Search Engine Hijacked by W32.Spybot.Worm?

[iamsmiling]

I've a a XP-Home PC where you get either an error 404 or are misdirected whenever you try to access google or any other search engine. Symantec tells me I have no infections.

Any ideas?

[Droppyale]

did you run adaware or spybot yet?

[Scott Tiger]

It's a worm but it can be removed. I've got a friend that got it and had Norton too. Try running this:

http://vil.nai.com/vil/stinger/

If it doesn't work let me I'll find you something else to try.

[Kc2iLq]

I have the SAME EXACT problem! I run AVG and it hasn't caught anything yet. Ad-aware hasn't found anything either. I was on the phone with my ISP for like an hour and we went one by one through all my network settings, hosts file, etc. and couldn't figure it out.

-Kc2iLq

[Scott Tiger]

Give the stinger a shot. I don't have an infected machine here so I can't test it. If it doesn't work I'll find you something else.

Guess the folks with AVG shouldn't feel bad because an up to date version of Norton 8 Corp Edition isn't getting it either.

[iamsmiling]

Neither Norton or AdAware found it. I'll give the stinger a try.

[Kc2iLq]

I downloaded stinger, am running it now. I'll let ya' know if it works.

-Kc2iLq

[Scott Tiger]

I should have mentioned this earlier but didn't think to cause it's second nature to me now:

You should ALWAYS turn off System Restore on an XP machine before you run the Stinger (or try to remove any virus). As good as System Restore is it will try to restore the virus/worm when Windows reboots. Turn System Restore back on when once the computer's rebooted and you've cleaned off the virus.

-Scott

[Kc2iLq]

Heh, I don't have system restore enabled anyway, but thanks for the heads-up.

-Kc2iLq

[Kc2iLq]

Stinger didn't get anything and I searched the entire C:\ drive. What's next?

-Kc2iLq