wrote on 05-07-2002 01:28 PM:

Has JP tried running an updated ref Ad-Aware?

Check IE Tools / Options / General - Temporary Internet Files - Settings tab, View Objects - and see if there's an object in there that is referring to the offending app. Delete cache and history while in there too, and to check any other locations where he might have setup non-default caches/temp files.

Otherwise, I'd suggest another registry scan with keywords relating to the app, - of course backing up the registry first.

Socal

[John Prophet]

oops..sorry about the link..wasnt thinking of it at all. But to me it was important to the question cuz I needed to describe the problem..didnt think of it being a link at all.
Anyway, problem was solved by installing Norton20002 antivirus and doing live update. Upon running scan, it found 6 different viruses that were "auto update" type deals. Had to quarantine them all. Then did an EXTENSIVE registry search for ALL related links to the virus files. Deleted all cookies again, temp files etc. Finally got rid of it. Incidentally, I did run adaware..she had like 46 offending things lol. But evidently it didnt find the particular ones.

I cant remember all the names of the viruses but they were things like..

bvt.exe....in registry and msconfig startup
coolstuff.inf
ausvc.exe..which probably means "auto update service"

Thanks again, Jp

[amdkt7]

Well good!

Glad you got it worked out. Now don't let that computer get near a porn site. It aint safe!

[Redwolf]

Hmmmmm....might wanna check out those viruses. I had accidently clicked a banner on an emulator site (honest officer, 24 hours) and it poipped up like 200 ads ort something. Then avg caught 2 viruses embedded in cookies.